nixos/nginx: add option enableSandbox
This commit is contained in:
parent
aa12fb8adb
commit
94391fce1d
|
@ -237,8 +237,8 @@ php.override {
|
|||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Nginx web server is now started with additional sandbox/hardening options. By default, write access to
|
||||
<literal>services.nginx.stateDir</literal> is allowed. To allow writing to other folders,
|
||||
Add option <literal>services.nginx.enableSandbox</literal> to starting Nginx web server with additional sandbox/hardening options.
|
||||
By default, write access to <literal>services.nginx.stateDir</literal> is allowed. To allow writing to other folders,
|
||||
use <literal>systemd.services.nginx.serviceConfig.ReadWritePaths</literal>
|
||||
<programlisting>
|
||||
systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
|
||||
|
|
|
@ -463,6 +463,14 @@ in
|
|||
'';
|
||||
};
|
||||
|
||||
enableSandbox = mkOption {
|
||||
default = false;
|
||||
type = types.bool;
|
||||
description = ''
|
||||
Starting Nginx web server with additional sandbox/hardening options.
|
||||
'';
|
||||
};
|
||||
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
default = "nginx";
|
||||
|
@ -713,6 +721,7 @@ in
|
|||
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_RESOURCE" ];
|
||||
# Security
|
||||
NoNewPrivileges = true;
|
||||
} // optionalAttrs cfg.enableSandbox {
|
||||
# Sandboxing
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = mkDefault true;
|
||||
|
|
|
@ -18,6 +18,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
|
|||
];
|
||||
services.nginx.enable = true;
|
||||
services.nginx.package = pkgs.nginx-lua;
|
||||
services.nginx.enableSandbox = true;
|
||||
services.nginx.virtualHosts.localhost = {
|
||||
extraConfig = ''
|
||||
location /test1-write {
|
||||
|
|
Loading…
Reference in a new issue