nginxModules: add option allowMemoryWriteExecute

The allowMemoryWriteExecute option is required to checking enabled nginxModules and disable the nginx sandbox mode MemoryDenyWriteExecute.
2020-05-12 20:03:29 +03:00
parent c7106610f1
commit aa12fb8adb
2 changed files with 4 additions and 1 deletions
@@ -724,7 +724,7 @@ in
        ProtectControlGroups = true;
        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
        LockPersonality = true;
-        MemoryDenyWriteExecute = mkDefault true;
+        MemoryDenyWriteExecute = !(builtins.any (mod: (mod.allowMemoryWriteExecute or false)) pkgs.nginx.modules);
        RestrictRealtime = true;
        RestrictSUIDSGID = true;
        PrivateMounts = true;