public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #120620 from mweinelt/empty-capability-bounding-sets

Browse Source 
nixos/{opendkim,rspamd}: Fix CapabilityBoundingSet option
This commit is contained in:
lewo
2021-05-01 08:17:19 +02:00
committed by GitHub
parent 3b07746b0a 6f358fa1d4
commit 85aef7706e
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
nixos/modules/services/mail/opendkim.nix
View File

@@ -134,7 +134,7 @@ in {
ReadWritePaths = [ cfg.keyPath ];
AmbientCapabilities = [];
CapabilityBoundingSet = [];
CapabilityBoundingSet = "";
DevicePolicy = "closed";
LockPersonality = true;
MemoryDenyWriteExecute = true;

2
nixos/modules/services/mail/rspamd.nix
View File

@@ -410,7 +410,7 @@ in
StateDirectoryMode = "0700";
AmbientCapabilities = [];
CapabilityBoundingSet = [];
CapabilityBoundingSet = "";
DevicePolicy = "closed";
LockPersonality = true;
NoNewPrivileges = true;