Unverified Commit a2d829ea authored by Florian Klink's avatar Florian Klink Committed by GitHub
Browse files

nixos/gerrit: Apply more hardening settings (#448870)

parents 54fa5a9a 8dac7deb

nixos/modules/services/web-apps/gerrit.nix

+3 −1
Original line number Diff line number Diff line
@@ -232,10 +232,12 @@ in 
        AmbientCapabilities = "";

        CapabilityBoundingSet = "";

        LockPersonality = true;

        MountAPIVFS = true;

        NoNewPrivileges = true;

        PrivateDevices = true;

        PrivateMounts = true;

        PrivateTmp = true;

        PrivateUsers = true;

        ProtectClock = true;

        ProtectControlGroups = "strict";

        ProtectHome = true;
@@ -243,7 +245,7 @@ in 
        ProtectKernelLogs = true;

        ProtectKernelModules = true;

        ProtectKernelTunables = true;

        ProtectProc = "noaccess";

        ProtectProc = "invisible";

        ProtectSystem = "full";

        RestrictAddressFamilies = [

          "AF_UNIX"