public
/
nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #122241 from dotlambda/znc-harden 

nixos/znc: harden systemd unit
This commit is contained in:
Robert Schütz 2021-05-18 17:44:14 +02:00 committed by GitHub
parent 903665f31c 314a64a026
commit d189df235a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 31 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
nixos/modules/services/networking/znc/default.nix
View File

@ -103,8 +103,8 @@ in
}; };
dataDir = mkOption { dataDir = mkOption {
default = "/var/lib/znc/"; default = "/var/lib/znc";
example = "/home/john/.znc/"; example = "/home/john/.znc";
type = types.path; type = types.path;
description = '' description = ''
The state directory for ZNC. The config and the modules will be linked The state directory for ZNC. The config and the modules will be linked
@ -258,6 +258,34 @@ in
ExecStart = "${pkgs.znc}/bin/znc --foreground --datadir ${cfg.dataDir} ${escapeShellArgs cfg.extraFlags}"; ExecStart = "${pkgs.znc}/bin/znc --foreground --datadir ${cfg.dataDir} ${escapeShellArgs cfg.extraFlags}";
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
ExecStop = "${pkgs.coreutils}/bin/kill -INT $MAINPID"; ExecStop = "${pkgs.coreutils}/bin/kill -INT $MAINPID";
# Hardening
CapabilityBoundingSet = [ "" ];
DevicePolicy = "closed";
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
ReadWritePaths = [ cfg.dataDir ];
RemoveIPC = true;
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
UMask = "0027";
}; };
preStart = '' preStart = ''
mkdir -p ${cfg.dataDir}/configs mkdir -p ${cfg.dataDir}/configs

2
nixos/modules/services/networking/znc/options.nix
View File

@ -44,7 +44,7 @@ let
modules = mkOption { modules = mkOption {
type = types.listOf types.str; type = types.listOf types.str;
default = [ "simple_away" ]; default = [ "simple_away" ];
example = literalExample "[ simple_away sasl ]"; example = literalExample ''[ "simple_away" "sasl" ]'';
description = '' description = ''
ZNC network modules to load. ZNC network modules to load.
''; '';