robin/evtype
1
0
Fork 0
mirror of https://codeberg.org/icewind/evtype.git synced 2026-06-03 09:34:11 +02:00
Code Issues Projects Releases Packages Wiki Activity

further systemd sandboxing

Browse source
This commit is contained in:
Robin Appelman 2024-08-11 15:40:55 +02:00
commit 0dfa47f921
2 changed files with 33 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

8
nix/module.nix
View file

@ -38,6 +38,12 @@ in {
ProtectControlGroups = true;
SystemCallArchitectures = "native";
ProtectKernelModules = true;
RestrictSUIDSGID = true;
ProtectProc = "invisible";
ProcSubset = "pid";
PrivateUsers = true;
DevicePolicy = "strict";
DeviceAllow = ["/dev/uinput" "/dev/stdout"];
RestrictNamespaces = true;
MemoryDenyWriteExecute = true;
ProtectHostname = true;
@ -46,8 +52,10 @@ in {
RestrictAddressFamilies = ["AF_UNIX"];
RestrictRealtime = true;
SystemCallFilter = ["@system-service" "~@resources" "~@privileged"];
PrivateNetwork = true;
IPAddressDeny = "any";
RuntimeDirectory = "evtype";
UMask = "0077";
};
};
};