Sovran Cleanandnaturallaw777
1fbeafd02f
- Move modules/vendor/nix-bitcoin/* -> modules/bitcoin/* (clean, Sovran-owned)
* modules/bitcoin/default.nix imports the 6 tailored services
* modules/bitcoin/common.nix bundles secrets/onion/lib
* modules/bitcoin/stubs.nix kept minimal (no clightning)
* packages/lndinit/default.nix replaces pkgs/sovran-overlay.nix
(lnd.nix now uses pkgs.callPackage ../../packages/lndinit {})
- Remove pkgs/sovran-overlay.nix, pkgs/nbxplorer.nix, pkgs/README.md
* No global overlay - lndinit is a normal package in packages/
- Remove modules/vendor/ entirely
- Update flake.nix: drop overlay-sovran, import ./modules/bitcoin
instead of ./modules/vendor/nix-bitcoin/modules.nix
- No more random vendor/ or pkgs/ dirs - follows Sovran convention:
modules/ for NixOS modules, packages/ for packages
49 lines
1.6 KiB
Nix
49 lines
1.6 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
{
|
|
options = {
|
|
nix-bitcoin.security.dbusHideProcessInformation = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
Only allow users with group `proc` to retrieve systemd unit information like
|
|
cgroup paths (i.e. (sub)process command lines) via D-Bus.
|
|
|
|
This mitigates a systemd security issue where (sub)process command lines can
|
|
be retrieved by services even when their access to /proc is restricted
|
|
(via ProtectProc).
|
|
|
|
This option works by restricting the D-Bus method `GetUnitProcesses`, which
|
|
is also used internally by {command}`systemctl status`.
|
|
'';
|
|
};
|
|
};
|
|
|
|
config = mkIf config.nix-bitcoin.security.dbusHideProcessInformation {
|
|
users.groups.proc = {};
|
|
nix-bitcoin.operator.groups = [ "proc" ]; # Enable operator access to systemd-status
|
|
|
|
services.dbus.packages = lib.mkAfter [ # Apply at the end to override the default policy
|
|
(pkgs.writeTextDir "etc/dbus-1/system.d/dbus.conf" ''
|
|
<busconfig>
|
|
<policy context="default">
|
|
<deny
|
|
send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="GetUnitProcesses"
|
|
/>
|
|
</policy>
|
|
<policy group="proc">
|
|
<allow
|
|
send_destination="org.freedesktop.systemd1"
|
|
send_interface="org.freedesktop.systemd1.Manager"
|
|
send_member="GetUnitProcesses"
|
|
/>
|
|
</policy>
|
|
</busconfig>
|
|
'')
|
|
];
|
|
};
|
|
}
|