mirror of
https://github.com/NixOS/nixpkgs.git
synced 2025-01-06 21:13:40 +00:00
cb10fe8aaf
Systemd units with `PrivateUsers` set get their capabilities within the user namespace only [1]. As a result they do cannot bind to privileged ports even though they *appear* like they should be able to. The units in this commit [2] set `PrivateUsers` unconditionally so binding to privileged ports is currently impossible. Granting them CAP_NET_BIND_SERVICE is useless and misleading any reader of those modules. Technically, this commit also hardens these modules ever so slightly. (There are corner cases where this could make sense (e.g. across units, using `JoinsNamspaceOf`) but this is arcane enough to not to be present in nixpkgs.) [1]: systemd.exec(5): PrivateUsers [2]: found using `rg -e 'PrivateUsers.?=\s+[^f][^a]' -l | xargs rg -e '\bCAP_' -l` |
||
|---|---|---|
| .. | ||
| accessibility | ||
| admin | ||
| amqp | ||
| audio | ||
| backup | ||
| blockchain/ethereum | ||
| cluster | ||
| computing | ||
| continuous-integration | ||
| databases | ||
| desktop-managers | ||
| desktops | ||
| development | ||
| display-managers | ||
| editors | ||
| finance | ||
| games | ||
| hardware | ||
| home-automation | ||
| logging | ||
| matrix | ||
| misc | ||
| monitoring | ||
| network-filesystems | ||
| networking | ||
| printing | ||
| scheduling | ||
| search | ||
| security | ||
| system | ||
| torrent | ||
| tracing | ||
| ttys | ||
| video | ||
| wayland | ||
| web-apps | ||
| web-servers | ||
| x11 | ||