JakeHillion/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nixos/bird: improve systemd hardening / capability set

Browse Source 
aligned with https://github.com/archlinux/svntogit-packages/blob/packages/bird/trunk/bird.service#L20-L21
This commit is contained in:
Jörg Thalheim 2022-02-23 07:00:33 +01:00
parent a5276e1fbd
commit ad16194460
No known key found for this signature in database
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
nixos/modules/services/networking/bird.nix
View File

@ -72,23 +72,27 @@ in
serviceConfig = { serviceConfig = {
Type = "forking"; Type = "forking";
Restart = "on-failure"; Restart = "on-failure";
# We need to start as root so bird can open netlink sockets i.e. for ospf
ExecStart = "${pkgs.bird}/bin/bird -c /etc/bird/bird2.conf -u bird2 -g bird2"; ExecStart = "${pkgs.bird}/bin/bird -c /etc/bird/bird2.conf -u bird2 -g bird2";
ExecReload = "/bin/sh -c '${pkgs.bird}/bin/bird -c /etc/bird/bird2.conf -p && ${pkgs.bird}/bin/birdc configure'"; ExecReload = "/bin/sh -c '${pkgs.bird}/bin/bird -c /etc/bird/bird2.conf -p && ${pkgs.bird}/bin/birdc configure'";
ExecStop = "${pkgs.bird}/bin/birdc down"; ExecStop = "${pkgs.bird}/bin/birdc down";
RuntimeDirectory = "bird";
CapabilityBoundingSet = [ CapabilityBoundingSet = [
"CAP_CHOWN" "CAP_CHOWN"
"CAP_FOWNER" "CAP_FOWNER"
"CAP_DAC_OVERRIDE"
"CAP_SETUID" "CAP_SETUID"
"CAP_SETGID" "CAP_SETGID"
# see bird/sysdep/linux/syspriv.h
"CAP_NET_BIND_SERVICE"
"CAP_NET_BROADCAST"
"CAP_NET_ADMIN" "CAP_NET_ADMIN"
"CAP_NET_BROADCAST"
"CAP_NET_BIND_SERVICE"
"CAP_NET_RAW" "CAP_NET_RAW"
]; ];
ProtectSystem = "full"; ProtectSystem = "full";
ProtectHome = "yes"; ProtectHome = "yes";
ProtectKernelTunables = true;
ProtectControlGroups = true;
PrivateTmp = true;
PrivateDevices = true;
SystemCallFilter = "~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io"; SystemCallFilter = "~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io";
MemoryDenyWriteExecute = "yes"; MemoryDenyWriteExecute = "yes";
}; };