nixos/dnscrypt-proxy2: more service hardening
added 'ProtectClock' and made the seccomp filter a bit more restrictive have been running with these settings for a while with zero problems
This commit is contained in:
parent
d47eae33b0
commit
2bab1a76c6
|
@ -87,6 +87,7 @@ in
|
|||
NoNewPrivileges = true;
|
||||
NonBlocking = true;
|
||||
PrivateDevices = true;
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
|
@ -107,8 +108,13 @@ in
|
|||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"@chown"
|
||||
"~@aio"
|
||||
"~@keyring"
|
||||
"~@memlock"
|
||||
"~@resources"
|
||||
"@privileged"
|
||||
"~@setuid"
|
||||
"~@sync"
|
||||
"~@timer"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
|
Loading…
Reference in a new issue