Merge pull request #61032 from dtzWill/feature/rngd-harden

rngd: harden service config, settings from arch
2019-05-11 23:36:57 +02:00 · 2019-05-11 23:36:57 +02:00 · e8d7f17c81
parent 1a262d01ba e5d049e469
commit e8d7f17c81
1 changed files with 5 additions and 0 deletions
--- a/nixos/modules/security/rngd.nix
+++ b/nixos/modules/security/rngd.nix
@ -42,6 +42,11 @@ in
      serviceConfig = {
        ExecStart = "${pkgs.rng-tools}/sbin/rngd -f"
          + optionalString cfg.debug " -d";
+        NoNewPrivileges = true;
+        PrivateNetwork = true;
+        PrivateTmp = true;
+        ProtectSystem = "full";
+        ProtectHome = true;
      };
    };
  };