nixos/jenkins: Apply more hardening settings (#449222)

2025-10-13 13:09:20 +00:00
parent aaddc65548 01a263c29a
commit 15fee7ddd0
1 changed files with 7 additions and 1 deletions
@@ -251,24 +251,30 @@ in

      serviceConfig = {
        User = cfg.user;
+        Group = cfg.group;
        StateDirectory = lib.mkIf (lib.hasPrefix "/var/lib/jenkins" cfg.home) "jenkins";
+        StateDirectoryMode = "750";
        # For (possible) socket use
        RuntimeDirectory = "jenkins";
+        RuntimeDirectoryMode = "750";
        AmbientCapabilities = "";
        CapabilityBoundingSet = "";
        LockPersonality = true;
        # MemoryDenyWriteExecute = false;   Breaks execution;
+        MountAPIVFS = true;
        NoNewPrivileges = true;
        PrivateDevices = true;
        PrivateMounts = true;
        PrivateTmp = true;
+        PrivateUsers = true;
        ProtectClock = true;
-        ProtectControlGroups = true;
+        ProtectControlGroups = "strict";
        ProtectHome = true;
        ProtectHostname = true;
        ProtectKernelLogs = true;
        ProtectKernelModules = true;
        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
        ProtectSystem = "full";
        RemoveIPC = true;
        RestrictAddressFamilies = [