BoomMicrophone/nixpkgs-suyu
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #120620 from mweinelt/empty-capability-bounding-sets

Browse source 
nixos/{opendkim,rspamd}: Fix CapabilityBoundingSet option
This commit is contained in:
lewo 2021-05-01 08:17:19 +02:00 committed by GitHub
commit 85aef7706e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
nixos/modules/services/mail/opendkim.nix
View file

@ -134,7 +134,7 @@ in {
ReadWritePaths = [ cfg.keyPath ];
AmbientCapabilities = [];
CapabilityBoundingSet = [];
CapabilityBoundingSet = "";
DevicePolicy = "closed";
LockPersonality = true;
MemoryDenyWriteExecute = true;

2
nixos/modules/services/mail/rspamd.nix
View file

@ -410,7 +410,7 @@ in
StateDirectoryMode = "0700";
AmbientCapabilities = [];
CapabilityBoundingSet = [];
CapabilityBoundingSet = "";
DevicePolicy = "closed";
LockPersonality = true;
NoNewPrivileges = true;