talexander/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Releases Activity

nixos/minio: harden service

Browse Source
This commit is contained in:
Alex Martens 2025-05-14 17:32:05 -07:00 committed by Pascal Bach
parent 8f5972c5de
commit 5420ae11ea
1 changed files with 38 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
nixos/modules/services/web-servers/minio.nix
View File

@ -135,6 +135,44 @@ in
(legacyCredentials cfg)
else
null;
# hardening
DevicePolicy = "closed";
CapabilityBoundingSet = "";
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_NETLINK"
"AF_UNIX"
];
DeviceAllow = "";
NoNewPrivileges = true;
PrivateDevices = true;
PrivateMounts = true;
PrivateTmp = true;
PrivateUsers = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
MemoryDenyWriteExecute = true;
LockPersonality = true;
RemoveIPC = true;
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
];
ProtectProc = "invisible";
ProtectHostname = true;
UMask = "0077";
# minio opens /proc/mounts on startup
ProcSubset = "all";
};
environment = {
MINIO_REGION = "${cfg.region}";