Archive/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-10-22 11:54:30 -04:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity
nixpkgs/nixos
History
Martin Weinelt 506bc7ba02
nixos/nginx: update hardening settings 
- Set an explicit umask that allows u+rwx and g+r.
- Adds `ProtectControlGroups` and `ProtectKernelLogs`, there should be
  no need to access either.
- Adds `ProtectClock` to prevent write-access to the system clock.
- `ProtectProc` hides processes from other users within the /proc
  filesystem and `ProcSubSet` hides all files/directories unrelated to
  the process management of the units process.
- Sets `RemoveIPC`, as there is no SysV or POSIX IPC within nginx that I
  know of.
- Restricts the creation of arbitrary namespaces
- Adds a reasonable `SystemCallFilter` preventing calls to @privileged,
  @obsolete and others.

And finally applies some sorting based on the order these options appear
in systemd.exec(5).
2021-04-30 18:49:43 +02:00
..
doc Merge pull request #118338 from Izorkin/update-nginx-zlib-ng 2021-04-27 16:36:25 +02:00
lib treewide: use lib.warnIf where appropriate 2021-04-28 21:44:21 +00:00
maintainers treewide: use auto diskSize for make-disk-image 2021-04-24 14:49:07 -04:00
modules nixos/nginx: update hardening settings 2021-04-30 18:49:43 +02:00
tests nixos/tests/cage: Increase the xterm font size to fix the test 2021-04-29 21:08:10 +02:00
COPYING
default.nix
README
release-combined.nix
release-small.nix
release.nix nixos: use supportedSystems argument instead of hardcoded list for netboot 2021-04-23 18:34:51 +02:00

README 

*** NixOS ***

NixOS is a Linux distribution based on the purely functional package
management system Nix.  More information can be found at
https://nixos.org/nixos and in the manual in doc/manual.