pyrox.dev / nixpkgs
lol
fork atom

nixos/chrony: allow @chown syscall set

The module was allowing specific chown syscalls, which is brittle because
there are several and different ones are used by glibc on different
architectures. For example, fchownat was already added to the allowlist for
aarch64, while on armv6l chrony crashes because chown32 is not in the
allowlist.

systemd provides the @chown syscall set, which includes all the chown
syscalls and avoids this brittleness. I believe the syscalls would all be
equivalent from an attacker's perspective, so there is unlikely to be any
security impact.

Ben Wolsieffer b92dae96 ccd25041

options
unified split
Changed files
+1 -1
nixos
modules
services
networking
ntp
chrony.nix
+1 -1
nixos/modules/services/networking/ntp/chrony.nix 
···

       
203

       
203

       
 

       
          PrivateMounts = true;


     

       
204

       
204

       
 

       
          # System Call Filtering


     

       
205

       
205

       
 

       
          SystemCallArchitectures = "native";


     

       
206

       

       
-

       
          SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @resources" "@clock" "@setuid" "capset" "chown" ] ++ lib.optional pkgs.stdenv.hostPlatform.isAarch64 "fchownat";


     

       

       
206

       
+

       
          SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @resources" "@clock" "@setuid" "capset" "@chown" ];


     

       
207

       
207

       
 

       
        };


     

       
208

       
208

       
 

       
      };


     

       
209

       
209

       
 

       
  };