From e944cc62692b7b3dc69323d6198dd3b52aceceff Mon Sep 17 00:00:00 2001 From: Felix Singer Date: Mon, 6 Oct 2025 20:17:59 +0200 Subject: [PATCH 1/7] nixos/jenkins: Configure system group in service config Signed-off-by: Felix Singer --- .../modules/services/continuous-integration/jenkins/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/services/continuous-integration/jenkins/default.nix b/nixos/modules/services/continuous-integration/jenkins/default.nix index 2dae8b61296c..49632095d6ea 100644 --- a/nixos/modules/services/continuous-integration/jenkins/default.nix +++ b/nixos/modules/services/continuous-integration/jenkins/default.nix @@ -251,6 +251,7 @@ in serviceConfig = { User = cfg.user; + Group = cfg.group; StateDirectory = lib.mkIf (lib.hasPrefix "/var/lib/jenkins" cfg.home) "jenkins"; # For (possible) socket use RuntimeDirectory = "jenkins"; From 8765032b50fde4d5db39d94c7eba641ccf2aa300 Mon Sep 17 00:00:00 2001 From: Felix Singer Date: Mon, 6 Oct 2025 20:27:15 +0200 Subject: [PATCH 2/7] nixos/jenkins: Ensure proper permissions for state directory Signed-off-by: Felix Singer --- .../modules/services/continuous-integration/jenkins/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/services/continuous-integration/jenkins/default.nix b/nixos/modules/services/continuous-integration/jenkins/default.nix index 49632095d6ea..ef7f5ac613b8 100644 --- a/nixos/modules/services/continuous-integration/jenkins/default.nix +++ b/nixos/modules/services/continuous-integration/jenkins/default.nix @@ -253,6 +253,7 @@ in User = cfg.user; Group = cfg.group; StateDirectory = lib.mkIf (lib.hasPrefix "/var/lib/jenkins" cfg.home) "jenkins"; + StateDirectoryMode = "750"; # For (possible) socket use RuntimeDirectory = "jenkins"; AmbientCapabilities = ""; From 6cece348c4165f46dac8c68d561140a6af88a9d8 Mon Sep 17 00:00:00 2001 From: Felix Singer Date: Mon, 6 Oct 2025 20:28:29 +0200 Subject: [PATCH 3/7] nixos/jenkins: Ensure proper permissions for cache directory Signed-off-by: Felix Singer --- .../modules/services/continuous-integration/jenkins/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/services/continuous-integration/jenkins/default.nix b/nixos/modules/services/continuous-integration/jenkins/default.nix index ef7f5ac613b8..012b91b18b5b 100644 --- a/nixos/modules/services/continuous-integration/jenkins/default.nix +++ b/nixos/modules/services/continuous-integration/jenkins/default.nix @@ -256,6 +256,7 @@ in StateDirectoryMode = "750"; # For (possible) socket use RuntimeDirectory = "jenkins"; + RuntimeDirectoryMode = "750"; AmbientCapabilities = ""; CapabilityBoundingSet = ""; LockPersonality = true; From d969bdbedaf4d496f4e63c8e24d61eec143c7e4e Mon Sep 17 00:00:00 2001 From: Felix Singer Date: Mon, 6 Oct 2025 20:20:00 +0200 Subject: [PATCH 4/7] nixos/jenkins: Set ProtectControlGroups to `strict` For documentation see https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#ProtectControlGroups= Signed-off-by: Felix Singer --- .../modules/services/continuous-integration/jenkins/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/continuous-integration/jenkins/default.nix b/nixos/modules/services/continuous-integration/jenkins/default.nix index 012b91b18b5b..150393acccaf 100644 --- a/nixos/modules/services/continuous-integration/jenkins/default.nix +++ b/nixos/modules/services/continuous-integration/jenkins/default.nix @@ -266,7 +266,7 @@ in PrivateMounts = true; PrivateTmp = true; ProtectClock = true; - ProtectControlGroups = true; + ProtectControlGroups = "strict"; ProtectHome = true; ProtectHostname = true; ProtectKernelLogs = true; From bfae9b0212d76918921f928df28bfe3df3b5e724 Mon Sep 17 00:00:00 2001 From: Felix Singer Date: Mon, 6 Oct 2025 20:23:19 +0200 Subject: [PATCH 5/7] nixos/jenkins: Set ProtectProc to `invisible` For documentation see https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#ProtectProc= Signed-off-by: Felix Singer --- .../modules/services/continuous-integration/jenkins/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/services/continuous-integration/jenkins/default.nix b/nixos/modules/services/continuous-integration/jenkins/default.nix index 150393acccaf..2fe53e173f4f 100644 --- a/nixos/modules/services/continuous-integration/jenkins/default.nix +++ b/nixos/modules/services/continuous-integration/jenkins/default.nix @@ -272,6 +272,7 @@ in ProtectKernelLogs = true; ProtectKernelModules = true; ProtectKernelTunables = true; + ProtectProc = "invisible"; ProtectSystem = "full"; RemoveIPC = true; RestrictAddressFamilies = [ From d62c46fec7425c290add47416dc6487a3591b71b Mon Sep 17 00:00:00 2001 From: Felix Singer Date: Mon, 6 Oct 2025 20:22:15 +0200 Subject: [PATCH 6/7] nixos/jenkins: Enable PrivateUsers hardening in service config For documentation see https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#PrivateUsers= Signed-off-by: Felix Singer --- .../modules/services/continuous-integration/jenkins/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/services/continuous-integration/jenkins/default.nix b/nixos/modules/services/continuous-integration/jenkins/default.nix index 2fe53e173f4f..8b44dfb83335 100644 --- a/nixos/modules/services/continuous-integration/jenkins/default.nix +++ b/nixos/modules/services/continuous-integration/jenkins/default.nix @@ -265,6 +265,7 @@ in PrivateDevices = true; PrivateMounts = true; PrivateTmp = true; + PrivateUsers = true; ProtectClock = true; ProtectControlGroups = "strict"; ProtectHome = true; From 01a263c29ac63aef0d6bac2afb59213fe400d5db Mon Sep 17 00:00:00 2001 From: Felix Singer Date: Mon, 6 Oct 2025 20:20:48 +0200 Subject: [PATCH 7/7] nixos/jenkins: Enable MountAPIVFS hardening in service config This setting is already implied by others, but add it for completeness as well. For documentation see https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#MountAPIVFS= Signed-off-by: Felix Singer --- .../modules/services/continuous-integration/jenkins/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/services/continuous-integration/jenkins/default.nix b/nixos/modules/services/continuous-integration/jenkins/default.nix index 8b44dfb83335..8ec7c972436b 100644 --- a/nixos/modules/services/continuous-integration/jenkins/default.nix +++ b/nixos/modules/services/continuous-integration/jenkins/default.nix @@ -261,6 +261,7 @@ in CapabilityBoundingSet = ""; LockPersonality = true; # MemoryDenyWriteExecute = false; Breaks execution; + MountAPIVFS = true; NoNewPrivileges = true; PrivateDevices = true; PrivateMounts = true;