alioth/nixpkgs
3
0
Fork 0
forked from mirrors/nixpkgs
Code Releases Activity

nixos/nginx: remove option enableSandbox

Browse source
This commit is contained in:
Izorkin 2020-09-10 08:19:20 +03:00
parent 940195c0e7
commit 535896671b
No known key found for this signature in database
GPG key ID: 1436C1B3F3679F09
3 changed files with 2 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
nixos/doc/manual/release-notes/rl-2009.xml
View file

@ -427,8 +427,8 @@ php.override {
</listitem>
<listitem>
<para>
Add option <literal>services.nginx.enableSandbox</literal> to starting Nginx web server with additional sandbox/hardening options.
By default, write access to <literal>services.nginx.stateDir</literal> is allowed. To allow writing to other folders,
Nginx web server now starting with additional sandbox/hardening options. By default, write access
to <literal>services.nginx.stateDir</literal> is allowed. To allow writing to other folders,
use <literal>systemd.services.nginx.serviceConfig.ReadWritePaths</literal>
<programlisting>
systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];

9
nixos/modules/services/web-servers/nginx/default.nix
View file

@ -463,14 +463,6 @@ in
'';
};
enableSandbox = mkOption {
default = false;
type = types.bool;
description = ''
Starting Nginx web server with additional sandbox/hardening options.
'';
};
user = mkOption {
type = types.str;
default = "nginx";
@ -728,7 +720,6 @@ in
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_RESOURCE" ];
# Security
NoNewPrivileges = true;
} // optionalAttrs cfg.enableSandbox {
# Sandboxing
ProtectSystem = "strict";
ProtectHome = mkDefault true;

1
nixos/tests/nginx-sandbox.nix
View file

@ -18,7 +18,6 @@ import ./make-test-python.nix ({ pkgs, ... }: {
];
services.nginx.enable = true;
services.nginx.package = pkgs.nginx-lua;
services.nginx.enableSandbox = true;
services.nginx.virtualHosts.localhost = {
extraConfig = ''
location /test1-write {