swendel/nixpkgs
1
0
Fork 0
mirror of https://github.com/SebastianWendel/nixpkgs.git synced 2024-09-20 12:29:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #118855 from bachp/unifi-harden

Browse source 
nixos/unifi: harden service
This commit is contained in:
Pascal Bach 2021-08-07 14:48:25 +02:00 committed by GitHub
parent a743aa80a3 f552bd52b5
commit 463be7303e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 35 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

35
nixos/modules/services/networking/unifi.nix
View file

@ -173,6 +173,41 @@ in
User = "unifi";
UMask = "0077";
WorkingDirectory = "${stateDir}";
# Hardening
AmbientCapabilities = "";
CapabilityBoundingSet = "";
# ProtectClock= adds DeviceAllow=char-rtc r
DeviceAllow = "";
DevicePolicy = "closed";
LockPersonality = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateMounts = true;
PrivateTmp = true;
PrivateUsers = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectSystem = "strict";
RemoveIPC = true;
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallErrorNumber = "EPERM";
SystemCallFilter = [ "@system-service" ];
# Required for ProtectSystem=strict
BindPaths = [ stateDir ];
# Needs network access
PrivateNetwork = false;
# Cannot be true due to OpenJDK
MemoryDenyWriteExecute = false;
};
};