nixos-containers: Set DevicePolicy=closed

This makes the container a bit more secure, by preventing root creating device nodes to access the host file system, for instance. (Reference: systemd-nspawn@.service in systemd.)
NixOS · Jul 28, 2016 · fd5bbdb · fd5bbdb · vcunat · Jul 29, 2016
1 parent bf3edfb
commit fd5bbdb
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/nixos/modules/virtualisation/containers.nix b/nixos/modules/virtualisation/containers.nix
@@ -415,6 +415,8 @@ in
         # after the timeout). So send an ignored signal.
         KillMode = "mixed";
         KillSignal = "WINCH";
+
+        DevicePolicy = "closed";
       };
     };
   in {