diff options
author | xeji <36407913+xeji@users.noreply.github.com> | 2018-10-30 15:57:11 +0100 |
---|---|---|
committer | GitHub <noreply@github.com> | 2018-10-30 15:57:11 +0100 |
commit | 1d9481a127c1438c0a8cf00e08c11f58e91541f6 (patch) | |
tree | 8b2711e5db1b3cc2229cc83e9f8d1b9edb010004 /nixos | |
parent | f68cf486d8410d5463c7bde41d533566b46f7582 (diff) | |
parent | d7e4c49ffc4c3879bc2edb287f0758c17b0e00e3 (diff) | |
download | nixlib-1d9481a127c1438c0a8cf00e08c11f58e91541f6.tar nixlib-1d9481a127c1438c0a8cf00e08c11f58e91541f6.tar.gz nixlib-1d9481a127c1438c0a8cf00e08c11f58e91541f6.tar.bz2 nixlib-1d9481a127c1438c0a8cf00e08c11f58e91541f6.tar.lz nixlib-1d9481a127c1438c0a8cf00e08c11f58e91541f6.tar.xz nixlib-1d9481a127c1438c0a8cf00e08c11f58e91541f6.tar.zst nixlib-1d9481a127c1438c0a8cf00e08c11f58e91541f6.zip |
Merge pull request #49395 from dtzWill/update/upower-0.99.9
upower: 0.99.7 -> 0.99.9, lock down service
Diffstat (limited to 'nixos')
-rw-r--r-- | nixos/modules/services/hardware/upower.nix | 26 |
1 files changed, 26 insertions, 0 deletions
diff --git a/nixos/modules/services/hardware/upower.nix b/nixos/modules/services/hardware/upower.nix index 2198842a4511..1da47349c077 100644 --- a/nixos/modules/services/hardware/upower.nix +++ b/nixos/modules/services/hardware/upower.nix @@ -56,6 +56,32 @@ in { Type = "dbus"; BusName = "org.freedesktop.UPower"; ExecStart = "@${cfg.package}/libexec/upowerd upowerd"; + Restart = "on-failure"; + # Upstream lockdown: + # Filesystem lockdown + ProtectSystem = "strict"; + # Needed by keyboard backlight support + ProtectKernelTunables = false; + ProtectControlGroups = true; + ReadWritePaths = "/var/lib/upower"; + ProtectHome = true; + PrivateTmp = true; + + # Network + # PrivateNetwork=true would block udev's netlink socket + RestrictAddressFamilies = "AF_UNIX AF_NETLINK"; + + # Execute Mappings + MemoryDenyWriteExecute = true; + + # Modules + ProtectKernelModules = true; + + # Real-time + RestrictRealtime = true; + + # Privilege escalation + NoNewPrivileges = true; }; }; |