diff options
| author | Martin Milata <martin@martinmilata.cz> | 2019-11-29 17:46:35 +0100 |
|---|---|---|
| committer | Franz Pletz <fpletz@fnordicwalking.de> | 2020-01-13 11:11:32 +0000 |
| commit | d9319e8e8725a43e7fa1329cddeef61cd61081b3 (patch) | |
| tree | a485b28adc0196b3dbb1d64b6a1a15118ac108f5 /nixos/modules/services/networking/ndppd.nix | |
| parent | 8305186bb44e73490ccb9c984c3d4fcaaf21da78 (diff) | |
| download | nixpkgs-d9319e8e8725a43e7fa1329cddeef61cd61081b3.tar nixpkgs-d9319e8e8725a43e7fa1329cddeef61cd61081b3.tar.gz nixpkgs-d9319e8e8725a43e7fa1329cddeef61cd61081b3.tar.bz2 nixpkgs-d9319e8e8725a43e7fa1329cddeef61cd61081b3.tar.lz nixpkgs-d9319e8e8725a43e7fa1329cddeef61cd61081b3.tar.xz nixpkgs-d9319e8e8725a43e7fa1329cddeef61cd61081b3.tar.zst nixpkgs-d9319e8e8725a43e7fa1329cddeef61cd61081b3.zip | |
nixos/ndppd: enable systemd sandboxing
Diffstat (limited to 'nixos/modules/services/networking/ndppd.nix')
| -rw-r--r-- | nixos/modules/services/networking/ndppd.nix | 20 |
1 files changed, 19 insertions, 1 deletions
diff --git a/nixos/modules/services/networking/ndppd.nix b/nixos/modules/services/networking/ndppd.nix index 92088623517..e015f76f622 100644 --- a/nixos/modules/services/networking/ndppd.nix +++ b/nixos/modules/services/networking/ndppd.nix @@ -161,7 +161,25 @@ in { documentation = [ "man:ndppd(1)" "man:ndppd.conf(5)" ]; after = [ "network-pre.target" ]; wantedBy = [ "multi-user.target" ]; - serviceConfig.ExecStart = "${pkgs.ndppd}/bin/ndppd -c ${ndppdConf}"; + serviceConfig = { + ExecStart = "${pkgs.ndppd}/bin/ndppd -c ${ndppdConf}"; + + # Sandboxing + CapabilityBoundingSet = "CAP_NET_RAW CAP_NET_ADMIN"; + ProtectSystem = "strict"; + ProtectHome = true; + PrivateTmp = true; + PrivateDevices = true; + ProtectKernelTunables = true; + ProtectKernelModules = true; + ProtectControlGroups = true; + RestrictAddressFamilies = "AF_INET6 AF_PACKET AF_NETLINK"; + RestrictNamespaces = true; + LockPersonality = true; + MemoryDenyWriteExecute = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + }; }; }; } |