aiolabs/nix-bitcoin
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

security: update /proc restriction mechanism

Browse source 
NixOS option `security.hideProcessInformation` for globally restricting
access to /proc has been removed.
Use per-service restrictions via 'ProtectProc' instead.

Rename
`nix-bitcoin.security.hideProcessInformation` to
`nix-bitcoin.security.dbusHideProcessInformation`
because this option now only implements the dbus restriction.
This commit is contained in:
Erik Arvstedt 2021-08-05 00:49:01 +02:00
parent 178a0dcf8f
commit 35fe939cf8
No known key found for this signature in database
GPG key ID: 33312B944DD97846
4 changed files with 23 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

5
pkgs/lib.nix
View file

@ -17,9 +17,8 @@ let self = {
ProtectKernelModules = "true";
ProtectKernelLogs = "true";
ProtectClock = "true";
# Test and enable these when systemd v247 is available
# ProtectProc = "invisible";
# ProcSubset = "pid";
ProtectProc = "invisible";
ProcSubset = "pid";
ProtectControlGroups = "true";
RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
RestrictNamespaces = "true";