From 8f91507efbb2ca319ac5f6e0b59465c4616c9738 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Sat, 26 Apr 2025 18:06:51 +0800
Subject: [PATCH 1/2] nixos/clash-verge: harden systemd service

---
 nixos/modules/programs/clash-verge.nix | 28 ++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/nixos/modules/programs/clash-verge.nix b/nixos/modules/programs/clash-verge.nix
index 7210fe7ec464..0de013613854 100644
--- a/nixos/modules/programs/clash-verge.nix
+++ b/nixos/modules/programs/clash-verge.nix
@@ -48,6 +48,34 @@
         serviceConfig = {
           ExecStart = "${cfg.package}/bin/clash-verge-service";
           Restart = "on-failure";
+          ProtectSystem = "strict";
+          NoNewPrivileges = true;
+          ProtectHostname = true;
+          ProtectProc = "invisible";
+          ProcSubset = "pid";
+          SystemCallArchitectures = "native";
+          PrivateTmp = true;
+          PrivateMounts = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectKernelLogs = true;
+          ProtectControlGroups = true;
+          LockPersonality = true;
+          RestrictRealtime = true;
+          ProtectClock = true;
+          MemoryDenyWriteExecute = true;
+          RestrictSUIDSGID = true;
+          RestrictNamespaces = [ "~user cgroup ipc mnt uts" ];
+          RestrictAddressFamilies = [
+            "AF_INET AF_INET6 AF_NETLINK AF_PACKET AF_RAW"
+          ];
+          CapabilityBoundingSet = [
+            "CAP_NET_ADMIN CAP_NET_RAW CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SETUID CAP_SETGID CAP_CHOWN CAP_MKNOD"
+          ];
+          SystemCallFilter = [
+            "~@aio @chown @clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @pkey @privileged @raw-io @reboot @sandbox @setuid @swap @timer"
+          ];
+          SystemCallErrorNumber = "EPERM";
         };
         wantedBy = [ "multi-user.target" ];
       };

From edf880979370f74f949be2701469c62ee91871d9 Mon Sep 17 00:00:00 2001
From: wxt <3264117476@qq.com>
Date: Mon, 28 Apr 2025 21:35:57 +0800
Subject: [PATCH 2/2] nixos/clash-verge: readd tunMode

Co-authored-by: Aleksana <alexander.huang.y@gmail.com>
---
 nixos/modules/programs/clash-verge.nix | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/programs/clash-verge.nix b/nixos/modules/programs/clash-verge.nix
index 0de013613854..13a079864eca 100644
--- a/nixos/modules/programs/clash-verge.nix
+++ b/nixos/modules/programs/clash-verge.nix
@@ -7,9 +7,6 @@
 
 {
   imports = [
-    (lib.mkRemovedOptionModule [ "programs" "clash-verge" "tunMode" ] ''
-      The tunMode will work with service mode which is enabled by default.
-    '')
   ];
   options.programs.clash-verge = {
     enable = lib.mkEnableOption "Clash Verge";
@@ -23,6 +20,8 @@
       default = pkgs.clash-verge-rev;
       defaultText = lib.literalExpression "pkgs.clash-verge-rev";
     };
+    serviceMode = lib.mkEnableOption "Service Mode";
+    tunMode = lib.mkEnableOption "Setcap for TUN Mode. DNS settings won't work on this way";
     autoStart = lib.mkEnableOption "Clash Verge auto launch";
   };
 
@@ -42,7 +41,14 @@
         ))
       ];
 
-      systemd.services.clash-verge = {
+      security.wrappers.clash-verge = lib.mkIf cfg.tunMode {
+        owner = "root";
+        group = "root";
+        capabilities = "cap_net_bind_service,cap_net_raw,cap_net_admin=+ep";
+        source = "${lib.getExe cfg.package}";
+      };
+
+      systemd.services.clash-verge = lib.mkIf cfg.serviceMode {
         enable = true;
         description = "Clash Verge Service Mode";
         serviceConfig = {