public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

rmilter/rspamd service: tighten unix socket permissions

Browse Source
This commit is contained in:
Franz Pletz 2017-03-17 23:01:24 +01:00
parent 8ab2d2ee27
commit 00239ce8e9
No known key found for this signature in database
GPG Key ID: 846FDED7792617B4
2 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
nixos/modules/services/mail/rmilter.nix
View File

@ -5,6 +5,7 @@ with lib;
let let
rspamdCfg = config.services.rspamd; rspamdCfg = config.services.rspamd;
postfixCfg = config.services.postfix;
cfg = config.services.rmilter; cfg = config.services.rmilter;
inetSocket = addr: port: "inet:[${toString port}@${addr}]"; inetSocket = addr: port: "inet:[${toString port}@${addr}]";
@ -219,7 +220,7 @@ in
PermissionsStartOnly = true; PermissionsStartOnly = true;
Restart = "always"; Restart = "always";
RuntimeDirectory = "rmilter"; RuntimeDirectory = "rmilter";
RuntimeDirectoryMode = "0755"; RuntimeDirectoryMode = "0750";
}; };
}; };
@ -231,16 +232,18 @@ in
ListenStream = systemdSocket; ListenStream = systemdSocket;
SocketUser = cfg.user; SocketUser = cfg.user;
SocketGroup = cfg.group; SocketGroup = cfg.group;
SocketMode = "0666"; SocketMode = "0660";
}; };
}; };
}) })
(mkIf (cfg.enable && cfg.rspamd.enable && rspamdCfg.enable) {
users.extraUsers.${cfg.user}.extraGroups = [ rspamdCfg.group ];
})
(mkIf (cfg.enable && cfg.postfix.enable) { (mkIf (cfg.enable && cfg.postfix.enable) {
services.postfix.extraConfig = cfg.postfix.configFragment; services.postfix.extraConfig = cfg.postfix.configFragment;
users.users.postfix.extraGroups = [ cfg.group ]; users.extraUsers.${postfixCfg.user}.extraGroups = [ cfg.group ];
}) })
]; ];
} }

5
nixos/modules/services/mail/rspamd.nix
View File

@ -53,8 +53,11 @@ in
bindSocket = mkOption { bindSocket = mkOption {
type = types.listOf types.str; type = types.listOf types.str;
default = [ default = [
"/run/rspamd/rspamd.sock mode=0666 owner=${cfg.user}" "/run/rspamd/rspamd.sock mode=0660 owner=${cfg.user} group=${cfg.group}"
]; ];
defaultText = ''[
"/run/rspamd/rspamd.sock mode=0660 owner=${cfg.user} group=${cfg.group}"
]'';
description = '' description = ''
List of sockets to listen, in format acceptable by rspamd List of sockets to listen, in format acceptable by rspamd
''; '';