nixos/unit: update sandboxing options

2020-08-15 11:13:44 +03:00 · 2020-08-15 11:13:44 +03:00 · 26898b8518
commit 26898b8518
parent d56514c76a
1 changed files with 3 additions and 0 deletions
--- a/nixos/modules/services/web-servers/unit/default.nix
+++ b/nixos/modules/services/web-servers/unit/default.nix
@ -120,9 +120,12 @@ in {
        ProtectHome = true;
        PrivateTmp = true;
        PrivateDevices = true;
+        PrivateUsers = false;
        ProtectHostname = true;
+        ProtectClock = true;
        ProtectKernelTunables = true;
        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
        ProtectControlGroups = true;
        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
        LockPersonality = true;