MirrorHub/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-16 23:03:40 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge pull request #122241 from dotlambda/znc-harden

Browse source 
nixos/znc: harden systemd unit
This commit is contained in:
Robert Schütz 2021-05-18 17:44:14 +02:00 committed by GitHub
commit d189df235a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 31 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
nixos/modules/services/networking/znc/default.nix
View file

@ -103,8 +103,8 @@ in
};
dataDir = mkOption {
default = "/var/lib/znc/";
example = "/home/john/.znc/";
default = "/var/lib/znc";
example = "/home/john/.znc";
type = types.path;
description = ''
The state directory for ZNC. The config and the modules will be linked
@ -258,6 +258,34 @@ in
ExecStart = "${pkgs.znc}/bin/znc --foreground --datadir ${cfg.dataDir} ${escapeShellArgs cfg.extraFlags}";
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
ExecStop = "${pkgs.coreutils}/bin/kill -INT $MAINPID";
# Hardening
CapabilityBoundingSet = [ "" ];
DevicePolicy = "closed";
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
ReadWritePaths = [ cfg.dataDir ];
RemoveIPC = true;
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
UMask = "0027";
};
preStart = ''
mkdir -p ${cfg.dataDir}/configs

2
nixos/modules/services/networking/znc/options.nix
View file

@ -44,7 +44,7 @@ let
modules = mkOption {
type = types.listOf types.str;
default = [ "simple_away" ];
example = literalExample "[ simple_away sasl ]";
example = literalExample ''[ "simple_away" "sasl" ]'';
description = ''
ZNC network modules to load.
'';