colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/exim: apply privilege restrictions

Browse Source 
Since 816614bd62, the service is set to use the exim user so that
systemd takes care of the credentials ownership. The executable is
still required to run as root, to then drop privileges. The prefix '+'
that was used however interfers with the use of privilege restrictions
and other sandboxing options. Since we only want to escape the "User"
setting, we can use the '!' prefix instead.
This commit is contained in:
pacien 2023-06-05 20:04:48 +02:00
parent 09720cc41f
commit 54be076ae7
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
nixos/modules/services/mail/exim.nix
View File

@ -116,8 +116,8 @@ in
wantedBy = [ "multi-user.target" ];
restartTriggers = [ config.environment.etc."exim.conf".source ];
serviceConfig = {
ExecStart = "+${cfg.package}/bin/exim -bdf -q${cfg.queueRunnerInterval}";
ExecReload = "+${coreutils}/bin/kill -HUP $MAINPID";
ExecStart = "!${cfg.package}/bin/exim -bdf -q${cfg.queueRunnerInterval}";
ExecReload = "!${coreutils}/bin/kill -HUP $MAINPID";
User = cfg.user;
};
preStart = ''