greg
/
nix-bitcoin
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security: don't restrict process info by default for module users

This commit is contained in:
Erik Arvstedt 2020-08-20 13:11:10 +02:00
parent a36789b468
commit 44de5064cd
No known key found for this signature in database
GPG Key ID: 33312B944DD97846
2 changed files with 36 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
modules/presets/secure-node.nix
View File

@ -42,8 +42,7 @@ in {
networking.firewall.enable = true;
# hideProcessInformation even if hardened kernel profile is disabled
security.hideProcessInformation = true;
nix-bitcoin.security.hideProcessInformation = true;
# Tor
services.tor = {

8
modules/security.nix
View File

@ -1,6 +1,11 @@
{ config, lib, pkgs, ... }:
{ config, lib, pkgs, options, ... }:
{
options = {
nix-bitcoin.security.hideProcessInformation = options.security.hideProcessInformation;
};
config = lib.mkIf config.nix-bitcoin.security.hideProcessInformation {
# Only show the current user's processes in /proc.
# Users with group 'proc' can still access all processes.
security.hideProcessInformation = true;
@ -30,4 +35,5 @@
</busconfig>
'')
];
};
}