pyrox.dev / nixpkgs
lol
fork atom

Merge pull request #280561 from RaitoBezarius/fix-listmonk-module

nixos/mail/listmonk: fix hardening directives

authored by Ryan Lahfa and committed by GitHub bbd92ae0 44596db6

+2 -3
unified split
+2 -3
nixos/modules/services/mail/listmonk.nix
··· 201 DynamicUser = true; 202 NoNewPrivileges = true; 203 CapabilityBoundingSet = ""; 204 - SystemCallArchitecture = "native"; 205 SystemCallFilter = [ "@system-service" "~@privileged" ]; 206 - ProtectDevices = true; 207 ProtectControlGroups = true; 208 ProtectKernelTunables = true; 209 ProtectHome = true; 210 - DeviceAllow = false; 211 RestrictNamespaces = true; 212 RestrictRealtime = true; 213 UMask = "0027";
··· 201 DynamicUser = true; 202 NoNewPrivileges = true; 203 CapabilityBoundingSet = ""; 204 + SystemCallArchitectures = "native"; 205 SystemCallFilter = [ "@system-service" "~@privileged" ]; 206 + PrivateDevices = true; 207 ProtectControlGroups = true; 208 ProtectKernelTunables = true; 209 ProtectHome = true; 210 RestrictNamespaces = true; 211 RestrictRealtime = true; 212 UMask = "0027";