From 4e40f1c79e5a9939c170a666ce43b695dee0460a Mon Sep 17 00:00:00 2001
From: Minijackson <minijackson@riseup.net>
Date: Thu, 26 Jun 2025 13:17:09 +0200
Subject: [PATCH] nixos/sssd: add upstream hardening options in
 sssd-kcm.service

---
 nixos/modules/services/misc/sssd.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/nixos/modules/services/misc/sssd.nix b/nixos/modules/services/misc/sssd.nix
index 7edb7a79109c..284b2972d300 100644
--- a/nixos/modules/services/misc/sssd.nix
+++ b/nixos/modules/services/misc/sssd.nix
@@ -165,6 +165,14 @@ in
         serviceConfig = {
           ExecStartPre = "-${pkgs.sssd}/bin/sssd --genconf-section=kcm";
           ExecStart = "${pkgs.sssd}/libexec/sssd/sssd_kcm --uid 0 --gid 0";
+          CapabilityBoundingSet = [
+            "CAP_IPC_LOCK"
+            "CAP_CHOWN"
+            "CAP_DAC_READ_SEARCH"
+            "CAP_FOWNER"
+            "CAP_SETGID"
+            "CAP_SETUID"
+          ];
         };
         restartTriggers = [
           settingsFileUnsubstituted