mirrors/nixpkgs
1
0
Fork 1
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-20 12:42:24 +00:00
Code Issues Wiki Activity

cjdns service: allow daemon to drop privileges

Browse source 
The service can run certain components with reduced privileges, but for
that it needs the setuid capability.
This commit is contained in:
Joachim Fasting 2017-02-05 04:46:58 +01:00
parent a0338afe5f
commit 2628597e76
No known key found for this signature in database
GPG key ID: 7544761007FE4E08
1 changed files with 1 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
nixos/modules/services/networking/cjdns.nix
View file

@ -258,8 +258,7 @@ in
Restart = "always";
StartLimitInterval = 0;
RestartSec = 1;
CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW";
AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_RAW";
CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW CAP_SETUID";
ProtectSystem = true;
MemoryDenyWriteExecute = true;
ProtectHome = true;