From 384293bbbb59b8af9ad24c50bb108d792c6ca38f Mon Sep 17 00:00:00 2001
From: Henri Menke <henri@henrimenke.de>
Date: Mon, 21 Nov 2022 13:21:44 +0100
Subject: [PATCH] nixos/alps: fixes for service hardening

---
 nixos/modules/services/web-apps/alps.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/web-apps/alps.nix b/nixos/modules/services/web-apps/alps.nix
index 4681739af4ab..1a58df2da1d2 100644
--- a/nixos/modules/services/web-apps/alps.nix
+++ b/nixos/modules/services/web-apps/alps.nix
@@ -98,11 +98,11 @@ in {
 
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/alps ${escapeShellArgs cfg.args}";
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
         DynamicUser = true;
-        ## This is desirable but would restrict bindIP to 127.0.0.1
-        #IPAddressAllow = "localhost";
-        #IPAddressDeny = "any";
         LockPersonality = true;
+        MemoryDenyWriteExecute = true;
         NoNewPrivileges = true;
         PrivateDevices = true;
         PrivateIPC = true;
@@ -122,8 +122,10 @@ in {
         RestrictNamespaces = true;
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
+        SocketBindAllow = cfg.port;
+        SocketBindDeny = "any";
         SystemCallArchitectures = "native";
-        SystemCallFilter = [ "@system-service @resources" "~@privileged @obsolete" ];
+        SystemCallFilter = [ "@system-service" "~@privileged @obsolete" ];
       };
     };
   };