nixos/murmur: Apply more hardening options (#449125)

2025-10-13 13:09:05 +00:00
parent a5d79d36df 9638a1ba24
commit aaddc65548
1 changed files with 3 additions and 0 deletions
@@ -345,10 +345,12 @@ in
        CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
        LockPersonality = true;
        MemoryDenyWriteExecute = true;
+        MountAPIVFS = true;
        NoNewPrivileges = true;
        PrivateDevices = true;
        PrivateMounts = true;
        PrivateTmp = true;
+        PrivateUsers = true;
        ProtectClock = true;
        ProtectControlGroups = "strict";
        ProtectHome = true;
@@ -356,6 +358,7 @@ in
        ProtectKernelLogs = true;
        ProtectKernelModules = true;
        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
        ProtectSystem = "strict";
        ReadWritePaths = [
          cfg.stateDir