nixos/zipline: improve systemd hardening

2025-03-19 18:16:01 +01:00
parent 0deb1b285f
commit ef19fcf725
1 changed files with 11 additions and 6 deletions
@@ -107,9 +107,11 @@ in
        ExecStart = lib.getExe cfg.package;

        # Hardening
+        AmbientCapabilities = "";
        CapabilityBoundingSet = [ "" ];
-        DeviceAllow = [ "" ];
+        DevicePolicy = "closed";
        LockPersonality = true;
+        NoNewPrivileges = true;
        PrivateDevices = true;
        PrivateTmp = true;
        PrivateUsers = true;
@@ -123,15 +125,18 @@ in
        ProtectKernelTunables = true;
        ProtectProc = "invisible";
        ProtectSystem = "strict";
-        RestrictAddressFamilies = [
-          "AF_INET"
-          "AF_INET6"
-          "AF_UNIX"
-        ];
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET AF_INET6 AF_UNIX AF_NETLINK" ];
        RestrictNamespaces = true;
        RestrictRealtime = true;
        RestrictSUIDSGID = true;
        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0077";
      };
    };
  };