diff options
author | Silvan Mosberger <contact@infinisil.com> | 2024-02-10 02:48:46 +0100 |
---|---|---|
committer | GitHub <noreply@github.com> | 2024-02-10 02:48:46 +0100 |
commit | 5de438562062dfb706700c379ca68c2ff1bd97ad (patch) | |
tree | 94a3b603f27d978ba9eebb056610bfce2b9b5777 /nixos/modules/services/networking | |
parent | b9e0ac3fdf89ce76a0cb3d94a2a219f2c5d5c254 (diff) | |
parent | 11cf6ab0ddc050de98715d4b9353d9ac12f8c9cd (diff) | |
download | nixlib-5de438562062dfb706700c379ca68c2ff1bd97ad.tar nixlib-5de438562062dfb706700c379ca68c2ff1bd97ad.tar.gz nixlib-5de438562062dfb706700c379ca68c2ff1bd97ad.tar.bz2 nixlib-5de438562062dfb706700c379ca68c2ff1bd97ad.tar.lz nixlib-5de438562062dfb706700c379ca68c2ff1bd97ad.tar.xz nixlib-5de438562062dfb706700c379ca68c2ff1bd97ad.tar.zst nixlib-5de438562062dfb706700c379ca68c2ff1bd97ad.zip |
Merge pull request #285833 from 360ied/murmur-hardened
nixos/murmur: systemd service hardening
Diffstat (limited to 'nixos/modules/services/networking')
-rw-r--r-- | nixos/modules/services/networking/murmur.nix | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/nixos/modules/services/networking/murmur.nix b/nixos/modules/services/networking/murmur.nix index 0cd80e134ace..5805f332a66f 100644 --- a/nixos/modules/services/networking/murmur.nix +++ b/nixos/modules/services/networking/murmur.nix @@ -326,6 +326,29 @@ in RuntimeDirectoryMode = "0700"; User = "murmur"; Group = "murmur"; + + # service hardening + AmbientCapabilities = "CAP_NET_BIND_SERVICE"; + CapabilityBoundingSet = "CAP_NET_BIND_SERVICE"; + LockPersonality = true; + MemoryDenyWriteExecute = true; + NoNewPrivileges = true; + PrivateDevices = true; + PrivateTmp = true; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectSystem = "full"; + RestrictAddressFamilies = "~AF_PACKET AF_NETLINK"; + RestrictNamespaces = true; + RestrictSUIDSGID = true; + RestrictRealtime = true; + SystemCallArchitectures = "native"; + SystemCallFilter = "@system-service"; }; }; |