diff options
| author | Félix Baylac-Jacqué <felix@alternativebit.fr> | 2020-01-20 21:15:47 +0100 |
|---|---|---|
| committer | Félix Baylac-Jacqué <felix@alternativebit.fr> | 2020-01-20 21:48:48 +0100 |
| commit | ff8f2928eeddb0dfe07365052360484df951aed3 (patch) | |
| tree | d4e935d189ec969454b057a0e8b84df021760ee4 /nixos/modules | |
| parent | a7dacaf3e2980c317672d592f311babf33d9d9de (diff) | |
| download | nixpkgs-ff8f2928eeddb0dfe07365052360484df951aed3.tar nixpkgs-ff8f2928eeddb0dfe07365052360484df951aed3.tar.gz nixpkgs-ff8f2928eeddb0dfe07365052360484df951aed3.tar.bz2 nixpkgs-ff8f2928eeddb0dfe07365052360484df951aed3.tar.lz nixpkgs-ff8f2928eeddb0dfe07365052360484df951aed3.tar.xz nixpkgs-ff8f2928eeddb0dfe07365052360484df951aed3.tar.zst nixpkgs-ff8f2928eeddb0dfe07365052360484df951aed3.zip | |
nixos/syncthing.nix: Sandbox the systemd service.
Using systemd sandboxing features to harden the syncthing service.
Diffstat (limited to 'nixos/modules')
| -rw-r--r-- | nixos/modules/services/networking/syncthing.nix | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix index 47b10e408c0..5b3eb6f04b4 100644 --- a/nixos/modules/services/networking/syncthing.nix +++ b/nixos/modules/services/networking/syncthing.nix @@ -484,6 +484,24 @@ in { -gui-address=${cfg.guiAddress} \ -home=${cfg.configDir} ''; + MemoryDenyWriteExecute = true; + NoNewPrivileges = true; + PrivateDevices = true; + PrivateMounts = true; + PrivateTmp = true; + PrivateUsers = true; + ProtectControlGroups = true; + ProtectHostname = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + CapabilityBoundingSet = [ + "~CAP_SYS_PTRACE" "~CAP_SYS_ADMIN" + "~CAP_SETGID" "~CAP_SETUID" "~CAP_SETPCAP" + "~CAP_SYS_TIME" "~CAP_KILL" + ]; }; }; syncthing-init = mkIf ( |