nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-27 17:33:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

nixos/unbound: fix wrong syscall filter

Browse Source 
This changes the syscall filter to match that of upstream. Note that

    SystemCallFilter=~foo bar

is completely different from

    SystemCallFilter=~foo
    SystemCallFilter=bar

The former one means that foo and bar are forbidden, and the latter
one means foo is forbidden and bar is granted!
This commit is contained in:
Gary Guo 2023-11-05 20:31:52 +00:00
parent 6e9240e25b
commit c70614c0a4
1 changed files with 1 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
nixos/modules/services/networking/unbound.nix
View File

@ -273,14 +273,7 @@ in {
RestrictRealtime = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"~@clock"
"@cpu-emulation"
"@debug"
"@keyring"
"@module"
"mount"
"@obsolete"
"@resources"
"~@clock @cpu-emulation @debug @keyring @module mount @obsolete @resources"
];
RestrictNamespaces = true;
LockPersonality = true;