public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

cjdns service: allow daemon to drop privileges

Browse Source 
The service can run certain components with reduced privileges, but for
that it needs the setuid capability.
This commit is contained in:
Joachim Fasting
2017-02-05 04:46:58 +01:00
parent a0338afe5f
commit 2628597e76
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
nixos/modules/services/networking/cjdns.nix
View File

@@ -258,8 +258,7 @@ in
Restart = "always";
StartLimitInterval = 0;
RestartSec = 1;
CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW";
AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_RAW";
CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW CAP_SETUID";
ProtectSystem = true;
MemoryDenyWriteExecute = true;
ProtectHome = true;