nixos/babeld: run as DynamicUser

The last bits to prevent babeld from running unprivileged was its kernel_setup_interface routine, that wants to set per interface rp_filter. This behaviour has been disabled in a patch that has been submitted upstream at https://github.com/jech/babeld/pull/68 and reuses the skip-kernel-setup config option. → Overall exposure level for babeld.service: 1.7 OK 🙂
2021-04-25 00:54:52 +02:00
parent 70c96f0e02
commit e8988f7a30
2 changed files with 21 additions and 2 deletions
@@ -680,6 +680,13 @@ environment.systemPackages = [
     All CUDA toolkit versions prior to CUDA 10 have been removed.
    </para>
   </listitem>
+   <listitem>
+     <para>
+       The <package>babeld</package> service is now being run as an unprivileged user. To achieve that the module configures
+       <literal>skip-kernel-setup true</literal> and takes care of setting forwarding and rp_filter sysctls by itself as well
+       as for each interface in <varname>services.babeld.interfaces</varname>.
+     </para>
+   </listitem>
  </itemizedlist>
 </section>