nscd and rtkit hardening

hardening/systemd/default.nix

@@ -17,11 +17,13 @@ in
     ./wpa_supplicant.nix
     ./auditd.nix
     ./acpid.nix
-    # ./cups.nix
+    ./cups.nix
     ./bluetooth.nix
     ./tty.nix
     ./ask-password.nix
     ./nix-daemon.nix
+    ./nscd.nix
+    ./rtkit.nix
 
     ./global
   ];

hardening/systemd/nscd.nix

@@ -0,0 +1,55 @@
+{
+  lib,
+  config,
+  ...
+}:
+{
+  config.systemd.services = lib.mkIf (config.specialisation != { }) {
+    nscd.serviceConfig = {
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      SystemCallArchitectures = "native";
+      RestrictSUIDSGID = true;
+      RestrictAddressFamilies = [
+        "AF_UNIX"
+        "AF_INET"
+        "AF_INET6"
+      ];
+      RestrictNamespaces = [
+        "~pid"
+        "~user"
+        "~net"
+        "~uts"
+        "~mnt"
+        "~cgroup"
+        "~ipc"
+      ];
+      SystemCallFilter = "@system-service";
+
+      LockPersonality = true;
+      ProtectControlGroups = true;
+      ProtectKernelModules = true;
+      PrivateMounts = true;
+      ProtectProc = "invisible";
+      ProtectClock = true;
+
+      # file system
+      PrivateTmp = true;
+      ProtectSystem = "strict";
+      RestrictRealtime = true;
+
+      PrivateUsers = true;
+      PrivateDevices = true;
+
+      CapabilityBoundingSet = [
+        "CAP_SETGID"
+        "CAP_SETUID"
+        "cap_dac_override"
+      ];
+
+      ProtectKernelLogs = true;
+      ProtectKernelTunables = true;
+      ProtectHostname = true;
+    };
+  };
+}

hardening/systemd/rtkit.nix

@@ -0,0 +1,56 @@
+{
+  lib,
+  config,
+  ...
+}:
+{
+  config.systemd.services = lib.mkIf (config.specialisation != { }) {
+    rtkit-daemon.serviceConfig = {
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      SystemCallArchitectures = "native";
+      RestrictSUIDSGID = true;
+      RestrictAddressFamilies = "AF_UNIX";
+      RestrictNamespaces = [
+        "~pid"
+        "~user"
+        "~net"
+        "~uts"
+        "~mnt"
+        "~cgroup"
+        "~ipc"
+      ];
+      SystemCallFilter = [
+        "@system-service"
+        "@chroot"
+        "@mount"
+      ];
+
+      LockPersonality = true;
+      ProtectControlGroups = true;
+      ProtectKernelModules = true;
+      PrivateMounts = true;
+      ProtectClock = true;
+
+      PrivateTmp = true;
+      ProtectSystem = "strict";
+      RestrictRealtime = false; # important
+      PrivateDevices = true;
+      ProcSubset = "pid";
+
+      CapabilityBoundingSet = [
+        "CAP_SYS_NICE"
+        "CAP_DAC_READ_SEARCH"
+        "CAP_SYS_CHROOT"
+        "CAP_SETGID"
+        "CAP_SETUID"
+      ];
+
+      ProtectKernelLogs = true;
+      ProtectKernelTunables = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      PrivateNetwork = true;
+    };
+  };
+}