rmilter/rspamd service: tighten unix socket permissions

2017-03-17 23:01:24 +01:00
parent 8ab2d2ee27
commit 00239ce8e9
2 changed files with 12 additions and 6 deletions
@@ -53,8 +53,11 @@ in
      bindSocket = mkOption {
        type = types.listOf types.str;
        default = [
-          "/run/rspamd/rspamd.sock mode=0666 owner=${cfg.user}"
+          "/run/rspamd/rspamd.sock mode=0660 owner=${cfg.user} group=${cfg.group}"
        ];
+        defaultText = ''[
+          "/run/rspamd/rspamd.sock mode=0660 owner=${cfg.user} group=${cfg.group}"
+        ]'';
        description = ''
          List of sockets to listen, in format acceptable by rspamd
        '';