Unverified Commit 4e40f1c7 authored by Minijackson's avatar Minijackson
Browse files

nixos/sssd: add upstream hardening options in sssd-kcm.service

parent 98672296

nixos/modules/services/misc/sssd.nix

+8 −0
Original line number Diff line number Diff line
@@ -165,6 +165,14 @@ in 
        serviceConfig = {

          ExecStartPre = "-${pkgs.sssd}/bin/sssd --genconf-section=kcm";

          ExecStart = "${pkgs.sssd}/libexec/sssd/sssd_kcm --uid 0 --gid 0";

          CapabilityBoundingSet = [

            "CAP_IPC_LOCK"

            "CAP_CHOWN"

            "CAP_DAC_READ_SEARCH"

            "CAP_FOWNER"

            "CAP_SETGID"

            "CAP_SETUID"

          ];

        };

        restartTriggers = [

          settingsFileUnsubstituted