b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Merge pull request #122825 from Izorkin/update-duplicates-systemcallfilters

Browse source 
treewide: remove duplicates SystemCallFilters
This commit is contained in:
Jörg Thalheim 2021-05-17 12:06:06 +01:00 committed by GitHub
parent 70b37f9bf2 feebe402f5
commit b900661f6e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
6 changed files with 6 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
nixos/modules/services/databases/redis.nix
View file

@ -331,7 +331,7 @@ in {
PrivateMounts = true;
# System Call Filtering
SystemCallArchitectures = "native";
SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @privileged @raw-io @reboot @resources @setuid @swap";
SystemCallFilter = "~@cpu-emulation @debug @keyring @memlock @mount @obsolete @privileged @resources @setuid";
};
};
};

4
nixos/modules/services/misc/jellyfin.nix
View file

@ -92,9 +92,7 @@ in
SystemCallErrorNumber = "EPERM";
SystemCallFilter = [
"@system-service"
"~@chown" "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@module"
"~@obsolete" "~@privileged" "~@setuid"
"~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@obsolete" "~@privileged" "~@setuid"
];
};
};

2
nixos/modules/services/network-filesystems/samba-wsdd.nix
View file

@ -117,7 +117,7 @@ in {
PrivateMounts = true;
# System Call Filtering
SystemCallArchitectures = "native";
SystemCallFilter = "~@clock @cpu-emulation @debug @module @mount @obsolete @privileged @raw-io @reboot @resources @swap";
SystemCallFilter = "~@cpu-emulation @debug @mount @obsolete @privileged @resources";
};
};
};

4
nixos/modules/services/networking/croc.nix
View file

@ -72,9 +72,7 @@ in
RuntimeDirectoryMode = "700";
SystemCallFilter = [
"@system-service"
"~@aio" "~@chown" "~@keyring" "~@memlock"
"~@privileged" "~@resources" "~@setuid"
"~@sync" "~@timer"
"~@aio" "~@keyring" "~@memlock" "~@privileged" "~@resources" "~@setuid" "~@sync" "~@timer"
];
SystemCallArchitectures = "native";
SystemCallErrorNumber = "EPERM";

5
nixos/modules/services/web-apps/shiori.nix
View file

@ -86,10 +86,7 @@ in {
SystemCallErrorNumber = "EPERM";
SystemCallFilter = [
"@system-service"
"~@chown" "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock"
"~@module" "~@obsolete" "~@privileged" "~@raw-io"
"~@resources" "~@setuid"
"~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@obsolete" "~@privileged" "~@resources" "~@setuid"
];
};
};

2
nixos/modules/services/web-servers/nginx/default.nix
View file

@ -859,7 +859,7 @@ in
PrivateMounts = true;
# System Call Filtering
SystemCallArchitectures = "native";
SystemCallFilter = "~@chown @cpu-emulation @debug @keyring @ipc @module @mount @obsolete @privileged @raw-io @reboot @setuid @swap";
SystemCallFilter = "~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid";
};
};