commit 2d5317c1a036fbcf091c2a29f89c11ef456ef2cd · pyrox.dev/nixpkgs

+27
nixos/modules/services/continuous-integration/jenkins/default.nix
···

       254
       254
        
               StateDirectory = lib.mkIf (lib.hasPrefix "/var/lib/jenkins" cfg.home) "jenkins";

     

       255
       255
        
               # For (possible) socket use

     

       256
       256
        
               RuntimeDirectory = "jenkins";

     

       257
       257
       +
               AmbientCapabilities = "";

     

       258
       258
       +
               CapabilityBoundingSet = "";

     

       259
       259
       +
               LockPersonality = true;

     

       260
       260
       +
               # MemoryDenyWriteExecute = false;   Breaks execution;

     

       261
       261
       +
               NoNewPrivileges = true;

     

       262
       262
       +
               PrivateDevices = true;

     

       263
       263
       +
               PrivateMounts = true;

     

       264
       264
       +
               PrivateTmp = true;

     

       265
       265
       +
               ProtectClock = true;

     

       266
       266
       +
               ProtectControlGroups = true;

     

       267
       267
       +
               ProtectHome = true;

     

       268
       268
       +
               ProtectHostname = true;

     

       269
       269
       +
               ProtectKernelLogs = true;

     

       270
       270
       +
               ProtectKernelModules = true;

     

       271
       271
       +
               ProtectKernelTunables = true;

     

       272
       272
       +
               ProtectSystem = "full";

     

       273
       273
       +
               RemoveIPC = true;

     

       274
       274
       +
               RestrictAddressFamilies = [

     

       275
       275
       +
                 "AF_UNIX"

     

       276
       276
       +
                 "AF_INET"

     

       277
       277
       +
                 "AF_INET6"

     

       278
       278
       +
               ];

     

       279
       279
       +
               RestrictNamespaces = true;

     

       280
       280
       +
               RestrictRealtime = true;

     

       281
       281
       +
               RestrictSUIDSGID = true;

     

       282
       282
       +
               SystemCallArchitectures = "native";

     

       283
       283
       +
               UMask = 27;

     

       257
       284
        
             };

     

       258
       285
        
           };

     

       259
       286
        
         };