commit eccf6388229ab41dec9b97244fe0432490cbc4cb · pyrox.dev/nixpkgs

+13 -6
nixos/modules/services/web-apps/echoip.nix
···

       75
       75
        
               );

     

       76
       76
        
       

     

       77
       77
        
               # Hardening

     

       78
       78
       +
               AmbientCapabilities = "";

     

       78
       79
        
               CapabilityBoundingSet = [ "" ];

     

       79
       79
       -
               DeviceAllow = [ "" ];

     

       80
       80
       +
               DevicePolicy = "closed";

     

       80
       81
        
               LockPersonality = true;

     

       82
       82
       +
               MemoryDenyWriteExecute = true;

     

       83
       83
       +
               NoNewPrivileges = true;

     

       81
       84
        
               PrivateDevices = true;

     

       82
       85
        
               PrivateTmp = true;

     

       83
       86
        
               PrivateUsers = true;

     
···

       91
       94
        
               ProtectKernelTunables = true;

     

       92
       95
        
               ProtectProc = "invisible";

     

       93
       96
        
               ProtectSystem = "strict";

     

       94
       94
       -
               RestrictAddressFamilies = [

     

       95
       95
       -
                 "AF_INET"

     

       96
       96
       -
                 "AF_INET6"

     

       97
       97
       -
                 "AF_UNIX"

     

       98
       98
       -
               ];

     

       97
       97
       +
               RemoveIPC = true;

     

       98
       98
       +
               RestrictAddressFamilies = [ "AF_INET AF_INET6 AF_UNIX" ];

     

       99
       99
        
               RestrictNamespaces = true;

     

       100
       100
        
               RestrictRealtime = true;

     

       101
       101
        
               RestrictSUIDSGID = true;

     

       102
       102
        
               SystemCallArchitectures = "native";

     

       103
       103
       +
               SystemCallFilter = [

     

       104
       104
       +
                 "@system-service"

     

       105
       105
       +
                 "~@privileged"

     

       106
       106
       +
                 "~@resources"

     

       107
       107
       +
                 "setrlimit"

     

       108
       108
       +
               ];

     

       109
       109
       +
               UMask = "0077";

     

       103
       110
        
             };

     

       104
       111
        
           };

     

       105
       112