Merge pull request #108238 from snicket2100/more-dnscrypt-proxy-hardening
nixos/dnscrypt-proxy2: more service hardening
This commit is contained in:
commit
2630a2df91
|
@ -87,6 +87,7 @@ in
|
|||
NoNewPrivileges = true;
|
||||
NonBlocking = true;
|
||||
PrivateDevices = true;
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
|
@ -107,8 +108,13 @@ in
|
|||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"@chown"
|
||||
"~@aio"
|
||||
"~@keyring"
|
||||
"~@memlock"
|
||||
"~@resources"
|
||||
"@privileged"
|
||||
"~@setuid"
|
||||
"~@sync"
|
||||
"~@timer"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
|
Loading…
Reference in a new issue