From 4d2bb49e75e0f6bbf5de394b3665bea3c9d7bdb4 Mon Sep 17 00:00:00 2001
From: Anna Aurora <anna@annaaurora.eu>
Date: Sun, 23 Feb 2025 17:47:56 +0100
Subject: [PATCH] nixos/meme-bingo-web: harden

---
 nixos/modules/services/web-apps/meme-bingo-web.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nixos/modules/services/web-apps/meme-bingo-web.nix b/nixos/modules/services/web-apps/meme-bingo-web.nix
index 7573e325e860..5bda9afcf88d 100644
--- a/nixos/modules/services/web-apps/meme-bingo-web.nix
+++ b/nixos/modules/services/web-apps/meme-bingo-web.nix
@@ -89,6 +89,9 @@ in
         InaccessiblePaths = [
           "/dev/shm"
           "/sys"
+          "/run/dbus"
+          "/run/user"
+          "/run/nscd"
         ];
         LockPersonality = true;
         PrivateDevices = true;
@@ -124,6 +127,8 @@ in
         RemoveIPC = true;
         NoNewPrivileges = true;
         MemoryDenyWriteExecute = true;
+        ExecPaths = [ "/nix/store" ];
+        NoExecPaths = [ "/" ];
       };
     };
   };