mirrors/nixpkgs
1
0
Fork 1
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-19 12:11:28 +00:00
Code Issues Wiki Activity

nixos/bird: improve systemd hardening / capability set

Browse source 
aligned with https://github.com/archlinux/svntogit-packages/blob/packages/bird/trunk/bird.service#L20-L21
This commit is contained in:
Jörg Thalheim 2022-02-23 07:00:33 +01:00
parent a5276e1fbd
commit ad16194460
No known key found for this signature in database
1 changed files with 8 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
nixos/modules/services/networking/bird.nix
View file

@ -72,23 +72,27 @@ in
serviceConfig = {
Type = "forking";
Restart = "on-failure";
# We need to start as root so bird can open netlink sockets i.e. for ospf
ExecStart = "${pkgs.bird}/bin/bird -c /etc/bird/bird2.conf -u bird2 -g bird2";
ExecReload = "/bin/sh -c '${pkgs.bird}/bin/bird -c /etc/bird/bird2.conf -p && ${pkgs.bird}/bin/birdc configure'";
ExecStop = "${pkgs.bird}/bin/birdc down";
RuntimeDirectory = "bird";
CapabilityBoundingSet = [
"CAP_CHOWN"
"CAP_FOWNER"
"CAP_DAC_OVERRIDE"
"CAP_SETUID"
"CAP_SETGID"
# see bird/sysdep/linux/syspriv.h
"CAP_NET_BIND_SERVICE"
"CAP_NET_BROADCAST"
"CAP_NET_ADMIN"
"CAP_NET_BROADCAST"
"CAP_NET_BIND_SERVICE"
"CAP_NET_RAW"
];
ProtectSystem = "full";
ProtectHome = "yes";
ProtectKernelTunables = true;
ProtectControlGroups = true;
PrivateTmp = true;
PrivateDevices = true;
SystemCallFilter = "~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io";
MemoryDenyWriteExecute = "yes";
};