aiolabs/nix-bitcoin
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

security(lamassu): re-enable sandboxing for build service
Some checks failed
nix-bitcoin tests / build_test_drivers (push) Has been cancelled
Details
nix-bitcoin tests / check_flake (push) Has been cancelled
Details
nix-bitcoin tests / test_scenario (default) (push) Has been cancelled
Details
nix-bitcoin tests / test_scenario (joinmarket-bitcoind-29) (push) Has been cancelled
Details
nix-bitcoin tests / test_scenario (netns) (push) Has been cancelled
Details
nix-bitcoin tests / test_scenario (netnsRegtest) (push) Has been cancelled
Details

Browse source 
The build service only needs write access to the data directory.
Re-enable ProtectSystem, ProtectHome, NoNewPrivileges with
ReadWritePaths to allow writes to /var/lib/lamassu-server.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Patrick Mulligan 2026-01-09 23:29:25 +01:00
parent 04f008d1cf
commit 3d45dcadbd
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
modules/lamassu-lnbits.nix
View file

@ -281,11 +281,11 @@ in
TimeoutStartSec = "30min";
KillMode = "process";
KillSignal = "SIGTERM";
# Disable sandboxing for build
PrivateTmp = false;
ProtectSystem = false;
ProtectHome = false;
NoNewPrivileges = false;
# Sandboxing with write access to data directory
ProtectSystem = "strict";
ProtectHome = true;
NoNewPrivileges = true;
ReadWritePaths = [ cfg.dataDir ];
};
script = ''