37 lines
1.5 KiB
Diff
37 lines
1.5 KiB
Diff
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
|
|
index 014c5b16097..c559edc6978 100644
|
|
--- a/nixos/modules/services/misc/gitea.nix
|
|
+++ b/nixos/modules/services/misc/gitea.nix
|
|
@@ -569,7 +569,10 @@ in
|
|
Restart = "always";
|
|
# Runtime directory and mode
|
|
RuntimeDirectory = "gitea";
|
|
- RuntimeDirectoryMode = "0755";
|
|
+ RuntimeDirectoryMode = "0750";
|
|
+ # Proc filesystem
|
|
+ ProcSubset = "pid";
|
|
+ ProtectProc = "invisible";
|
|
# Access write directories
|
|
ReadWritePaths = [ cfg.dump.backupDir cfg.repositoryRoot cfg.stateDir cfg.lfs.contentDir ];
|
|
UMask = "0027";
|
|
@@ -589,15 +592,17 @@ in
|
|
ProtectKernelModules = true;
|
|
ProtectKernelLogs = true;
|
|
ProtectControlGroups = true;
|
|
- RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ];
|
|
+ RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
|
|
+ RestrictNamespaces = true;
|
|
LockPersonality = true;
|
|
MemoryDenyWriteExecute = true;
|
|
+ RemoveIPC = true;
|
|
RestrictRealtime = true;
|
|
RestrictSUIDSGID = true;
|
|
PrivateMounts = true;
|
|
# System Call Filtering
|
|
SystemCallArchitectures = "native";
|
|
- SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap";
|
|
+ SystemCallFilter = [ "~@clock ~@cpu-emulation @debug @keyring @module @mount @obsolete @privileged @setuid" "setrlimit" ];
|
|
};
|
|
|
|
environment = {
|