public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

knot: drop dynamic user

Browse Source 
This makes it hard to include secret files.
Also using tools like keymgr becomes harder.
This commit is contained in:
Jörg Thalheim 2020-02-12 16:34:10 +00:00
parent 6adc09ed30
commit 88029bce39
No known key found for this signature in database
GPG Key ID: 003F2096411B5F92
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
nixos/modules/services/networking/knot.nix
View File

@ -65,6 +65,13 @@ in {
}; };
config = mkIf config.services.knot.enable { config = mkIf config.services.knot.enable {
users.users.knot = {
isSystemUser = true;
group = "knot";
description = "Knot daemon user";
};
users.groups.knot.gid = null;
systemd.services.knot = { systemd.services.knot = {
unitConfig.Documentation = "man:knotd(8) man:knot.conf(5) man:knotc(8) https://www.knot-dns.cz/docs/${cfg.package.version}/html/"; unitConfig.Documentation = "man:knotd(8) man:knot.conf(5) man:knotc(8) https://www.knot-dns.cz/docs/${cfg.package.version}/html/";
description = cfg.package.meta.description; description = cfg.package.meta.description;
@ -79,7 +86,7 @@ in {
CapabilityBoundingSet = "CAP_NET_BIND_SERVICE CAP_SETPCAP"; CapabilityBoundingSet = "CAP_NET_BIND_SERVICE CAP_SETPCAP";
AmbientCapabilities = "CAP_NET_BIND_SERVICE CAP_SETPCAP"; AmbientCapabilities = "CAP_NET_BIND_SERVICE CAP_SETPCAP";
NoNewPrivileges = true; NoNewPrivileges = true;
DynamicUser = "yes"; User = "knot";
RuntimeDirectory = "knot"; RuntimeDirectory = "knot";
StateDirectory = "knot"; StateDirectory = "knot";
StateDirectoryMode = "0700"; StateDirectoryMode = "0700";