nixos/wakapi: harden systemd service (#389534)

2025-03-20 17:48:34 +01:00
parent 809e198860 c7968cf140
commit 9f2544d0ea
1 changed files with 8 additions and 1 deletions
@@ -159,18 +159,25 @@ in
        Group = config.users.users.wakapi.group;

        DynamicUser = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        PrivateDevices = true;
        ProtectHome = true;
        ProtectHostname = true;
+        ProtectClock = true;
        ProtectKernelLogs = true;
        ProtectKernelModules = true;
        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        NoNewPrivileges = true;
        ProtectProc = "invisible";
-        ProtectSystem = "strict";
+        ProtectSystem = "full";
        RestrictAddressFamilies = [
          "AF_INET"
          "AF_INET6"
          "AF_UNIX"
        ];
+        CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
        RestrictNamespaces = true;
        RestrictRealtime = true;
        RestrictSUIDSGID = true;