JakeHillion/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chrony: update sandboxing options

Browse Source
This commit is contained in:
Izorkin 2023-01-02 15:49:23 +03:00 committed by Austin Seipp
parent 6ae49bc107
commit b943fb24b7
3 changed files with 52 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
View File

@ -339,6 +339,13 @@
And backup your data.
</para>
</listitem>
<listitem>
<para>
<literal>services.chronyd</literal> is now started with
additional systemd sandbox/hardening options for better
security.
</para>
</listitem>
<listitem>
<para>
The module <literal>services.headscale</literal> was

2
nixos/doc/manual/release-notes/rl-2305.section.md
View File

@ -94,6 +94,8 @@ In addition to numerous new and upgraded packages, this release has the followin
And backup your data.
- `services.chronyd` is now started with additional systemd sandbox/hardening options for better security.
- The module `services.headscale` was refactored to be compliant with [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md). To be precise, this means that the following things have changed:
- Most settings has been migrated under [services.headscale.settings](#opt-services.headscale.settings) which is an attribute-set that

54
nixos/modules/services/networking/ntp/chrony.nix
View File

@ -147,9 +147,9 @@ in
systemd.services.systemd-timedated.environment = { SYSTEMD_TIMEDATED_NTP_SERVICES = "chronyd.service"; };
systemd.tmpfiles.rules = [
"d ${stateDir} 0755 chrony chrony - -"
"f ${driftFile} 0640 chrony chrony -"
"f ${keyFile} 0640 chrony chrony -"
"d ${stateDir} 0750 chrony chrony - -"
"f ${driftFile} 0640 chrony chrony - -"
"f ${keyFile} 0640 chrony chrony - -"
];
systemd.services.chronyd =
@ -164,15 +164,47 @@ in
path = [ chronyPkg ];
unitConfig.ConditionCapability = "CAP_SYS_TIME";
serviceConfig =
{ Type = "simple";
ExecStart = "${chronyPkg}/bin/chronyd ${builtins.toString chronyFlags}";
ProtectHome = "yes";
ProtectSystem = "full";
PrivateTmp = "yes";
};
serviceConfig = {
Type = "simple";
ExecStart = "${chronyPkg}/bin/chronyd ${builtins.toString chronyFlags}";
# Proc filesystem
ProcSubset = "pid";
ProtectProc = "invisible";
# Access write directories
ReadWritePaths = [ "${stateDir}" ];
UMask = "0027";
# Capabilities
CapabilityBoundingSet = [ "CAP_CHOWN" "CAP_DAC_OVERRIDE" "CAP_NET_BIND_SERVICE" "CAP_SETGID" "CAP_SETUID" "CAP_SYS_RESOURCE" "CAP_SYS_TIME" ];
# Device Access
DeviceAllow = [ "char-pps rw" "char-ptp rw" "char-rtc rw" ];
DevicePolicy = "closed";
# Security
NoNewPrivileges = true;
# Sandboxing
ProtectSystem = "full";
ProtectHome = true;
PrivateTmp = true;
PrivateDevices = true;
PrivateUsers = false;
ProtectHostname = true;
ProtectClock = false;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
RemoveIPC = true;
PrivateMounts = true;
# System Call Filtering
SystemCallArchitectures = "native";
SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @resources" "@clock" "@setuid" "capset" "chown" ];
};
};
};
}