aviallon/nixos-lib
1
0
Fork 0
mirror of https://github.com/aviallon/nixos-lib.git synced 2026-04-05 17:27:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

[Hardening] ignore execve where auid is unset (services, typically)

Browse source
This commit is contained in:
Antoine Viallon 2024-03-11 00:18:34 +01:00
parent 470e333d00
commit 98e06464eb
Signed by: aviallon
GPG key ID: 186FC35EDEB25716
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
security/hardening.nix
View file

@ -123,8 +123,8 @@ in
"-a exit,always -F arch=b64 -S init_module -S finit_module -k module_insertion"
"-a exit,always -F arch=b32 -S init_module -S finit_module -k module_insertion"
"-a exit,always -F arch=b64 -C auid!=euid -F euid=0 -S execve -k privesc_execve"
"-a exit,always -F arch=b32 -C auid!=euid -F euid=0 -S execve -k privesc_execve"
"-a exit,always -F arch=b64 -C auid!=euid -F auid!=unset -F euid=0 -S execve -k privesc_execve"
"-a exit,always -F arch=b32 -C auid!=euid -F auid!=unset -F euid=0 -S execve -k privesc_execve"
]
++ optional cfg.expensive "-a exit,always -F arch=b64 -S execve -k execve_calls"
;