diff options
author | Joachim Fasting <joachifm@fastmail.fm> | 2016-09-15 15:23:52 +0200 |
---|---|---|
committer | Joachim Fasting <joachifm@fastmail.fm> | 2016-09-15 15:36:03 +0200 |
commit | 527b3dc1df24ae6097fc5aa2fc6986a25799cecc (patch) | |
tree | 3878cba649faf185126c9780e629fa5e1b188925 /nixos/modules/security/hidepid.nix | |
parent | fa787da36f6302b45809ec5c9b011e6bd2532956 (diff) | |
download | nixlib-527b3dc1df24ae6097fc5aa2fc6986a25799cecc.tar nixlib-527b3dc1df24ae6097fc5aa2fc6986a25799cecc.tar.gz nixlib-527b3dc1df24ae6097fc5aa2fc6986a25799cecc.tar.bz2 nixlib-527b3dc1df24ae6097fc5aa2fc6986a25799cecc.tar.lz nixlib-527b3dc1df24ae6097fc5aa2fc6986a25799cecc.tar.xz nixlib-527b3dc1df24ae6097fc5aa2fc6986a25799cecc.tar.zst nixlib-527b3dc1df24ae6097fc5aa2fc6986a25799cecc.zip |
hidepid module: detailed description to external doc
Diffstat (limited to 'nixos/modules/security/hidepid.nix')
-rw-r--r-- | nixos/modules/security/hidepid.nix | 24 |
1 files changed, 12 insertions, 12 deletions
diff --git a/nixos/modules/security/hidepid.nix b/nixos/modules/security/hidepid.nix index 8f2df380cfe8..ee351eb84473 100644 --- a/nixos/modules/security/hidepid.nix +++ b/nixos/modules/security/hidepid.nix @@ -2,19 +2,19 @@ with lib; { - options = { - security.hideProcessInformation = mkEnableOption "" // { description = '' - Restrict access to process information to the owning user. Enabling - this option implies, among other things, that command-line arguments - remain private. This option is recommended for most systems, unless - there's a legitimate reason for allowing unprivileged users to inspect - the process information of other users. + meta = { + maintainers = [ maintainers.joachifm ]; + doc = ./hidepid.xml; + }; - Members of the group "proc" are exempt from process information hiding. - To allow a service to run without process information hiding, add "proc" - to its supplementary groups via - <option>systemd.services.<name?>.serviceConfig.SupplementaryGroups</option>. - ''; }; + options = { + security.hideProcessInformation = mkOption { + type = types.bool; + default = false; + description = '' + Restrict process information to the owning user. + ''; + }; }; config = mkIf config.security.hideProcessInformation { |