nixos/dnscrypt-proxy2: more service hardening

added 'ProtectClock' and made the seccomp filter a bit more restrictive
have been running with these settings for a while with zero problems
This commit is contained in:
snicket2100 2021-01-02 18:09:49 +01:00
parent d47eae33b0
commit 2bab1a76c6

View file

@ -87,6 +87,7 @@ in
NoNewPrivileges = true;
NonBlocking = true;
PrivateDevices = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
@ -107,8 +108,13 @@ in
SystemCallFilter = [
"@system-service"
"@chown"
"~@aio"
"~@keyring"
"~@memlock"
"~@resources"
"@privileged"
"~@setuid"
"~@sync"
"~@timer"
];
};
};