diff options
| author | Sandro <sandro.jaeckel@gmail.com> | 2022-03-08 13:11:42 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-03-08 13:11:42 +0100 |
| commit | a879922e62decaff8ad73b237d9cf5aa69f712ff (patch) | |
| tree | b1a4d9116a9121bf846cf45ba9bd545546e1ccce /nixos | |
| parent | c69ce893afcfd9969f9b1fa9c02ecad64b0ebd57 (diff) | |
| parent | b672e4dd2c04b495fa03524c9d0fd6c9e8ca315b (diff) | |
| download | nixlib-a879922e62decaff8ad73b237d9cf5aa69f712ff.tar nixlib-a879922e62decaff8ad73b237d9cf5aa69f712ff.tar.gz nixlib-a879922e62decaff8ad73b237d9cf5aa69f712ff.tar.bz2 nixlib-a879922e62decaff8ad73b237d9cf5aa69f712ff.tar.lz nixlib-a879922e62decaff8ad73b237d9cf5aa69f712ff.tar.xz nixlib-a879922e62decaff8ad73b237d9cf5aa69f712ff.tar.zst nixlib-a879922e62decaff8ad73b237d9cf5aa69f712ff.zip | |
Merge pull request #163208 from Izorkin/fix-modsecurity-nginx
Diffstat (limited to 'nixos')
| -rw-r--r-- | nixos/modules/services/web-servers/nginx/default.nix | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index 7daf0f158b35..e046c28dd6bb 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -924,7 +924,8 @@ in PrivateMounts = true; # System Call Filtering SystemCallArchitectures = "native"; - SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" ] ++ optionals (cfg.package != pkgs.tengine) [ "~@ipc" ]; + SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" ] + ++ optionals ((cfg.package != pkgs.tengine) && (!lib.any (mod: (mod.disableIPC or false)) cfg.package.modules)) [ "~@ipc" ]; }; }; |