nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-02-21 11:34:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

nginxModules: add option allowMemoryWriteExecute

Browse Source 
The allowMemoryWriteExecute option is required to checking enabled nginxModules
and disable the nginx sandbox mode MemoryDenyWriteExecute.
This commit is contained in:
Izorkin 2020-05-11 14:29:16 +03:00
parent c7106610f1
commit aa12fb8adb
2 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
nixos/modules/services/web-servers/nginx/default.nix
View File

@ -724,7 +724,7 @@ in
ProtectControlGroups = true; ProtectControlGroups = true;
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ]; RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
LockPersonality = true; LockPersonality = true;
MemoryDenyWriteExecute = mkDefault true; MemoryDenyWriteExecute = !(builtins.any (mod: (mod.allowMemoryWriteExecute or false)) pkgs.nginx.modules);
RestrictRealtime = true; RestrictRealtime = true;
RestrictSUIDSGID = true; RestrictSUIDSGID = true;
PrivateMounts = true; PrivateMounts = true;

3
pkgs/servers/http/nginx/modules.nix
View File

@ -140,6 +140,7 @@ in
export LUAJIT_LIB="${pkgs.luajit}/lib" export LUAJIT_LIB="${pkgs.luajit}/lib"
export LUAJIT_INC="${pkgs.luajit}/include/luajit-2.0" export LUAJIT_INC="${pkgs.luajit}/include/luajit-2.0"
''; '';
allowMemoryWriteExecute = true;
}; };
lua-upstream = { lua-upstream = {
@ -150,6 +151,7 @@ in
sha256 = "1gqccg8airli3i9103zv1zfwbjm27h235qjabfbfqk503rjamkpk"; sha256 = "1gqccg8airli3i9103zv1zfwbjm27h235qjabfbfqk503rjamkpk";
}; };
inputs = [ pkgs.luajit ]; inputs = [ pkgs.luajit ];
allowMemoryWriteExecute = true;
}; };
modsecurity = { modsecurity = {
@ -246,6 +248,7 @@ in
in { in {
src = ngx_pagespeed; src = ngx_pagespeed;
inputs = [ pkgs.zlib pkgs.libuuid ]; # psol deps inputs = [ pkgs.zlib pkgs.libuuid ]; # psol deps
allowMemoryWriteExecute = true;
}; };
pam = { pam = {