commit 7cc39b13b00dd8ce5eebc5a1cb53e3de22dc9b99 · pyrox.dev/nixpkgs

+20
nixos/modules/services/misc/geoipupdate.nix
···

       150
       150
        
               ReadWritePaths = cfg.settings.DatabaseDirectory;

     

       151
       151
        
               RuntimeDirectory = "geoipupdate";

     

       152
       152
        
               RuntimeDirectoryMode = 0700;

     

       153
       153
       +
               CapabilityBoundingSet = "";

     

       154
       154
       +
               PrivateDevices = true;

     

       155
       155
       +
               PrivateMounts = true;

     

       156
       156
       +
               PrivateUsers = true;

     

       157
       157
       +
               ProtectClock = true;

     

       158
       158
       +
               ProtectControlGroups = true;

     

       159
       159
       +
               ProtectHome = true;

     

       160
       160
       +
               ProtectHostname = true;

     

       161
       161
       +
               ProtectKernelLogs = true;

     

       162
       162
       +
               ProtectKernelModules = true;

     

       163
       163
       +
               ProtectKernelTunables = true;

     

       164
       164
       +
               ProtectProc = "invisible";

     

       165
       165
       +
               ProcSubset = "pid";

     

       166
       166
       +
               SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];

     

       167
       167
       +
               RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];

     

       168
       168
       +
               RestrictRealtime = true;

     

       169
       169
       +
               RestrictNamespaces = true;

     

       170
       170
       +
               MemoryDenyWriteExecute = true;

     

       171
       171
       +
               LockPersonality = true;

     

       172
       172
       +
               SystemCallArchitectures = "native";

     

       153
       173
        
             };

     

       154
       174
        
           };

     

       155
       175