public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/dnscrypt-proxy2: more service hardening

Browse Source 
added 'ProtectClock' and made the seccomp filter a bit more restrictive
have been running with these settings for a while with zero problems
This commit is contained in:
snicket2100 2021-01-02 18:09:49 +01:00
parent d47eae33b0
commit 2bab1a76c6
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
nixos/modules/services/networking/dnscrypt-proxy2.nix
View File

@ -87,6 +87,7 @@ in
NoNewPrivileges = true; NoNewPrivileges = true;
NonBlocking = true; NonBlocking = true;
PrivateDevices = true; PrivateDevices = true;
ProtectClock = true;
ProtectControlGroups = true; ProtectControlGroups = true;
ProtectHome = true; ProtectHome = true;
ProtectHostname = true; ProtectHostname = true;
@ -107,8 +108,13 @@ in
SystemCallFilter = [ SystemCallFilter = [
"@system-service" "@system-service"
"@chown" "@chown"
"~@aio"
"~@keyring"
"~@memlock"
"~@resources" "~@resources"
"@privileged" "~@setuid"
"~@sync"
"~@timer"
]; ];
}; };
}; };