Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

earlyoom: Apply security recommendations from package maintainer (First attempt) #363597

Closed
wants to merge 10 commits into from
67 changes: 47 additions & 20 deletions nixos/modules/services/system/earlyoom.nix
Original file line number Diff line number Diff line change
Expand Up @@ -149,25 +149,52 @@ in
config = mkIf cfg.enable {
services.systembus-notify.enable = mkDefault cfg.enableNotifications;

systemd.services.earlyoom = {
description = "Early OOM Daemon for Linux";
wantedBy = [ "multi-user.target" ];
path = optionals cfg.enableNotifications [ pkgs.dbus ];
serviceConfig = {
StandardError = "journal";
ExecStart = concatStringsSep " " ([
"${lib.getExe cfg.package}"
("-m ${toString cfg.freeMemThreshold}"
+ optionalString (cfg.freeMemKillThreshold != null) ",${toString cfg.freeMemKillThreshold}")
("-s ${toString cfg.freeSwapThreshold}"
+ optionalString (cfg.freeSwapKillThreshold != null) ",${toString cfg.freeSwapKillThreshold}")
"-r ${toString cfg.reportInterval}"
]
++ optionals cfg.enableDebugInfo [ "-d" ]
++ optionals cfg.enableNotifications [ "-n" ]
++ optionals (cfg.killHook != null) [ "-N ${escapeShellArg cfg.killHook}" ]
++ cfg.extraArgs);
};
};
systemd.services.earlyoom = {
description = "Early OOM Daemon for Linux";
wantedBy = [ "multi-user.target" ];
path = optionals cfg.enableNotifications [ pkgs.dbus ];
serviceConfig = {
StandardError = "journal";
ExecStart = concatStringsSep " " ([
"${lib.getExe cfg.package}"
("-m ${toString cfg.freeMemThreshold}"
+ optionalString (cfg.freeMemKillThreshold != null) ",${toString cfg.freeMemKillThreshold}")
("-s ${toString cfg.freeSwapThreshold}"
+ optionalString (cfg.freeSwapKillThreshold != null) ",${toString cfg.freeSwapKillThreshold}")
"-r ${toString cfg.reportInterval}"
]
++ optionals cfg.enableDebugInfo [ "-d" ]
++ optionals cfg.enableNotifications [ "-n" ]
++ optionals (cfg.killHook != null) [ "-N ${escapeShellArg cfg.killHook}" ]
++ cfg.extraArgs);

AmbientCapabilities = "CAP_KILL CAP_IPC_LOCK";
CapabilityBoundingSet = "CAP_KILL CAP_IPC_LOCK";
kaindlnetwork marked this conversation as resolved.
Show resolved Hide resolved
Nice = "-20";
OOMScoreAdjust = "-100";
Restart = "always";
TasksMax = "10";
MemoryMax = "50M";
DynamicUser = "true";
ProtectSystem = "strict";
ProtectHome = "true";
PrivateDevices = "true";
ProtectClock = "true";
ProtectHostname = "true";
ProtectKernelLogs = "true";
ProtectKernelModules = "true";
ProtectKernelTunables = "true";
ProtectControlGroups = "true";
RestrictNamespaces = "true";
RestrictRealtime = "true";
LockPersonality = "true";
PrivateNetwork = "true";
IPAddressDeny = "true";
kaindlnetwork marked this conversation as resolved.
Show resolved Hide resolved
RestrictAddressFamilies = "AF_UNIX";
SystemCallArchitectures = "native";
SystemCallFilter = ["@system-service" "~@resources @privileged"];
kaindlnetwork marked this conversation as resolved.
Show resolved Hide resolved
};
};

};
}
Loading