From 53218d4a39cf2e9a09bec1b56d9ded7c444f71cc Mon Sep 17 00:00:00 2001 From: Renaud Date: Sat, 8 Dec 2018 14:41:37 +0100 Subject: [PATCH] nixos/systemd-nspawn: accept all Exec and Files options See: https://www.freedesktop.org/software/systemd/man/systemd.nspawn.html Closes #49712 --- nixos/modules/system/boot/systemd-nspawn.nix | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/nixos/modules/system/boot/systemd-nspawn.nix b/nixos/modules/system/boot/systemd-nspawn.nix index 649453418b5..34a34091a7d 100644 --- a/nixos/modules/system/boot/systemd-nspawn.nix +++ b/nixos/modules/system/boot/systemd-nspawn.nix @@ -10,8 +10,13 @@ let checkExec = checkUnitConfig "Exec" [ (assertOnlyFields [ "Boot" "ProcessTwo" "Parameters" "Environment" "User" "WorkingDirectory" - "Capability" "DropCapability" "KillSignal" "Personality" "MachineId" - "PrivateUsers" "NotifyReady" + "PivotRoot" "Capability" "DropCapability" "NoNewPrivileges" "KillSignal" + "Personality" "MachineId" "PrivateUsers" "NotifyReady" "SystemCallFilter" + "LimitCPU" "LimitFSIZE" "LimitDATA" "LimitSTACK" "LimitCORE" "LimitRSS" + "LimitNOFILE" "LimitAS" "LimitNPROC" "LimitMEMLOCK" "LimitLOCKS" + "LimitSIGPENDING" "LimitMSGQUEUE" "LimitNICE" "LimitRTPRIO" "LimitRTTIME" + "OOMScoreAdjust" "CPUAffinity" "Hostname" "ResolvConf" "Timezone" + "LinkJournal" ]) (assertValueOneOf "Boot" boolValues) (assertValueOneOf "ProcessTwo" boolValues) @@ -20,8 +25,8 @@ let checkFiles = checkUnitConfig "Files" [ (assertOnlyFields [ - "ReadOnly" "Volatile" "Bind" "BindReadOnly" "TemporaryFileSystems" - "PrivateUsersChown" + "ReadOnly" "Volatile" "Bind" "BindReadOnly" "TemporaryFileSystem" + "Overlay" "OverlayReadOnly" "PrivateUsersChown" ]) (assertValueOneOf "ReadOnly" boolValues) (assertValueOneOf "Volatile" (boolValues ++ [ "state" ]))