nixpkgs/nixos/modules/services
ShaRose 9e2308ed80 nixos/dnsdist: Add CAP_NET_BIND_SERVICE to AmbientCapabilities
It seems that dnsdist doesn't actually request CAP_NET_BIND_SERVICE, which is why normally it's executed and root and setuids to another, unprivileged, user. This means that as it is, dnsdist will be unable to bind to any port under 1024 and will fail with access denied.

Removing CAP_SETGID and CAP_SETUID is also related to this as we don't actually change the uid or gid after the fact as we use DynamicUser. (That part isn't strictly NEEDED but there's no reason to have those capabilities if we don't use them).

There are also some additional sandboxing we can remove from the service definition as they are assumed true or strict by DynamicUser: specifically PrivateTmp and ProtectSystem respectively.

ProtectHome is still there, despite being assumed read-only as setting it to true means they are seen as empty. I don't think it really matters as I don't know if systemd will ignore it or not, but I didn't see any reason to go hunting for excuses to make it a bigger change.
2019-10-31 13:27:55 -02:30
..
admin nixos/oxidized: Use symlinks for config files 2019-08-14 09:30:51 +00:00
amqp nixos/rabbitmq: use a literalExample for example configItems 2019-10-18 12:36:16 +00:00
audio nixos/spotifyd: update spotifyd flags 2019-09-21 17:10:00 -05:00
backup nixos/borgbackup: add option to allow removable devices 2019-10-14 17:28:44 +02:00
cluster treewide: remove redundant quotes 2019-09-08 23:38:31 +00:00
computing nixos: remove dependencies on local-fs.target 2019-09-01 19:06:38 +02:00
continuous-integration nixos/nix-daemon: don't refer to deprecated option aliases 2019-10-18 12:27:43 +00:00
databases nixos/mysql: fix mysqlReplication test 2019-10-13 19:18:51 +03:00
desktops Merge pull request #70931 from symphorien/system-config-printer 2019-10-20 23:39:48 +00:00
development bloop: allow specifying extra cli options 2019-07-25 09:28:13 +02:00
editors Revert "nixos/doc: re-format" 2019-09-19 19:17:30 +02:00
games Merge branch 'master' into staging 2019-09-02 23:25:24 +02:00
hardware Revert "Merge pull request #71095 from flokli/pinentry-cleanup" 2019-10-16 20:28:21 -04:00
logging Merge branch 'master' into staging-next 2019-09-06 16:55:11 +02:00
mail Specify correct option type 2019-10-04 09:57:06 +02:00
misc Merge pull request #71428 from talyz/gitlab-already-initialized-constant 2019-10-21 20:52:54 +02:00
monitoring nixos/collectd: add option buildMinimalPackage 2019-10-20 00:53:49 +02:00
network-filesystems Merge pull request #41841 from Izorkin/samba 2019-10-12 14:31:39 +00:00
networking nixos/dnsdist: Add CAP_NET_BIND_SERVICE to AmbientCapabilities 2019-10-31 13:27:55 -02:30
printing Merge pull request #68218 from worldofpeace/cups-pk/no-auth-wheel 2019-09-09 04:42:19 -04:00
scheduling nixos: remove dependencies on local-fs.target 2019-09-01 19:06:38 +02:00
search nixos/kibana: Filter empty lists 2019-09-07 13:24:24 +01:00
security fprintd: 0.8.1 -> 0.9.0 2019-09-17 20:15:57 -04:00
system Merge branch 'master' into staging 2019-09-02 23:25:24 +02:00
torrent deluge service: fix my bad conflict resolution from f21211ebf 2019-09-08 08:42:53 +02:00
ttys treewide: remove redundant quotes 2019-08-26 21:40:19 +00:00
web-apps Merge pull request #69255 from minijackson/init-shiori 2019-10-12 09:01:58 -05:00
web-servers nixos/httpd: remove deprecated extraSubservices option 2019-10-20 20:16:45 -04:00
x11 Revert "nixos/gnome3: fix gnome-flashback" 2019-10-19 19:57:49 -04:00