JakeHillion/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nixos/knot: update systemd hardening

Browse Source
This commit is contained in:
Martin Weinelt 2021-12-04 02:54:50 +01:00
parent c52ea537b3
commit 67f102d8d8
No known key found for this signature in database
GPG Key ID: 87C1E9888F856759
1 changed files with 42 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
nixos/modules/services/networking/knot.nix
View File

@ -80,13 +80,13 @@ in {
};
config = mkIf config.services.knot.enable {
users.groups.knot = {};
users.users.knot = {
isSystemUser = true;
group = "knot";
description = "Knot daemon user";
};
users.groups.knot.gid = null;
systemd.services.knot = {
unitConfig.Documentation = "man:knotd(8) man:knot.conf(5) man:knotc(8) https://www.knot-dns.cz/docs/${cfg.package.version}/html/";
description = cfg.package.meta.description;
@ -98,17 +98,52 @@ in {
Type = "notify";
ExecStart = "${cfg.package}/bin/knotd --config=${configFile} --socket=${socketFile} ${concatStringsSep " " cfg.extraArgs}";
ExecReload = "${knot-cli-wrappers}/bin/knotc reload";
CapabilityBoundingSet = "CAP_NET_BIND_SERVICE CAP_SETPCAP";
AmbientCapabilities = "CAP_NET_BIND_SERVICE CAP_SETPCAP";
NoNewPrivileges = true;
User = "knot";
Group = "knot";
AmbientCapabilities = [
"CAP_NET_BIND_SERVICE"
];
CapabilityBoundingSet = [
"CAP_NET_BIND_SERVICE"
];
DeviceAllow = "";
DevicePolicy = "closed";
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
PrivateUsers = false; # breaks capability passing
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
RemoveIPC = true;
Restart = "on-abort";
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
RestrictNamespaces = true;
RestrictRealtime =true;
RestrictSUIDSGID = true;
RuntimeDirectory = "knot";
StateDirectory = "knot";
StateDirectoryMode = "0700";
PrivateDevices = true;
RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
SystemCallArchitectures = "native";
Restart = "on-abort";
SystemCallFilter = [
"@system-service"
"~@privileged"
];
UMask = "0077";
};
};