commit feebe402f55fcb38b873370bee8fa09979018e85 · pyrox.dev/nixpkgs

+1 -1

nixos/modules/services/databases/redis.nix

···

       331
        
               PrivateMounts = true;

     

       332
        
               # System Call Filtering

     

       333
        
               SystemCallArchitectures = "native";

     

       334
       -
               SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @privileged @raw-io @reboot @resources @setuid @swap";

     

       335
        
             };

     

       336
        
           };

     

       337
        
         };

···

       331
        
               PrivateMounts = true;

     

       332
        
               # System Call Filtering

     

       333
        
               SystemCallArchitectures = "native";

     

       334
       +
               SystemCallFilter = "~@cpu-emulation @debug @keyring @memlock @mount @obsolete @privileged @resources @setuid";

     

       335
        
             };

     

       336
        
           };

     

       337
        
         };

+1 -3

nixos/modules/services/misc/jellyfin.nix

···

       92
        
               SystemCallErrorNumber = "EPERM";

     

       93
        
               SystemCallFilter = [

     

       94
        
                 "@system-service"

     

       95
       -
       

     

       96
       -
                 "~@chown" "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@module"

     

       97
       -
                 "~@obsolete" "~@privileged" "~@setuid"

     

       98
        
               ];

     

       99
        
             };

     

       100
        
           };

···

       92
        
               SystemCallErrorNumber = "EPERM";

     

       93
        
               SystemCallFilter = [

     

       94
        
                 "@system-service"

     

       95
       +
                 "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@obsolete" "~@privileged" "~@setuid"

     

       0
        
       
     

       0
        
       
     

       96
        
               ];

     

       97
        
             };

     

       98
        
           };

+1 -1

nixos/modules/services/network-filesystems/samba-wsdd.nix

···

       117
        
               PrivateMounts = true;

     

       118
        
               # System Call Filtering

     

       119
        
               SystemCallArchitectures = "native";

     

       120
       -
               SystemCallFilter = "~@clock @cpu-emulation @debug @module @mount @obsolete @privileged @raw-io @reboot @resources @swap";

     

       121
        
             };

     

       122
        
           };

     

       123
        
         };

···

       117
        
               PrivateMounts = true;

     

       118
        
               # System Call Filtering

     

       119
        
               SystemCallArchitectures = "native";

     

       120
       +
               SystemCallFilter = "~@cpu-emulation @debug @mount @obsolete @privileged @resources";

     

       121
        
             };

     

       122
        
           };

     

       123
        
         };

+1 -3

nixos/modules/services/networking/croc.nix

···

       72
        
               RuntimeDirectoryMode = "700";

     

       73
        
               SystemCallFilter = [

     

       74
        
                 "@system-service"

     

       75
       -
                 "~@aio" "~@chown" "~@keyring" "~@memlock"

     

       76
       -
                 "~@privileged" "~@resources" "~@setuid"

     

       77
       -
                 "~@sync" "~@timer"

     

       78
        
               ];

     

       79
        
               SystemCallArchitectures = "native";

     

       80
        
               SystemCallErrorNumber = "EPERM";

···

       72
        
               RuntimeDirectoryMode = "700";

     

       73
        
               SystemCallFilter = [

     

       74
        
                 "@system-service"

     

       75
       +
                 "~@aio" "~@keyring" "~@memlock" "~@privileged" "~@resources" "~@setuid" "~@sync" "~@timer"

     

       0
        
       
     

       0
        
       
     

       76
        
               ];

     

       77
        
               SystemCallArchitectures = "native";

     

       78
        
               SystemCallErrorNumber = "EPERM";

+1 -4

nixos/modules/services/web-apps/shiori.nix

···

       86
        
               SystemCallErrorNumber = "EPERM";

     

       87
        
               SystemCallFilter = [

     

       88
        
                 "@system-service"

     

       89
       -
       

     

       90
       -
                 "~@chown" "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock"

     

       91
       -
                 "~@module" "~@obsolete" "~@privileged" "~@raw-io"

     

       92
       -
                 "~@resources" "~@setuid"

     

       93
        
               ];

     

       94
        
             };

     

       95
        
           };

···

       86
        
               SystemCallErrorNumber = "EPERM";

     

       87
        
               SystemCallFilter = [

     

       88
        
                 "@system-service"

     

       89
       +
                 "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@obsolete" "~@privileged" "~@resources" "~@setuid"

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       90
        
               ];

     

       91
        
             };

     

       92
        
           };

+1 -1

nixos/modules/services/web-servers/nginx/default.nix

···

       850
        
               PrivateMounts = true;

     

       851
        
               # System Call Filtering

     

       852
        
               SystemCallArchitectures = "native";

     

       853
       -
               SystemCallFilter = "~@chown @cpu-emulation @debug @keyring @ipc @module @mount @obsolete @privileged @raw-io @reboot @setuid @swap";

     

       854
        
             };

     

       855
        
           };

     

       856

···

       850
        
               PrivateMounts = true;

     

       851
        
               # System Call Filtering

     

       852
        
               SystemCallArchitectures = "native";

     

       853
       +
               SystemCallFilter = "~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid";

     

       854
        
             };

     

       855
        
           };

     

       856