diff options
| author | Izorkin <izorkin@elven.pw> | 2022-03-07 23:28:43 +0300 |
|---|---|---|
| committer | Izorkin <izorkin@elven.pw> | 2022-03-08 14:37:11 +0300 |
| commit | b672e4dd2c04b495fa03524c9d0fd6c9e8ca315b (patch) | |
| tree | fb3a5815e3aaf868856e6ce5b640f4425155be80 | |
| parent | 031ab3327467c0ba63ff50304489b5d3c31a1d02 (diff) | |
| download | nixpkgs-b672e4dd2c04b495fa03524c9d0fd6c9e8ca315b.tar nixpkgs-b672e4dd2c04b495fa03524c9d0fd6c9e8ca315b.tar.gz nixpkgs-b672e4dd2c04b495fa03524c9d0fd6c9e8ca315b.tar.bz2 nixpkgs-b672e4dd2c04b495fa03524c9d0fd6c9e8ca315b.tar.lz nixpkgs-b672e4dd2c04b495fa03524c9d0fd6c9e8ca315b.tar.xz nixpkgs-b672e4dd2c04b495fa03524c9d0fd6c9e8ca315b.tar.zst nixpkgs-b672e4dd2c04b495fa03524c9d0fd6c9e8ca315b.zip | |
nginxModules: add option disableIPC
The disableIPC option is required to checking enabled nginxModules and disable the SystemCallFilter IPC filter.
| -rw-r--r-- | nixos/modules/services/web-servers/nginx/default.nix | 3 | ||||
| -rw-r--r-- | pkgs/servers/http/nginx/modules.nix | 1 |
2 files changed, 3 insertions, 1 deletions
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index 7daf0f158b3..e046c28dd6b 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -924,7 +924,8 @@ in PrivateMounts = true; # System Call Filtering SystemCallArchitectures = "native"; - SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" ] ++ optionals (cfg.package != pkgs.tengine) [ "~@ipc" ]; + SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" ] + ++ optionals ((cfg.package != pkgs.tengine) && (!lib.any (mod: (mod.disableIPC or false)) cfg.package.modules)) [ "~@ipc" ]; }; }; diff --git a/pkgs/servers/http/nginx/modules.nix b/pkgs/servers/http/nginx/modules.nix index b159cc00aaa..2b8e2ac7f79 100644 --- a/pkgs/servers/http/nginx/modules.nix +++ b/pkgs/servers/http/nginx/modules.nix @@ -256,6 +256,7 @@ in sha256 = "sha256-UXiitc3jZlgXlCsDPS+xEFLNRVgRbn8BCCXUEqAWlII="; }; inputs = [ pkgs.curl pkgs.geoip pkgs.libmodsecurity pkgs.libxml2 pkgs.lmdb pkgs.yajl ]; + disableIPC = true; }; moreheaders = { |