Unverified Commit b99ffef2 authored by Sandro Jäckel's avatar Sandro Jäckel Committed by GitHub
Browse files

Merge pull request #197688 from MidAutumnMoon/go-119-services-fix-2

parents dc5fa53b 5c983ac3

nixos/modules/services/networking/snowflake-proxy.nix

+1 −1
Original line number Diff line number Diff line
@@ -71,7 +71,7 @@ in 
        RestrictNamespaces = true;

        RestrictRealtime = true;

        SystemCallArchitectures = "native";

        SystemCallFilter = "~@clock @cpu-emulation @debug @mount @obsolete @reboot @swap @privileged @resources";

        SystemCallFilter = [ "@system-service" "~@privileged" ];

        UMask = "0077";

      };

    };

nixos/modules/services/networking/yggdrasil.nix

+1 −1
Original line number Diff line number Diff line
@@ -180,7 +180,7 @@ in { 
        RestrictNamespaces = true;

        RestrictRealtime = true;

        SystemCallArchitectures = "native";

        SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @resources";

        SystemCallFilter = [ "@system-service" "~@privileged @keyring" ];

      } // (if (cfg.group != null) then {

        Group = cfg.group;

      } else {});

nixos/modules/services/web-apps/dex.nix

+2 −2
Original line number Diff line number Diff line
@@ -58,7 +58,7 @@ in 
      '';

      description = lib.mdDoc ''

        The available options can be found in

        [the example configuration](https://github.com/dexidp/dex/blob/v${pkgs.dex.version}/config.yaml.dist).

        [the example configuration](https://github.com/dexidp/dex/blob/v${pkgs.dex-oidc.version}/config.yaml.dist).



        It's also possible to refer to environment variables (defined in [services.dex.environmentFile](#opt-services.dex.environmentFile))

        using the syntax `$VARIABLE_NAME`.
@@ -119,7 +119,7 @@ in 
        RestrictRealtime = true;

        RestrictSUIDSGID = true;

        SystemCallArchitectures = "native";

        SystemCallFilter = [ "@system-service" "~@privileged @resources @setuid @keyring" ];

        SystemCallFilter = [ "@system-service" "~@privileged @setuid @keyring" ];

        TemporaryFileSystem = "/:ro";

        # Does not work well with the temporary root

        #UMask = "0066";

nixos/modules/services/web-apps/prosody-filer.nix

+1 −1
Original line number Diff line number Diff line
@@ -79,7 +79,7 @@ in { 
        LockPersonality = true;

        RemoveIPC = true;

        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];

        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];

        SystemCallFilter = [ "@system-service" "~@privileged" ];

      };

    };

  };