Restrict namespaces for systemd services by default

2019-04-28 13:11:27 +00:00
parent eaaf8e9aab
commit 6f8dac6e07
1 changed files with 1 additions and 0 deletions
--- a/modules/nix-bitcoin-services.nix
+++ b/modules/nix-bitcoin-services.nix
@@ -14,6 +14,7 @@ let
      ProtectKernelModules = "true";
      ProtectControlGroups = "true";
      RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
+      RestrictNamespaces = "true";
      LockPersonality = "true";
      IPAddressDeny = "any";
  };