nixpkgs/nixos/modules/services/networking
ShaRose 9e2308ed80 nixos/dnsdist: Add CAP_NET_BIND_SERVICE to AmbientCapabilities
It seems that dnsdist doesn't actually request CAP_NET_BIND_SERVICE, which is why normally it's executed and root and setuids to another, unprivileged, user. This means that as it is, dnsdist will be unable to bind to any port under 1024 and will fail with access denied.

Removing CAP_SETGID and CAP_SETUID is also related to this as we don't actually change the uid or gid after the fact as we use DynamicUser. (That part isn't strictly NEEDED but there's no reason to have those capabilities if we don't use them).

There are also some additional sandboxing we can remove from the service definition as they are assumed true or strict by DynamicUser: specifically PrivateTmp and ProtectSystem respectively.

ProtectHome is still there, despite being assumed read-only as setting it to true means they are seen as empty. I don't think it really matters as I don't know if systemd will ignore it or not, but I didn't see any reason to go hunting for excuses to make it a bigger change.
2019-10-31 13:27:55 -02:30
..
firefox nixos/syncserver: mild cleanup 2019-01-30 15:59:01 +01:00
hylafax Merge staging-next into staging 2019-08-28 08:26:42 +02:00
ircd-hybrid treewide: remove redundant quotes 2019-08-26 21:40:19 +00:00
keepalived nixos/keepalived: Implemented vrrp-instance tracking scripts and interfaces. 2018-05-08 11:25:53 +02:00
nghttpx [bot] nixos/*: remove unused arguments in lambdas 2018-07-20 20:56:59 +00:00
ntp nixos/chrony: keep in foreground 2019-09-12 11:45:51 -05:00
ssh mass replace "flip map -> forEach" 2019-08-05 14:03:38 +03:00
strongswan-swanctl Merge staging-next into staging 2019-08-31 10:04:20 +02:00
znc nixos/modules: Replace all nested types.either's with types.oneOf's 2019-08-08 23:35:52 +02:00
amuled.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
aria2.nix nixos: remove dependencies on local-fs.target 2019-09-01 19:06:38 +02:00
asterisk.nix nixos/asterisk: /var/run -> /run 2019-03-24 21:13:19 +01:00
atftpd.nix nixos/atftpd: various improvements 2016-10-17 16:20:24 +02:00
autossh.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
avahi-daemon.nix nixos/avahi: refactor module, add option extraServiceFiles 2019-06-04 00:22:48 +02:00
babeld.nix treewide: remove redundant quotes 2019-08-26 21:40:19 +00:00
bind.nix nixos/bind: allow manual additions to zone config fragments 2019-07-20 17:50:37 +02:00
bird.nix nixos/bird: Fix reload 2019-05-31 01:21:18 +02:00
bitcoind.nix nixos/{namecoind,bitcoind}: removing the altcoin prefix 2019-08-31 10:15:03 +02:00
bitlbee.nix nixos/bitlbee: use purple-2 as purple_plugin_path (#49440) 2018-10-30 15:37:41 +01:00
charybdis.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
cjdns.nix nixos/cjdns: add extraConfig option (#53502) 2019-08-18 18:47:56 +02:00
cntlm.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
connman.nix Merge branch 'master' into staging 2019-09-02 23:25:24 +02:00
consul.nix Merge staging-next into staging 2019-08-28 08:26:42 +02:00
coredns.nix nixos/coredns: init (#54931) 2019-03-01 11:10:44 +02:00
coturn.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
dante.nix dante service: default for logoutput 2018-04-26 13:57:11 +03:00
ddclient.nix Fix ddclient extraConfig 2019-06-13 18:25:59 +02:00
dhcpcd.nix nixos/dhcpcd: Before network-online.target 2019-07-11 12:23:41 +01:00
dhcpd.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
dnscache.nix nixos: add preferLocalBuild=true; on derivations for config files 2019-02-22 20:11:27 +01:00
dnschain.nix nixos/dnschain: disable DNSSEC for namecoin TLDs 2019-08-27 14:42:06 +02:00
dnscrypt-proxy.nix dnscrypt-proxy: make man 8 dnscrypt-proxy work (#41039) 2018-05-31 23:15:19 +02:00
dnscrypt-proxy.xml Revert "nixos/doc: re-format" 2019-09-19 19:17:30 +02:00
dnscrypt-wrapper.nix nixos/dnscrypt-wrapper: fix rotate script failing to restart the service 2018-01-05 02:37:09 +01:00
dnsdist.nix nixos/dnsdist: Add CAP_NET_BIND_SERVICE to AmbientCapabilities 2019-10-31 13:27:55 -02:30
dnsmasq.nix resolvconf service: init 2019-07-15 20:25:39 +03:00
ejabberd.nix nixos/ejabberd: migrate to tmpfiles, drop runit 2019-04-23 14:00:49 +02:00
epmd.nix epmd: Introduce erlang port mapper daemon service 2018-07-19 17:32:29 +02:00
eternal-terminal.nix Address more review feedback. 2018-10-24 17:57:33 -07:00
fakeroute.nix fakeroute: add service 2016-11-23 15:23:10 +01:00
ferm.nix nixos/treewide: remove boolean examples for options 2017-03-17 23:36:19 +01:00
fireqos.nix nixos/fireqos: add service 2017-09-09 00:29:46 +02:00
firewall.nix nixos/firewall: rename iptables-compat to iptables-nftables-compat 2019-09-22 09:09:43 +01:00
flannel.nix treewide: Remove usage of isNull 2019-04-29 14:05:50 +02:00
flashpolicyd.nix nixos/flashpolicyd: fix url and use https 2018-11-24 23:13:09 +01:00
freenet.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
freeradius.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
gale.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
gateone.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
gdomap.nix [bot]: remove unreferenced code 2018-07-20 18:48:37 +00:00
git-daemon.nix treewide: remove redundant quotes 2019-08-26 21:40:19 +00:00
gnunet.nix nixos/gnunet: fix typo in PrivateTmp parameter (#56343) 2019-02-25 15:53:36 +01:00
gogoclient.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
gvpe.nix
hans.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
haproxy.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
heyefi.nix
hostapd.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
htpdate.nix nixos/htpdate: /var/run -> /run 2019-03-24 21:15:26 +01:00
i2p.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
i2pd.nix treewide: Remove usage of isNull 2019-04-29 14:05:50 +02:00
iodine.nix iodine: improve password handling (#58806) 2019-04-08 21:20:26 +02:00
iperf3.nix nixos/iperf: add openFirewall setting 2019-07-04 16:58:56 +02:00
iwd.nix nixos/iwd: add tmpfiles rule for ead service 2019-09-06 11:32:55 -04:00
jormungandr.nix nixos/jormungandr: moving to a new section topics_of_interest 2019-09-19 10:51:59 +02:00
keybase.nix Merge pull request #30712 from peterhoeg/f/service 2019-08-02 11:58:27 +08:00
kippo.nix Merge branch 'master' into staging 2019-09-02 23:25:24 +02:00
knot.nix nixos/knot: init 2019-03-14 01:28:53 +01:00
kresd.nix knot-resolver: 3.2.1 -> 4.0.0 2019-07-10 17:40:04 +02:00
lambdabot.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
libreswan.nix nixos/libreswan: add missing runtime dependencies 2017-10-22 15:36:26 +02:00
lldpd.nix nixos/lldpd: /var/run -> /run 2019-03-24 21:15:27 +01:00
logmein-hamachi.nix nixos: remove dependencies on local-fs.target 2019-09-01 19:06:38 +02:00
mailpile.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
matterbridge.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
minidlna.nix nixos/minidlna: Allow more configuration options 2019-09-17 19:51:33 +02:00
miniupnpd.nix nixos/miniupnpd: /var/run -> /run 2019-03-24 21:15:28 +01:00
miredo.nix cleanup redundant text in modules utilizing mkEnableOption 2019-04-20 14:44:02 +02:00
mjpg-streamer.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
monero.nix cleanup redundant text in modules utilizing mkEnableOption 2019-04-20 14:44:02 +02:00
morty.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
mosquitto.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
mstpd.nix
mtprotoproxy.nix treewide: remove redundant quotes 2019-08-26 21:40:19 +00:00
murmur.nix murmur service: fix typo in description 2019-09-06 20:29:20 +03:00
mxisd.nix nixos/mxisd: add support for ma1sd 2019-10-07 18:57:15 +02:00
namecoind.nix nixos/{namecoind,bitcoind}: removing the altcoin prefix 2019-08-31 10:15:03 +02:00
nat.nix nixos/nat: optional networking.nat.externalInterface (#41864) 2018-06-12 15:14:15 +02:00
ndppd.nix treewide: remove redundant quotes 2019-08-26 21:40:19 +00:00
networkmanager.nix nixos/networkmanager: remove networking.networkmanager.dynamic… (#71337) 2019-10-21 02:33:28 +02:00
nftables.nix nixos: Move uses of stdenv.shell to runtimeShell. 2018-03-01 14:38:53 -05:00
ngircd.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
nix-serve.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
nixops-dns.nix nixos/nixops-dns: init (#34511) 2018-02-20 10:14:55 +00:00
nntp-proxy.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
nsd.nix Merge staging-next into staging 2019-08-31 10:04:20 +02:00
ntopng.nix
nullidentdmod.nix cleanup redundant text in modules utilizing mkEnableOption 2019-04-20 14:44:02 +02:00
nylon.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
ocserv.nix nixos/ocserv: /var/run -> /run 2019-03-24 21:15:28 +01:00
ofono.nix nixos/ofono: allow adding 3rd party plug-ins 2019-08-23 19:50:53 +02:00
oidentd.nix oidentd: 2.2.2 -> 2.3.1 2018-11-07 14:51:45 +02:00
openfire.nix openfire service: more informative assertion failure message 2016-12-10 20:35:43 +01:00
openvpn.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
ostinato.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
owamp.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
pdns-recursor.nix treewide: remove redundant quotes 2019-09-08 23:38:31 +00:00
pdnsd.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
polipo.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
powerdns.nix powerdns: removed PrivateTmp=true in serviceConfig 2016-10-01 12:27:23 -04:00
pppd.nix nixos/pppd: add description for peers, unbreaks metrics job and channel 2019-10-17 13:59:52 +02:00
pptpd.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
prayer.nix nixos: add preferLocalBuild=true; on derivations for config files 2019-02-22 20:11:27 +01:00
privoxy.nix privoxy service: remove static uid 2016-12-05 13:37:08 +01:00
prosody.nix nixos/prosody: fix escape 2019-09-17 00:20:05 +00:00
quagga.nix quagga module: Use a deep merge via imports instead of the shallow merge 2018-07-05 22:11:29 -04:00
quassel.nix nixos/quassel: replace deprecated usage of PermissionsStartOnly 2019-05-26 07:20:55 -04:00
quicktun.nix treewide: remove redundant quotes 2019-08-26 21:40:19 +00:00
racoon.nix nixos/raccoon: /var/run -> /run 2019-03-24 21:15:28 +01:00
radicale.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
radvd.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
rdnssd.nix resolvconf service: init 2019-07-15 20:25:39 +03:00
redsocks.nix redsocks module: add self as maintainer 2018-10-31 01:06:14 +09:00
resilio.nix nixos: remove dependencies on local-fs.target 2019-09-01 19:06:38 +02:00
rpcbind.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
rxe.nix nixos/rdma-core: add module for soft RoCE and test (#34607) 2018-02-10 07:52:03 +00:00
sabnzbd.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
searx.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
seeks.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
shadowsocks.nix shadowsocks service: support dual-stack server 2019-08-18 23:07:51 +03:00
shairport-sync.nix shairport-sync service: fix default arguments 2019-01-02 19:17:22 +01:00
shout.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
skydns.nix etcd: make all service using etc go to 127.0.0.1:2379 by default 2016-11-11 23:11:54 +01:00
smokeping.nix Merge branch 'master' into staging 2019-09-02 23:25:24 +02:00
sniproxy.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
softether.nix Merge branch 'master' into staging 2019-09-02 23:25:24 +02:00
spiped.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
squid.nix nixos/squid: replace deprecated usage of PermissionsStartOnly 2019-05-26 07:20:55 -04:00
sslh.nix nixos/sslh: add transparent proxying support (#41412) 2018-06-09 00:38:51 +02:00
strongswan.nix nixos/treewide: drop dependencies to keys.target 2019-08-27 18:55:55 +02:00
stubby.nix nixos/stubby: Clearer wording for upstreamServers 2019-08-07 12:23:20 +00:00
stunnel.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
supplicant.nix nixos/supplicant: /var/run -> /run 2019-03-24 21:15:29 +01:00
supybot.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
syncplay.nix syncplay module: init 2019-09-03 00:30:12 +02:00
syncthing-relay.nix syncthing-relay module: init 2018-11-19 01:09:54 +01:00
syncthing.nix treewide: remove redundant quotes 2019-08-26 21:40:19 +00:00
tcpcrypt.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
teamspeak3.nix nixos/teamspeak3: replace deprecated usage of PermissionsStartOnly 2019-05-26 07:20:54 -04:00
tedicross.nix nixos/tedicross: add module 2019-04-23 22:52:23 +02:00
tftpd.nix nixos/tftpd: change default dir from /home/tftp to /srv/tftp 2016-10-25 17:20:52 +02:00
thelounge.nix nixos/thelounge: init 2019-07-23 13:18:01 +02:00
tinc.nix nixos/tinc: remove ordering dependency on network.target 2019-04-25 22:54:11 +02:00
tinydns.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
tox-bootstrapd.nix nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
tox-node.nix nixos/tox-node: Add descriptions to module options. 2019-04-15 17:11:10 +01:00
toxvpn.nix nixos/toxvpn: Fix typo in option description 2019-09-09 19:31:48 +02:00
tvheadend.nix [bot] nixos/*: remove unused arguments in lambdas 2018-07-20 20:56:59 +00:00
unbound.nix resolvconf service: init 2019-07-15 20:25:39 +03:00
unifi.nix nixos/unifi: restarting on failure (#67456) 2019-08-25 18:22:03 -06:00
vsftpd.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
wakeonlan.nix
websockify.nix treewide: remove redundant quotes 2019-08-26 21:40:19 +00:00
wg-quick.nix nixos/modules/networking/wg-quick Add wg-quick options support 2019-04-20 14:02:54 +02:00
wicd.nix
wireguard.nix nixos/wireguard: add peer service to interface dependencies (#62828) 2019-06-09 11:51:45 +02:00
wpa_supplicant.nix nixos/doc: Clarify wireless examples 2019-09-26 22:52:21 -04:00
xinetd.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
xl2tpd.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
xrdp.nix nixos/xrdp: /var/run -> /run 2019-03-24 21:15:29 +01:00
zerobin.nix treewide: remove redundant quotes 2019-08-26 21:40:19 +00:00
zeronet.nix nixos/zeronet: improved config, dynamic user 2019-10-03 17:03:32 -05:00
zerotierone.nix nixos/zerotier: binds to network-online.target to avoid the 1m30s timeout before kill on shutdown 2018-11-01 23:00:25 +00:00