nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-01-22 12:53:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #265733 from nbdd0121/unbound

Browse Source 
nixos/unbound: fix wrong syscall filter and tighten sandbox
This commit is contained in:
Lin Jian 2023-11-16 14:38:46 +08:00 committed by GitHub
commit bf8a6ad72c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
nixos/modules/services/networking/unbound.nix
View File

@ -166,7 +166,7 @@ in {
services.unbound.settings = {
server = {
directory = mkDefault cfg.stateDir;
username = cfg.user;
username = ''""'';
chroot = ''""'';
pidfile = ''""'';
# when running under systemd there is no need to daemonize
@ -245,14 +245,13 @@ in {
NotifyAccess = "main";
Type = "notify";
# FIXME: Which of these do we actually need, can we drop the chroot flag?
AmbientCapabilities = [
"CAP_NET_BIND_SERVICE"
"CAP_NET_RAW" # needed if ip-transparent is set to true
];
CapabilityBoundingSet = [
"CAP_NET_BIND_SERVICE"
"CAP_NET_RAW"
"CAP_SETGID"
"CAP_SETUID"
"CAP_SYS_CHROOT"
"CAP_SYS_RESOURCE"
];
User = cfg.user;
@ -266,22 +265,19 @@ in {
ProtectControlGroups = true;
ProtectKernelModules = true;
ProtectSystem = "strict";
ProtectClock = true;
ProtectHostname = true;
ProtectProc = "invisible";
ProcSubset = "pid";
ProtectKernelLogs = true;
ProtectKernelTunables = true;
RuntimeDirectory = "unbound";
ConfigurationDirectory = "unbound";
StateDirectory = "unbound";
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_NETLINK" "AF_UNIX" ];
RestrictRealtime = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"~@clock"
"@cpu-emulation"
"@debug"
"@keyring"
"@module"
"mount"
"@obsolete"
"@resources"
];
SystemCallFilter = [ "@system-service" ];
RestrictNamespaces = true;
LockPersonality = true;
RestrictSUIDSGID = true;