From 96be3f19b480296350027787acdad131daef014e Mon Sep 17 00:00:00 2001
From: h7x4 <h7x4@nani.wtf>
Date: Tue, 21 Oct 2025 16:59:54 +0900
Subject: [PATCH] nixos/rtkit: harden systemd service

---
 nixos/modules/security/rtkit.nix | 43 +++++++++++++++++++++++++++++---
 1 file changed, 39 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/security/rtkit.nix b/nixos/modules/security/rtkit.nix
index a5916f1173b7..d7c6df17f03b 100644
--- a/nixos/modules/security/rtkit.nix
+++ b/nixos/modules/security/rtkit.nix
@@ -57,10 +57,45 @@ in
     systemd.packages = [ package ];
 
     systemd.services.rtkit-daemon = {
-      serviceConfig.ExecStart = [
-        "" # Resets command from upstream unit.
-        "${package}/libexec/rtkit-daemon ${utils.escapeSystemdExecArgs cfg.args}"
-      ];
+      serviceConfig = {
+        ExecStart = [
+          "" # Resets command from upstream unit.
+          "${package}/libexec/rtkit-daemon ${utils.escapeSystemdExecArgs cfg.args}"
+        ];
+
+        # Needs to verify the user of the processes.
+        PrivateUsers = "full";
+        # Needs to access other processes to modify their scheduling modes.
+        ProcSubset = "all";
+        ProtectProc = "default";
+        # Canary needs to be realtime.
+        RestrictRealtime = false;
+
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = "disconnected";
+        ProtectClock = true;
+        ProtectControlGroups = "strict";
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_UNIX" ];
+        IPAddressDeny = "any";
+        RestrictNamespaces = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "@mount" # Needs chroot(1)
+        ];
+        UMask = "0777";
+      };
     };
 
     users.users.rtkit = {