talexander/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Releases Activity

nixos/echoip: improve systemd hardening

Browse Source
This commit is contained in:
Defelo 2025-03-06 02:01:23 +01:00
parent 110b3af97a
commit eccf638822
No known key found for this signature in database
GPG Key ID: 2A05272471204DD3
1 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
nixos/modules/services/web-apps/echoip.nix
View File

@ -75,9 +75,12 @@ in
); );
# Hardening # Hardening
AmbientCapabilities = "";
CapabilityBoundingSet = [ "" ]; CapabilityBoundingSet = [ "" ];
DeviceAllow = [ "" ]; DevicePolicy = "closed";
LockPersonality = true; LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true; PrivateDevices = true;
PrivateTmp = true; PrivateTmp = true;
PrivateUsers = true; PrivateUsers = true;
@ -91,15 +94,19 @@ in
ProtectKernelTunables = true; ProtectKernelTunables = true;
ProtectProc = "invisible"; ProtectProc = "invisible";
ProtectSystem = "strict"; ProtectSystem = "strict";
RestrictAddressFamilies = [ RemoveIPC = true;
"AF_INET" RestrictAddressFamilies = [ "AF_INET AF_INET6 AF_UNIX" ];
"AF_INET6"
"AF_UNIX"
];
RestrictNamespaces = true; RestrictNamespaces = true;
RestrictRealtime = true; RestrictRealtime = true;
RestrictSUIDSGID = true; RestrictSUIDSGID = true;
SystemCallArchitectures = "native"; SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
"~@resources"
"setrlimit"
];
UMask = "0077";
}; };
}; };