colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/unbound: tighten sandboxing for unbound

Browse Source
This commit is contained in:
Gary Guo 2023-11-05 20:54:09 +00:00
parent de6c5343b6
commit bc422e2f61
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
nixos/modules/services/networking/unbound.nix
View File

@ -249,6 +249,10 @@ in {
"CAP_NET_BIND_SERVICE"
"CAP_NET_RAW" # needed if ip-transparent is set to true
];
CapabilityBoundingSet = [
"CAP_NET_BIND_SERVICE"
"CAP_NET_RAW"
];
User = cfg.user;
Group = cfg.group;
@ -261,15 +265,19 @@ in {
ProtectControlGroups = true;
ProtectKernelModules = true;
ProtectSystem = "strict";
ProtectClock = true;
ProtectHostname = true;
ProtectProc = "invisible";
ProcSubset = "pid";
ProtectKernelLogs = true;
ProtectKernelTunables = true;
RuntimeDirectory = "unbound";
ConfigurationDirectory = "unbound";
StateDirectory = "unbound";
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_NETLINK" "AF_UNIX" ];
RestrictRealtime = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @resources @privileged"
];
SystemCallFilter = [ "@system-service" ];
RestrictNamespaces = true;
LockPersonality = true;
RestrictSUIDSGID = true;