Unverified Commit fdf74752 authored by Paul Haerle's avatar Paul Haerle Committed by GitHub
Browse files

nixos/jenkins: Set ProtectSystem to strict (#472066)

parents a499dfba 81e2494e

nixos/modules/services/continuous-integration/jenkins/default.nix

+4 −1
Original line number Diff line number Diff line
@@ -275,7 +275,10 @@ in 
        ProtectKernelModules = true;

        ProtectKernelTunables = true;

        ProtectProc = "invisible";

        ProtectSystem = "full";

        ProtectSystem = "strict";

        ReadWritePaths = [

          cfg.home

        ];

        RemoveIPC = true;

        RestrictAddressFamilies = [

          "AF_UNIX"