Grimmauld/grimm-nixos-laptop
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix bluetooth

Browse source
This commit is contained in:
Grimmauld 2025-01-29 21:11:30 +01:00
parent d021739983
commit 24caa93a7c
No known key found for this signature in database
2 changed files with 27 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
hardening/systemd/acpid.nix
View file

@ -35,6 +35,7 @@
PrivateDevices = false; # acpi needs device access PrivateDevices = false; # acpi needs device access
PrivateNetwork = false; # required for netlink to work properly PrivateNetwork = false; # required for netlink to work properly
NoNewPrivileges = false; # acpi hooks might want to execute things at higher/different access NoNewPrivileges = false; # acpi hooks might want to execute things at higher/different access
ProcSubset = "all"; # requires access to /proc/acpi
RestrictAddressFamilies = [ RestrictAddressFamilies = [
"AF_NETLINK" "AF_NETLINK"
"AF_UNIX" "AF_UNIX"

31
hardening/systemd/bluetooth.nix
View file

@ -3,13 +3,25 @@
config.systemd.services = lib.mkIf (config.specialisation != { }) { config.systemd.services = lib.mkIf (config.specialisation != { }) {
bluetooth.serviceConfig = { bluetooth.serviceConfig = {
CapabilityBoundingSet = [ CapabilityBoundingSet = [
"" "CAP_NET_BIND_SERVICE" # sockets and tethering
];
RestrictAddressFamilies = [
"AF_UNIX" # sockets
"AF_INET" # tethering
"AF_INET6" # tethering
"AF_NETLINK" # deamon callback
]; ];
NoNewPrivileges = true; NoNewPrivileges = true;
RestrictNamespaces = "pid"; RestrictNamespaces = [
"~pid"
"~user"
"~net"
"~uts"
"~mnt"
"~cgroup"
"~ipc"
];
ProtectControlGroups = true; ProtectControlGroups = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
MemoryDenyWriteExecute = true; MemoryDenyWriteExecute = true;
RestrictSUIDSGID = true; RestrictSUIDSGID = true;
SystemCallArchitectures = "native"; SystemCallArchitectures = "native";
@ -17,7 +29,16 @@
LockPersonality = true; LockPersonality = true;
RestrictRealtime = true; RestrictRealtime = true;
ProtectProc = "invisible"; ProtectProc = "invisible";
PrivateUsers = true; PrivateTmp = true;
PrivateUsers = false;
# loading hardware modules
ProtectKernelModules = false;
ProtectKernelTunables = false;
PrivateNetwork = false; # tethering
}; };
blueman-mechanism.serviceConfig = { blueman-mechanism.serviceConfig = {