Unverified Commit 6ae8e133 authored by Martin Weinelt's avatar Martin Weinelt
Browse files

nixos/matrix-appservice-irc: update syscall filter 

Simplify the SystemcallFilter by employing an explicit allow list, and
an explicit block list.

Node since version 18 requires syscalls in the @pkey group.

Excluding @privileged and @resources is a recommendation in
systemd-analyze.
parent ddfe5282

nixos/modules/services/matrix/appservice-irc.nix

+4 −1
Original line number Diff line number Diff line
@@ -215,7 +215,10 @@ in { 
        LockPersonality = true;

        RestrictRealtime = true;

        PrivateMounts = true;

        SystemCallFilter = "~@aio @clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @raw-io @setuid @swap";

        SystemCallFilter = [

          "@system-service @pkey"

          "~@privileged @resources"

        ];

        SystemCallArchitectures = "native";

        # AF_UNIX is required to connect to a postgres socket.

        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";