Merge pull request #97631 from Izorkin/nginx-sandboxing

nixos/nginx: remove option enableSandbox
This commit is contained in:
Florian Klink 2020-09-10 20:33:25 +02:00 committed by GitHub
commit 484632983f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 2 additions and 12 deletions

View file

@ -427,8 +427,8 @@ php.override {
</listitem>
<listitem>
<para>
Add option <literal>services.nginx.enableSandbox</literal> to starting Nginx web server with additional sandbox/hardening options.
By default, write access to <literal>services.nginx.stateDir</literal> is allowed. To allow writing to other folders,
Nginx web server now starting with additional sandbox/hardening options. By default, write access
to <literal>services.nginx.stateDir</literal> is allowed. To allow writing to other folders,
use <literal>systemd.services.nginx.serviceConfig.ReadWritePaths</literal>
<programlisting>
systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];

View file

@ -463,14 +463,6 @@ in
'';
};
enableSandbox = mkOption {
default = false;
type = types.bool;
description = ''
Starting Nginx web server with additional sandbox/hardening options.
'';
};
user = mkOption {
type = types.str;
default = "nginx";
@ -728,7 +720,6 @@ in
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_RESOURCE" ];
# Security
NoNewPrivileges = true;
} // optionalAttrs cfg.enableSandbox {
# Sandboxing
ProtectSystem = "strict";
ProtectHome = mkDefault true;

View file

@ -18,7 +18,6 @@ import ./make-test-python.nix ({ pkgs, ... }: {
];
services.nginx.enable = true;
services.nginx.package = pkgs.nginx-lua;
services.nginx.enableSandbox = true;
services.nginx.virtualHosts.localhost = {
extraConfig = ''
location /test1-write {