diff options
author | rnhmjoj <rnhmjoj@inventati.org> | 2023-06-18 02:58:27 +0200 |
---|---|---|
committer | Anderson Torres <torres.anderson.85@protonmail.com> | 2023-06-20 01:12:04 +0000 |
commit | 7d263715bdf3b05bc58b9ed4d5bea9b075ff0c70 (patch) | |
tree | 9b916c9cc3a2f1bc46869cae57c333fa9ea00ba1 | |
parent | ed93c9d353392ac74fcf6fff8efe4f1c9b4069a4 (diff) |
nixos/fakeroute: run as unprivileged user
-rw-r--r-- | nixos/modules/services/networking/fakeroute.nix | 22 |
1 files changed, 8 insertions, 14 deletions
diff --git a/nixos/modules/services/networking/fakeroute.nix b/nixos/modules/services/networking/fakeroute.nix index ed6b1a3c4d26..faf5879a6ed3 100644 --- a/nixos/modules/services/networking/fakeroute.nix +++ b/nixos/modules/services/networking/fakeroute.nix @@ -1,10 +1,8 @@ { config, lib, pkgs, ... }: -with lib; - let cfg = config.services.fakeroute; - routeConf = pkgs.writeText "route.conf" (concatStringsSep "\n" cfg.route); + routeConf = pkgs.writeText "route.conf" (lib.concatStringsSep "\n" cfg.route); in @@ -16,16 +14,10 @@ in services.fakeroute = { - enable = mkOption { - type = types.bool; - default = false; - description = lib.mdDoc '' - Whether to enable the fakeroute service. - ''; - }; + enable = lib.mkEnableOption (lib.mdDoc "the fakeroute service"); - route = mkOption { - type = types.listOf types.str; + route = lib.mkOption { + type = with lib.types; listOf str; default = []; example = [ "216.102.187.130" @@ -46,14 +38,16 @@ in ###### implementation - config = mkIf cfg.enable { + config = lib.mkIf cfg.enable { systemd.services.fakeroute = { description = "Fakeroute Daemon"; after = [ "network.target" ]; wantedBy = [ "multi-user.target" ]; serviceConfig = { Type = "forking"; - User = "root"; + User = "fakeroute"; + DynamicUser = true; + AmbientCapabilities = [ "CAP_NET_RAW" ]; ExecStart = "${pkgs.fakeroute}/bin/fakeroute -f ${routeConf}"; }; }; |