6efcfe03ae
A new internal config option `fileSystems.<name>.early` is added to indicate that the filesystem needs to be loaded very early (i.e. in initrd). They are transformed to a shell script in `system.build.earlyMountScript` with calls to an undefined `specialMount` function, which is expected to be caller-specific. This option is used by stage-1, stage-2 and activation script to set up and remount those filesystems. Options for them are updated according to systemd defaults.
26 lines
988 B
Nix
26 lines
988 B
Nix
{ config, pkgs, lib, ... }:
|
|
with lib;
|
|
|
|
{
|
|
options = {
|
|
security.hideProcessInformation = mkEnableOption "" // { description = ''
|
|
Restrict access to process information to the owning user. Enabling
|
|
this option implies, among other things, that command-line arguments
|
|
remain private. This option is recommended for most systems, unless
|
|
there's a legitimate reason for allowing unprivileged users to inspect
|
|
the process information of other users.
|
|
|
|
Members of the group "proc" are exempt from process information hiding.
|
|
To allow a service to run without process information hiding, add "proc"
|
|
to its supplementary groups via
|
|
<option>systemd.services.<name?>.serviceConfig.SupplementaryGroups</option>.
|
|
''; };
|
|
};
|
|
|
|
config = mkIf config.security.hideProcessInformation {
|
|
users.groups.proc.gid = config.ids.gids.proc;
|
|
|
|
fileSystems."/proc".options = [ "hidepid=2" "gid=${toString config.ids.gids.proc}" ];
|
|
};
|
|
}
|