diff options
author | pennae <82953136+pennae@users.noreply.github.com> | 2023-06-25 14:57:19 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2023-06-25 14:57:19 +0200 |
commit | 32deda9ec08f550e4e0ece7708c4b674b2ca0dda (patch) | |
tree | 38307337f59f91da0d1bd33c944c09e33856e568 /nixos/modules/services/mail | |
parent | 1ae6063e841969ba8a966d6aa79b75f2d073b9bc (diff) | |
parent | 40c923aa13806beae85966bf063bd865812fefa8 (diff) | |
download | nixlib-32deda9ec08f550e4e0ece7708c4b674b2ca0dda.tar nixlib-32deda9ec08f550e4e0ece7708c4b674b2ca0dda.tar.gz nixlib-32deda9ec08f550e4e0ece7708c4b674b2ca0dda.tar.bz2 nixlib-32deda9ec08f550e4e0ece7708c4b674b2ca0dda.tar.lz nixlib-32deda9ec08f550e4e0ece7708c4b674b2ca0dda.tar.xz nixlib-32deda9ec08f550e4e0ece7708c4b674b2ca0dda.tar.zst nixlib-32deda9ec08f550e4e0ece7708c4b674b2ca0dda.zip |
Merge pull request #238222 from mads256h/harden-davmail
davmail: enable sandboxing options
Diffstat (limited to 'nixos/modules/services/mail')
-rw-r--r-- | nixos/modules/services/mail/davmail.nix | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/nixos/modules/services/mail/davmail.nix b/nixos/modules/services/mail/davmail.nix index 483f591a7268..9cdb435af4a1 100644 --- a/nixos/modules/services/mail/davmail.nix +++ b/nixos/modules/services/mail/davmail.nix @@ -91,6 +91,33 @@ in Restart = "on-failure"; DynamicUser = "yes"; LogsDirectory = "davmail"; + + CapabilityBoundingSet = [ "" ]; + DeviceAllow = [ "" ]; + LockPersonality = true; + NoNewPrivileges = true; + PrivateDevices = true; + PrivateTmp = true; + PrivateUsers = true; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectSystem = "strict"; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectProc = "invisible"; + RemoveIPC = true; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + SystemCallArchitectures = "native"; + SystemCallFilter = "@system-service"; + SystemCallErrorNumber = "EPERM"; + UMask = "0077"; + }; }; |