cafkafk/nixpkgs
cafkafk/nixpkgs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

nixos/mastodon: add new sandboxing options

Browse source
This commit is contained in:
Izorkin 2021-05-12 11:22:44 +03:00 committed by Kerstin
parent e62c9ce932
commit 943f15d4b7
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
nixos/modules/services/web-apps/mastodon.nix
View file

@ -50,6 +50,9 @@ let
# Logs directory and mode
LogsDirectory = "mastodon";
LogsDirectoryMode = "0750";
# Proc filesystem
ProcSubset = "pid";
ProtectProc = "invisible";
# Access write directories
UMask = "0027";
# Capabilities
@ -74,6 +77,7 @@ let
MemoryDenyWriteExecute = false;
RestrictRealtime = true;
RestrictSUIDSGID = true;
RemoveIPC = true;
PrivateMounts = true;
# System Call Filtering
SystemCallArchitectures = "native";