nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-29 10:23:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

nixos/yggdrasil: remove DynamicUser for systemd 243

Browse Source
This commit is contained in:
Gemini Lasswell 2019-09-22 08:08:42 -07:00 committed by Emery Hemingway
parent b8cb8c39d6
commit d6549a2c42
1 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
nixos/modules/services/networking/yggdrasil.nix
View File

@ -155,7 +155,19 @@ in {
BindReadOnlyPaths = mkIf configFileProvided
[ "${cfg.configFile}:/run/yggdrasil/configFile.json" ];
DynamicUser = true;
# TODO: as of yggdrasil 0.3.8 and systemd 243, yggdrasil fails
# to set up the network adapter when DynamicUser is set. See
# github.com/yggdrasil-network/yggdrasil-go/issues/557. The
# following options are implied by DynamicUser according to
# the systemd.exec documentation, and can be removed if the
# upstream issue is fixed and DynamicUser is set to true:
PrivateTmp = true;
RemoveIPC = true;
NoNewPrivileges = true;
ProtectSystem = "strict";
RestrictSUIDSGID = true;
# End of list of options implied by DynamicUser.
AmbientCapabilities = "CAP_NET_ADMIN";
CapabilityBoundingSet = "CAP_NET_ADMIN";
MemoryDenyWriteExecute = true;