Merge pull request #205573 from mweinelt/evcc-fixups
This commit is contained in:
@@ -48,7 +48,10 @@ in
|
||||
wantedBy = [
|
||||
"multi-user.target"
|
||||
];
|
||||
|
||||
environment.HOME = "/var/lib/evcc";
|
||||
path = with pkgs; [
|
||||
glibc # requires getent
|
||||
];
|
||||
serviceConfig = {
|
||||
ExecStart = "${package}/bin/evcc --config ${configFile} ${escapeShellArgs cfg.extraArgs}";
|
||||
CapabilityBoundingSet = [ "" ];
|
||||
@@ -77,6 +80,7 @@ in
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
StateDirectory = "evcc";
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
|
||||
@@ -87,6 +87,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} :
|
||||
|
||||
with subtest("Check journal for errors"):
|
||||
_, output = machine.execute("journalctl -o cat -u evcc.service")
|
||||
assert "FATAL" not in output
|
||||
assert "ERROR" not in output
|
||||
|
||||
with subtest("Check systemd hardening"):
|
||||
|
||||
Reference in New Issue
Block a user