commit 7762c2233c801f22cb0e377dcef2a2b510609f9b · pyrox.dev/nixpkgs

+18 -1

nixos/modules/services/backup/restic-rest-server.nix

···

       80
        
               Group = "restic";

     

       81
        
       

     

       82
        
               # Security hardening

     

       83
       -
               ReadWritePaths = [ cfg.dataDir ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       84
        
               PrivateTmp = true;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       85
        
               ProtectSystem = "strict";

     

       86
        
               ProtectKernelTunables = true;

     

       87
        
               ProtectKernelModules = true;

     

       88
        
               ProtectControlGroups = true;

     

       89
        
               PrivateDevices = true;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       90
        
             };

     

       91
        
           };

     

       92

···

       80
        
               Group = "restic";

     

       81
        
       

     

       82
        
               # Security hardening

     

       83
       +
               CapabilityBoundingSet = "";

     

       84
       +
               LockPersonality = true;

     

       85
       +
               MemoryDenyWriteExecute = true;

     

       86
       +
               NoNewPrivileges = true;

     

       87
        
               PrivateTmp = true;

     

       88
       +
               PrivateUsers = true;

     

       89
       +
               ProtectClock = true;

     

       90
       +
               ProtectHome = true;

     

       91
       +
               ProtectHostname = true;

     

       92
       +
               ProtectKernelLogs = true;

     

       93
       +
               ProtectProc = "invisible";

     

       94
        
               ProtectSystem = "strict";

     

       95
        
               ProtectKernelTunables = true;

     

       96
        
               ProtectKernelModules = true;

     

       97
        
               ProtectControlGroups = true;

     

       98
        
               PrivateDevices = true;

     

       99
       +
               ReadWritePaths = [ cfg.dataDir ];

     

       100
       +
               RemoveIPC = true;

     

       101
       +
               RestrictNamespaces = true;

     

       102
       +
               RestrictRealtime = true;

     

       103
       +
               RestrictSUIDSGID = true;

     

       104
       +
               SystemCallArchitectures = "native";

     

       105
       +
               SystemCallFilter = "@system-service";

     

       106
       +
               UMask = 027;

     

       107
        
             };

     

       108
        
           };

     

       109