nixos/sssd: add upstream hardening options in sssd-kcm.service

2025-06-26 13:17:09 +02:00
parent 9867229696
commit 4e40f1c79e
1 changed files with 8 additions and 0 deletions
@@ -165,6 +165,14 @@ in
        serviceConfig = {
          ExecStartPre = "-${pkgs.sssd}/bin/sssd --genconf-section=kcm";
          ExecStart = "${pkgs.sssd}/libexec/sssd/sssd_kcm --uid 0 --gid 0";
+          CapabilityBoundingSet = [
+            "CAP_IPC_LOCK"
+            "CAP_CHOWN"
+            "CAP_DAC_READ_SEARCH"
+            "CAP_FOWNER"
+            "CAP_SETGID"
+            "CAP_SETUID"
+          ];
        };
        restartTriggers = [
          settingsFileUnsubstituted