mirror of
https://github.com/NixOS/nixpkgs.git
synced 2024-10-21 11:43:11 -04:00
cef2814a4f
This module adds an option `security.hideProcessInformation` that, when enabled, restricts access to process information such as command-line arguments to the process owner. The module adds a static group "proc" whose members are exempt from process information hiding. Ideally, this feature would be implemented by simply adding the appropriate mount options to `fileSystems."/proc".fsOptions`, but this was found to not work in vmtests. To ensure that process information hiding is enforced, we use a systemd service unit that remounts `/proc` after `systemd-remount-fs.service` has completed. To verify the correctness of the feature, simple tests were added to nixos/tests/misc: the test ensures that unprivileged users cannot see process information owned by another user, while members of "proc" CAN. Thanks to @abbradar for feedback and suggestions. |
||
|---|---|---|
| .. | ||
| common | ||
| avahi.nix | ||
| bittorrent.nix | ||
| blivet.nix | ||
| boot.nix | ||
| cadvisor.nix | ||
| chromium.nix | ||
| cjdns.nix | ||
| containers.nix | ||
| dnscrypt-proxy.nix | ||
| docker-registry.nix | ||
| docker.nix | ||
| ec2.nix | ||
| etcd.nix | ||
| firefox.nix | ||
| firewall.nix | ||
| fleet.nix | ||
| gitlab.nix | ||
| gnome3-gdm.nix | ||
| gnome3.nix | ||
| grsecurity.nix | ||
| haka.nix | ||
| i3wm.nix | ||
| influxdb.nix | ||
| initrd-network.nix | ||
| installer.nix | ||
| ipv6.nix | ||
| jenkins.nix | ||
| kde4.nix | ||
| kexec.nix | ||
| keymap.nix | ||
| kubernetes.nix | ||
| lightdm.nix | ||
| login.nix | ||
| logstash.nix | ||
| make-test.nix | ||
| mathics.nix | ||
| mesos.nix | ||
| misc.nix | ||
| mpich-example.c | ||
| mpich.nix | ||
| mumble.nix | ||
| munin.nix | ||
| mysql-replication.nix | ||
| mysql.nix | ||
| nat.nix | ||
| networking-proxy.nix | ||
| networking.nix | ||
| nfs.nix | ||
| nsd.nix | ||
| openssh.nix | ||
| panamax.nix | ||
| partition.nix | ||
| peerflix.nix | ||
| phabricator.nix | ||
| postgresql.nix | ||
| printing.nix | ||
| proxy.nix | ||
| pump.io.nix | ||
| quake3.nix | ||
| rabbitmq.nix | ||
| riak.nix | ||
| run-in-machine.nix | ||
| sddm-kde5.nix | ||
| sddm.nix | ||
| simple.nix | ||
| slurm.nix | ||
| subversion.nix | ||
| test-config-examples.sh | ||
| testdb.sql | ||
| tomcat.nix | ||
| trac.nix | ||
| udisks2.nix | ||
| virtualbox.nix | ||
| xfce.nix | ||