Drift/pvv-nixos-config
Drift
/
pvv-nixos-config
16
4
Fork 1
Code Issues Pull Requests 6 Wiki Activity

systemd hardening for pvv-nettsiden-gallery-update.service #90

Merged
alfhj merged 2 commits from gallery-service-hardening into main 2024-11-09 22:22:09 +01:00
Conversation 0 Commits 2 Files Changed 1 +2 -2
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit de90a8e827 - Show all commits

4
hosts/bekkalokk/services/website/fetch-gallery.nix
View File

@ -70,7 +70,7 @@ in {
MemoryDenyWriteExecute = true; MemoryDenyWriteExecute = true;
NoNewPrivileges = true; # disable for third party rotate scripts NoNewPrivileges = true; # disable for third party rotate scripts
PrivateDevices = true; PrivateDevices = true;
#PrivateNetwork = true; # disable for mail delivery PrivateNetwork = true; # disable for mail delivery
PrivateTmp = true; PrivateTmp = true;
ProtectClock = true; ProtectClock = true;
ProtectControlGroups = true; ProtectControlGroups = true;
@ -84,7 +84,7 @@ in {
RestrictNamespaces = true; RestrictNamespaces = true;
RestrictRealtime = true; RestrictRealtime = true;
RestrictSUIDSGID = true; # disable for creating setgid directories RestrictSUIDSGID = true; # disable for creating setgid directories
#SocketBindDeny = [ "any" ]; SocketBindDeny = [ "any" ];
SystemCallArchitectures = "native"; SystemCallArchitectures = "native";
SystemCallFilter = [ SystemCallFilter = [
"@system-service" "@system-service"