c5effcaaea
This enables some systemd sandboxing options for the `tsm-backup.service`. Those settings have been determined by expermentation. This commit tries hard to protect the filesystem from write access, but not to hide anything from read access, so users can backup all files they choose to backup. An exception are API filesystems (`/dev`, `/proc`, `/sys`): As their "files" are not stored on persistent storage, they are sandboxed away as much as possible. Note that the service still has to run with root privileges to reach files with limited access permissions. The obvious alternative to use a dedicated user account and the `CAP_DAC_READ_SEARCH` capability to permit system-wide read access while blocking write access does not work. Experiments have shown that `dsmc` verifies access permissions for each file before attempting to open it for reading. Hence `dsmc` refuses to copy files where the file permission mode blocks read access -- even if process capabilities would allow it to proceed irrespective of permissions. |
||
|---|---|---|
| .. | ||
| doc | ||
| lib | ||
| maintainers | ||
| modules | ||
| tests | ||
| COPYING | ||
| default.nix | ||
| README | ||
| release-combined.nix | ||
| release-small.nix | ||
| release.nix | ||
*** NixOS *** NixOS is a Linux distribution based on the purely functional package management system Nix. More information can be found at https://nixos.org/nixos and in the manual in doc/manual.