nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-12-01 19:33:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

nixos/yggdrasil: remove DynamicUser for systemd 243

Browse Source
This commit is contained in:
Gemini Lasswell 2019-09-22 08:08:42 -07:00 committed by Emery Hemingway
parent b8cb8c39d6
commit d6549a2c42
1 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
nixos/modules/services/networking/yggdrasil.nix
View File

@ -155,7 +155,19 @@ in {
BindReadOnlyPaths = mkIf configFileProvided BindReadOnlyPaths = mkIf configFileProvided
[ "${cfg.configFile}:/run/yggdrasil/configFile.json" ]; [ "${cfg.configFile}:/run/yggdrasil/configFile.json" ];
DynamicUser = true; # TODO: as of yggdrasil 0.3.8 and systemd 243, yggdrasil fails
# to set up the network adapter when DynamicUser is set. See
# github.com/yggdrasil-network/yggdrasil-go/issues/557. The
# following options are implied by DynamicUser according to
# the systemd.exec documentation, and can be removed if the
# upstream issue is fixed and DynamicUser is set to true:
PrivateTmp = true;
RemoveIPC = true;
NoNewPrivileges = true;
ProtectSystem = "strict";
RestrictSUIDSGID = true;
# End of list of options implied by DynamicUser.
AmbientCapabilities = "CAP_NET_ADMIN"; AmbientCapabilities = "CAP_NET_ADMIN";
CapabilityBoundingSet = "CAP_NET_ADMIN"; CapabilityBoundingSet = "CAP_NET_ADMIN";
MemoryDenyWriteExecute = true; MemoryDenyWriteExecute = true;