From 9898f7e0728d45cf9cd60d340e023683b7b6472d Mon Sep 17 00:00:00 2001
From: Alexandre Iooss <erdnaxe@crans.org>
Date: Sun, 8 Aug 2021 10:27:01 +0200
Subject: [PATCH 1/3] nixos/nitter: systemd unit hardening

---
 nixos/modules/services/misc/nitter.nix | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/nixos/modules/services/misc/nitter.nix b/nixos/modules/services/misc/nitter.nix
index 095a15f21f6a..301af76c336a 100644
--- a/nixos/modules/services/misc/nitter.nix
+++ b/nixos/modules/services/misc/nitter.nix
@@ -312,6 +312,31 @@ in
           AmbientCapabilities = lib.mkIf (cfg.server.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
           Restart = "on-failure";
           RestartSec = "5s";
+          # Hardening
+          CapabilityBoundingSet = if (cfg.server.port < 1024) then [ "CAP_NET_BIND_SERVICE" ] else [ "" ];
+          DeviceAllow = [ "" ];
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          PrivateDevices = true;
+          # A private user cannot have process capabilities on the host's user
+          # namespace and thus CAP_NET_BIND_SERVICE has no effect.
+          PrivateUsers = (cfg.server.port >= 1024);
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+          UMask = "0077";
         };
     };
 

From 2e8e8f2c92a76535fa0d44611a20b97ee6b75927 Mon Sep 17 00:00:00 2001
From: Alexandre Iooss <erdnaxe@crans.org>
Date: Sun, 8 Aug 2021 15:29:33 +0200
Subject: [PATCH 2/3] nixos/nitter: test with CAP_NET_BIND_SERVICE

---
 nixos/tests/nitter.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/nixos/tests/nitter.nix b/nixos/tests/nitter.nix
index e17f1c473436..0e1a6d150f38 100644
--- a/nixos/tests/nitter.nix
+++ b/nixos/tests/nitter.nix
@@ -6,11 +6,13 @@ import ./make-test-python.nix ({ pkgs, ... }:
 
   nodes.machine = {
     services.nitter.enable = true;
+    # Test CAP_NET_BIND_SERVICE
+    services.nitter.server.port = 80;
   };
 
   testScript = ''
     machine.wait_for_unit("nitter.service")
-    machine.wait_for_open_port("8080")
-    machine.succeed("curl --fail http://localhost:8080/")
+    machine.wait_for_open_port("80")
+    machine.succeed("curl --fail http://localhost:80/")
   '';
 })

From 88b7302b9019a1ef08224961a862e9b6547b3b91 Mon Sep 17 00:00:00 2001
From: Alexandre Iooss <erdnaxe@crans.org>
Date: Sun, 8 Aug 2021 15:33:08 +0200
Subject: [PATCH 3/3] nitter: add test to passthru.tests

---
 pkgs/servers/nitter/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/servers/nitter/default.nix b/pkgs/servers/nitter/default.nix
index 47352edf48d3..b5137c92b450 100644
--- a/pkgs/servers/nitter/default.nix
+++ b/pkgs/servers/nitter/default.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, nixosTests
 , fetchFromGitHub
 , nim
 , libsass
@@ -120,6 +121,10 @@ in stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) nitter;
+  };
+
   meta = with lib; {
     description = "Alternative Twitter front-end";
     homepage = "https://github.com/zedeus/nitter";