nixos/geoipupdate: Add stricter service security

talyz 7cc39b13 41c82cd5

Changed files
+20
nixos
modules
services
+20
nixos/modules/services/misc/geoipupdate.nix
···
ReadWritePaths = cfg.settings.DatabaseDirectory;
RuntimeDirectory = "geoipupdate";
RuntimeDirectoryMode = 0700;
+
CapabilityBoundingSet = "";
+
PrivateDevices = true;
+
PrivateMounts = true;
+
PrivateUsers = true;
+
ProtectClock = true;
+
ProtectControlGroups = true;
+
ProtectHome = true;
+
ProtectHostname = true;
+
ProtectKernelLogs = true;
+
ProtectKernelModules = true;
+
ProtectKernelTunables = true;
+
ProtectProc = "invisible";
+
ProcSubset = "pid";
+
SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+
RestrictRealtime = true;
+
RestrictNamespaces = true;
+
MemoryDenyWriteExecute = true;
+
LockPersonality = true;
+
SystemCallArchitectures = "native";
};
};