Dawoox/nixpkgs
1
1
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

nixos/systemd/shutdown: stricter sandboxing

Browse Source 
Copied the config from archlinux's mkinitcpio:
318ae30f6a/systemd/mkinitcpio-generate-shutdown-ramfs.service
This commit is contained in:
nikstur
2025-10-10 23:18:06 +02:00
parent 7fe74bb833
commit b9d0fd8be4
1 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
nixos/modules/system/boot/systemd/shutdown.nix
View File

@@ -71,9 +71,21 @@ in
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.makeInitrdNGTool}/bin/make-initrd-ng ${ramfsContents} /run/initramfs";
# Sandboxing
ProtectSystem = "strict";
ReadWritePaths = "/run/initramfs";
ExecStart = "${pkgs.makeInitrdNGTool}/bin/make-initrd-ng ${ramfsContents} /run/initramfs";
ProtectHome = true;
ProtectHostname = true;
ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
PrivateNetwork = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
};
};
};