talexander/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Releases Activity

nixos/readeck: add back MemoryDenyWriteExecute

Browse Source 
SQLite driver is reverted to its CGO version so this can be enabled
This commit is contained in:
linsui 2025-06-05 03:47:00 +08:00
parent 49860b21df
commit 17f95268f3
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
nixos/modules/services/web-apps/readeck.nix
View File

@ -69,6 +69,7 @@ in
ExecStart = "${lib.getExe cfg.package} serve -config ${configFile}"; ExecStart = "${lib.getExe cfg.package} serve -config ${configFile}";
ProtectSystem = "full"; ProtectSystem = "full";
SystemCallArchitectures = "native"; SystemCallArchitectures = "native";
MemoryDenyWriteExecute = true;
NoNewPrivileges = true; NoNewPrivileges = true;
PrivateTmp = true; PrivateTmp = true;
PrivateDevices = true; PrivateDevices = true;