eeva/home-manager
1
0
Fork 0
mirror of https://github.com/nix-community/home-manager synced 2025-02-18 14:15:08 +01:00
Code Issues Releases Wiki Activity

espanso: add sandboxing for systemd service

Browse source
This commit is contained in:
Muhammad Talal Anwar 2024-10-18 22:20:18 +02:00
parent 2b13611eae
commit 0678a95352
2 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
modules/services/espanso.nix
View file

@ -124,6 +124,15 @@ in {
Type = "exec"; Type = "exec";
ExecStart = "${cfg.package}/bin/espanso daemon"; ExecStart = "${cfg.package}/bin/espanso daemon";
Restart = "on-failure"; Restart = "on-failure";
# Sandboxing.
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateUsers = true;
RestrictNamespaces = true;
SystemCallArchitectures = "native";
SystemCallFilter = "@system-service";
}; };
Install = { WantedBy = [ "default.target" ]; }; Install = { WantedBy = [ "default.target" ]; };
}; };

7
tests/modules/services/espanso/basic-configuration.service
View file

@ -3,7 +3,14 @@ WantedBy=default.target
[Service] [Service]
ExecStart=@espanso@/bin/espanso daemon ExecStart=@espanso@/bin/espanso daemon
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateUsers=true
Restart=on-failure Restart=on-failure
RestrictNamespaces=true
SystemCallArchitectures=native
SystemCallFilter=@system-service
Type=exec Type=exec
[Unit] [Unit]