rhi/peerix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Let's disable some security.

Browse source
This commit is contained in:
Sarah 2021-10-17 14:05:45 +02:00
parent c9644c3fd7
commit 4ee7a3abc1
No known key found for this signature in database
GPG key ID: 708F7ACE058F0186
1 changed files with 25 additions and 25 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

50
module.nix
View file

@ -62,33 +62,33 @@ in
Group = cfg.group; Group = cfg.group;
PrivateMounts = true; PrivateMounts = true;
PrivateDevices = true; # PrivateDevices = true;
PrivateTmp = true; # PrivateTmp = true;
PrivateIPC = true; # PrivateIPC = true;
PrivateUsers = true; # PrivateUsers = true;
SystemCallFilters = [ # SystemCallFilters = [
"@aio" # "@aio"
"@basic-io" # "@basic-io"
"@file-system" # "@file-system"
"@io-event" # "@io-event"
"@process" # "@process"
"@network-io" # "@network-io"
"@timer" # "@timer"
"@signal" # "@signal"
"@alarm" # "@alarm"
]; # ];
SystemCallErrorNumber = "EPERM"; # SystemCallErrorNumber = "EPERM";
ProtectSystem = "full"; # ProtectSystem = "full";
ProtectHome = true; # ProtectHome = true;
ProtectHostname = true; # ProtectHostname = true;
ProtectClock = true; # ProtectClock = true;
ProtectKernelTunables = true; # ProtectKernelTunables = true;
ProtectKernelModules = true; # ProtectKernelModules = true;
ProtectKernelLogs = true; # ProtectKernelLogs = true;
ProtectControlGroups = true; # ProtectControlGroups = true;
RestrictNamespaces = ""; # RestrictNamespaces = "";
NoNewPrivileges = true; NoNewPrivileges = true;
ReadOnlyPaths = lib.mkMerge [ ReadOnlyPaths = lib.mkMerge [