From b672e4dd2c04b495fa03524c9d0fd6c9e8ca315b Mon Sep 17 00:00:00 2001 From: Izorkin Date: Mon, 7 Mar 2022 23:28:43 +0300 Subject: nginxModules: add option disableIPC The disableIPC option is required to checking enabled nginxModules and disable the SystemCallFilter IPC filter. --- nixos/modules/services/web-servers/nginx/default.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'nixos') diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index 7daf0f158b35..e046c28dd6bb 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -924,7 +924,8 @@ in PrivateMounts = true; # System Call Filtering SystemCallArchitectures = "native"; - SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" ] ++ optionals (cfg.package != pkgs.tengine) [ "~@ipc" ]; + SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid" ] + ++ optionals ((cfg.package != pkgs.tengine) && (!lib.any (mod: (mod.disableIPC or false)) cfg.package.modules)) [ "~@ipc" ]; }; }; -- cgit 1.4.1