Paul Haerle phaer

security and hardening options for systemd service units

A common and reliable pattern in service unit files is thus:

NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict

This document contains some ideas for additions to the Nix language.

The Nix package manager, Nixpkgs and NixOS currently have several problems:

Poor discoverability of package options. Package functions have function arguments like enableFoo, but there is no way for the Nix UI to discover them, let alone to provide programmatic ways to

	module Jekyll
	require 'haml'
	class HamlConverter < Converter
	safe true
	priority :low

	def matches(ext)
	ext =~ /haml/i
	end

	module Jekyll
	require 'haml'
	class HamlConverter < Converter
	safe true
	priority :low

	def matches(ext)
	ext =~ /haml/i
	end

	module Jekyll

	class LessCssFile < StaticFile
	def write(dest)
	# do nothing
	end
	end

	# Expects a lessc: key in your _config.yml file with the path to a local less.js/bin/lessc
	# Less.js will require node.js to be installed

	module Sass (sass) where

	import Control.Monad.IO.Class (liftIO)
	import Text.Hakyll.File (makeDirectories, toDestination)
	import Text.Hakyll.HakyllAction (HakyllAction(..), runHakyllActionIfNeeded)
	import Text.Hakyll.HakyllMonad (Hakyll)

	import System.FilePath (replaceExtension)
	import System.Process (readProcess)

	require 'date'
	require 'ostatus'

	module Jekyll
	class RenderOStatus < Liquid::Tag
	def render(context)
	site = context.registers[:site]
	feed = OStatus::Feed.from_url(site.config['ostatus_feed'])

	result = "<h2>#{feed.author.name}'s microblog</h2>"

	// Lack of tail call optimization in JS
	var sum = function(x, y) {
	return y > 0 ? sum(x + 1, y - 1) :
	y < 0 ? sum(x - 1, y + 1) :
	x
	}

	sum(20, 100000) // => RangeError: Maximum call stack size exceeded

	// Using workaround

	#! /usr/bin/env python
	# avahi-alias.py

	import avahi, dbus
	from encodings.idna import ToASCII
	import logging

	# Got these from /usr/include/avahi-common/defs.h
	CLASS_IN = 0x01
	TYPE_CNAME = 0x05