nixos/rtkit: harden systemd service

nixos/modules/security/rtkit.nix

@@ -57,10 +57,45 @@ in
     systemd.packages = [ package ];
 
     systemd.services.rtkit-daemon = {
-      serviceConfig.ExecStart = [
-        "" # Resets command from upstream unit.
-        "${package}/libexec/rtkit-daemon ${utils.escapeSystemdExecArgs cfg.args}"
-      ];
+      serviceConfig = {
+        ExecStart = [
+          "" # Resets command from upstream unit.
+          "${package}/libexec/rtkit-daemon ${utils.escapeSystemdExecArgs cfg.args}"
+        ];
+
+        # Needs to verify the user of the processes.
+        PrivateUsers = "full";
+        # Needs to access other processes to modify their scheduling modes.
+        ProcSubset = "all";
+        ProtectProc = "default";
+        # Canary needs to be realtime.
+        RestrictRealtime = false;
+
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = "disconnected";
+        ProtectClock = true;
+        ProtectControlGroups = "strict";
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_UNIX" ];
+        IPAddressDeny = "any";
+        RestrictNamespaces = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "@mount" # Needs chroot(1)
+        ];
+        UMask = "0777";
+      };
     };
 
     users.users.rtkit = {