From f3a53c390f5d53fc578b5312493e8dc10d4e461f Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Thu, 30 Jan 2025 09:53:55 +0100
Subject: [PATCH 1/2] nixos/bluetooth: add systemd hardening

---
 nixos/modules/services/hardware/bluetooth.nix | 35 +++++++++++++++----
 1 file changed, 28 insertions(+), 7 deletions(-)

diff --git a/nixos/modules/services/hardware/bluetooth.nix b/nixos/modules/services/hardware/bluetooth.nix
index e90a612700cc..531795767239 100644
--- a/nixos/modules/services/hardware/bluetooth.nix
+++ b/nixos/modules/services/hardware/bluetooth.nix
@@ -9,7 +9,6 @@ let
   package = cfg.package;
 
   inherit (lib)
-    mkDefault
     mkEnableOption
     mkIf
     mkOption
@@ -18,9 +17,7 @@ let
     mkRemovedOptionModule
     concatStringsSep
     escapeShellArgs
-    literalExpression
     optional
-    optionals
     optionalAttrs
     recursiveUpdate
     types
@@ -146,10 +143,34 @@ in
           {
             wantedBy = [ "bluetooth.target" ];
             aliases = [ "dbus-org.bluez.service" ];
-            serviceConfig.ExecStart = [
-              ""
-              "${package}/libexec/bluetooth/bluetoothd ${escapeShellArgs args}"
-            ];
+            serviceConfig = {
+              ExecStart = [
+                ""
+                "${package}/libexec/bluetooth/bluetoothd ${escapeShellArgs args}"
+              ];
+              CapabilityBoundingSet = [
+                "CAP_NET_BIND_SERVICE" # sockets and tethering
+              ];
+              NoNewPrivileges = true;
+              RestrictNamespaces = true;
+              ProtectControlGroups = true;
+              MemoryDenyWriteExecute = true;
+              RestrictSUIDSGID = true;
+              SystemCallArchitectures = "native";
+              SystemCallFilter = "@system-service";
+              LockPersonality = true;
+              RestrictRealtime = true;
+              ProtectProc = "invisible";
+              PrivateTmp = true;
+
+              PrivateUsers = false;
+
+              # loading hardware modules
+              ProtectKernelModules = false;
+              ProtectKernelTunables = false;
+
+              PrivateNetwork = false; # tethering
+            };
             # restarting can leave people without a mouse/keyboard
             unitConfig.X-RestartIfChanged = false;
           };

From 58c1ab247b838ab8053ded6fa5320f110634ff0e Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Thu, 30 Jan 2025 13:05:35 +0100
Subject: [PATCH 2/2] nixos/bluetooth: use escapeSystemdExecArgs

---
 nixos/modules/services/hardware/bluetooth.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/hardware/bluetooth.nix b/nixos/modules/services/hardware/bluetooth.nix
index 531795767239..d8907d554d33 100644
--- a/nixos/modules/services/hardware/bluetooth.nix
+++ b/nixos/modules/services/hardware/bluetooth.nix
@@ -2,6 +2,7 @@
   config,
   lib,
   pkgs,
+  utils,
   ...
 }:
 let
@@ -16,7 +17,6 @@ let
     mkRenamedOptionModule
     mkRemovedOptionModule
     concatStringsSep
-    escapeShellArgs
     optional
     optionalAttrs
     recursiveUpdate
@@ -146,7 +146,7 @@ in
             serviceConfig = {
               ExecStart = [
                 ""
-                "${package}/libexec/bluetooth/bluetoothd ${escapeShellArgs args}"
+                "${package}/libexec/bluetooth/bluetoothd ${utils.escapeSystemdExecArgs args}"
               ];
               CapabilityBoundingSet = [
                 "CAP_NET_BIND_SERVICE" # sockets and tethering