nixos/open-webui: add additional systemd hardening (#377884)

2025-03-15 10:07:32 -04:00
parent 98a58ea448 dea0cb06e3
commit 4ee53e6544
1 changed files with 12 additions and 0 deletions
@@ -120,6 +120,18 @@ in
        RestrictRealtime = true;
        SystemCallArchitectures = "native";
        UMask = "0077";
+        CapabilityBoundingSet = "";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        ProtectClock = true;
+        ProtectProc = "invisible";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
      };
    };