public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #97631 from Izorkin/nginx-sandboxing

Browse Source 
nixos/nginx: remove option enableSandbox
This commit is contained in:
Florian Klink 2020-09-10 20:33:25 +02:00 committed by GitHub
commit 484632983f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 2 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
nixos/doc/manual/release-notes/rl-2009.xml
View File

@ -427,8 +427,8 @@ php.override {
</listitem> </listitem>
<listitem> <listitem>
<para> <para>
Add option <literal>services.nginx.enableSandbox</literal> to starting Nginx web server with additional sandbox/hardening options. Nginx web server now starting with additional sandbox/hardening options. By default, write access
By default, write access to <literal>services.nginx.stateDir</literal> is allowed. To allow writing to other folders, to <literal>services.nginx.stateDir</literal> is allowed. To allow writing to other folders,
use <literal>systemd.services.nginx.serviceConfig.ReadWritePaths</literal> use <literal>systemd.services.nginx.serviceConfig.ReadWritePaths</literal>
<programlisting> <programlisting>
systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ]; systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];

9
nixos/modules/services/web-servers/nginx/default.nix
View File

@ -463,14 +463,6 @@ in
''; '';
}; };
enableSandbox = mkOption {
default = false;
type = types.bool;
description = ''
Starting Nginx web server with additional sandbox/hardening options.
'';
};
user = mkOption { user = mkOption {
type = types.str; type = types.str;
default = "nginx"; default = "nginx";
@ -728,7 +720,6 @@ in
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_RESOURCE" ]; CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_RESOURCE" ];
# Security # Security
NoNewPrivileges = true; NoNewPrivileges = true;
} // optionalAttrs cfg.enableSandbox {
# Sandboxing # Sandboxing
ProtectSystem = "strict"; ProtectSystem = "strict";
ProtectHome = mkDefault true; ProtectHome = mkDefault true;

1
nixos/tests/nginx-sandbox.nix
View File

@ -18,7 +18,6 @@ import ./make-test-python.nix ({ pkgs, ... }: {
]; ];
services.nginx.enable = true; services.nginx.enable = true;
services.nginx.package = pkgs.nginx-lua; services.nginx.package = pkgs.nginx-lua;
services.nginx.enableSandbox = true;
services.nginx.virtualHosts.localhost = { services.nginx.virtualHosts.localhost = {
extraConfig = '' extraConfig = ''
location /test1-write { location /test1-write {