From ad88f1040e2556ba678afb33dac28387ddd3543a Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Mon, 5 Dec 2016 12:25:31 +0100 Subject: [PATCH 1/2] privoxy service: additional isolation --- nixos/modules/services/networking/privoxy.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/nixos/modules/services/networking/privoxy.nix b/nixos/modules/services/networking/privoxy.nix index 94beb78ef5a..e74fe44d76e 100644 --- a/nixos/modules/services/networking/privoxy.nix +++ b/nixos/modules/services/networking/privoxy.nix @@ -100,6 +100,11 @@ in after = [ "network.target" "nss-lookup.target" ]; wantedBy = [ "multi-user.target" ]; serviceConfig.ExecStart = "${privoxy}/sbin/privoxy --no-daemon --user ${privoxyUser} ${confFile}"; + + serviceConfig.PrivateDevices = true; + serviceConfig.PrivateTmp = true; + serviceConfig.ProtectHome = true; + serviceConfig.ProtectSystem = "full"; }; }; From 3dcdc2d2b054933a5812411c44a11bb4114b309e Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Mon, 5 Dec 2016 12:27:51 +0100 Subject: [PATCH 2/2] privoxy service: remove static uid The service owns no data, having a static uid serves no purpose. This frees up uid/gid 32 --- nixos/modules/misc/ids.nix | 2 -- nixos/modules/services/networking/privoxy.nix | 18 +++++++++--------- 2 files changed, 9 insertions(+), 11 deletions(-) diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix index 41ee63a9603..bc69102ba39 100644 --- a/nixos/modules/misc/ids.nix +++ b/nixos/modules/misc/ids.nix @@ -58,7 +58,6 @@ #utmp = 29; # unused ddclient = 30; davfs2 = 31; - privoxy = 32; #disnix = 33; # unused osgi = 34; tor = 35; @@ -322,7 +321,6 @@ utmp = 29; #ddclient = 30; # unused davfs2 = 31; - privoxy = 32; disnix = 33; osgi = 34; tor = 35; diff --git a/nixos/modules/services/networking/privoxy.nix b/nixos/modules/services/networking/privoxy.nix index e74fe44d76e..49ca839a2c3 100644 --- a/nixos/modules/services/networking/privoxy.nix +++ b/nixos/modules/services/networking/privoxy.nix @@ -6,8 +6,6 @@ let inherit (pkgs) privoxy; - privoxyUser = "privoxy"; - cfg = config.services.privoxy; confFile = pkgs.writeText "privoxy.conf" '' @@ -88,18 +86,20 @@ in ###### implementation config = mkIf cfg.enable { - - users.extraUsers = singleton - { name = privoxyUser; - uid = config.ids.uids.privoxy; - description = "Privoxy daemon user"; - }; + + users.users.privoxy = { + isSystemUser = true; + home = "/var/empty"; + group = "privoxy"; + }; + + users.groups.privoxy = {}; systemd.services.privoxy = { description = "Filtering web proxy"; after = [ "network.target" "nss-lookup.target" ]; wantedBy = [ "multi-user.target" ]; - serviceConfig.ExecStart = "${privoxy}/sbin/privoxy --no-daemon --user ${privoxyUser} ${confFile}"; + serviceConfig.ExecStart = "${privoxy}/bin/privoxy --no-daemon --user privoxy ${confFile}"; serviceConfig.PrivateDevices = true; serviceConfig.PrivateTmp = true;