greg/nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security: don't restrict process info by default for module users

Browse Source
This commit is contained in:
Erik Arvstedt 2020-08-20 13:11:10 +02:00
parent a36789b468
commit 44de5064cd
No known key found for this signature in database
GPG Key ID: 33312B944DD97846
2 changed files with 36 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
modules/presets/secure-node.nix
View File

@ -42,8 +42,7 @@ in {
networking.firewall.enable = true; networking.firewall.enable = true;
# hideProcessInformation even if hardened kernel profile is disabled nix-bitcoin.security.hideProcessInformation = true;
security.hideProcessInformation = true;
# Tor # Tor
services.tor = { services.tor = {

64
modules/security.nix
View File

@ -1,33 +1,39 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, options, ... }:
{ {
# Only show the current user's processes in /proc. options = {
# Users with group 'proc' can still access all processes. nix-bitcoin.security.hideProcessInformation = options.security.hideProcessInformation;
security.hideProcessInformation = true; };
# This mitigates a systemd security issue leaking (sub)process config = lib.mkIf config.nix-bitcoin.security.hideProcessInformation {
# command lines. # Only show the current user's processes in /proc.
# Only allow users with group 'proc' to retrieve systemd unit information like # Users with group 'proc' can still access all processes.
# cgroup paths (i.e. (sub)process command lines) via D-Bus. security.hideProcessInformation = true;
# This D-Bus call is used by `systemctl status`.
services.dbus.packages = lib.mkAfter [ # Apply at the end to override the default policy # This mitigates a systemd security issue leaking (sub)process
(pkgs.writeTextDir "etc/dbus-1/system.d/dbus.conf" '' # command lines.
<busconfig> # Only allow users with group 'proc' to retrieve systemd unit information like
<policy context="default"> # cgroup paths (i.e. (sub)process command lines) via D-Bus.
<deny # This D-Bus call is used by `systemctl status`.
send_destination="org.freedesktop.systemd1" services.dbus.packages = lib.mkAfter [ # Apply at the end to override the default policy
send_interface="org.freedesktop.systemd1.Manager" (pkgs.writeTextDir "etc/dbus-1/system.d/dbus.conf" ''
send_member="GetUnitProcesses" <busconfig>
/> <policy context="default">
</policy> <deny
<policy group="proc"> send_destination="org.freedesktop.systemd1"
<allow send_interface="org.freedesktop.systemd1.Manager"
send_destination="org.freedesktop.systemd1" send_member="GetUnitProcesses"
send_interface="org.freedesktop.systemd1.Manager" />
send_member="GetUnitProcesses" </policy>
/> <policy group="proc">
</policy> <allow
</busconfig> send_destination="org.freedesktop.systemd1"
'') send_interface="org.freedesktop.systemd1.Manager"
]; send_member="GetUnitProcesses"
/>
</policy>
</busconfig>
'')
];
};
} }