From 72c7dd36151d26007d40bce359634bec5cfcba38 Mon Sep 17 00:00:00 2001
From: nani8ot <git@wiedemer.xyz>
Date: Thu, 3 Apr 2025 22:51:21 +0200
Subject: [PATCH] nixos/redlib: harden systemd service

---
 nixos/modules/services/misc/redlib.nix | 42 ++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/nixos/modules/services/misc/redlib.nix b/nixos/modules/services/misc/redlib.nix
index 3e3cd31a814c..5e3529fbc846 100644
--- a/nixos/modules/services/misc/redlib.nix
+++ b/nixos/modules/services/misc/redlib.nix
@@ -95,6 +95,47 @@ in
       environment = mapAttrs (_: v: if isBool v then boolToString' v else toString v) cfg.settings;
       serviceConfig =
         {
+          # Hardening
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateIPC = true;
+          PrivateTmp = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "full";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "~@mount"
+            "~@swap"
+            "~@resources"
+            "~@reboot"
+            "~@raw-io"
+            "~@obsolete"
+            "~@module"
+            "~@debug"
+            "~@cpu-emulation"
+            "~@clock"
+            "~@privileged"
+          ];
+          UMask = "0027";
+
           ExecStart = [
             ""
             "${lib.getExe cfg.package} ${args}"
@@ -111,6 +152,7 @@ in
               # A private user cannot have process capabilities on the host's user
               # namespace and thus CAP_NET_BIND_SERVICE has no effect.
               PrivateUsers = true;
+              CapabilityBoundingSet = false;
             }
         );
     };