Grimmauld/grimm-nixos-laptop
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

more sysd hardening

Browse source
This commit is contained in:
Grimmauld 2025-01-05 23:03:11 +01:00
parent d6c70f5ae2
commit 8f68278465
No known key found for this signature in database
4 changed files with 82 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
hardening/systemd/acpid.nix Normal file
View file

@ -0,0 +1,27 @@
{ lib, config, ... }:
{
config.systemd.services = lib.mkIf (config.specialisation != { }) {
acpid.serviceConfig = {
CapabilityBoundingSet = [
""
];
NoNewPrivileges = true;
RestrictNamespaces = "pid";
ProtectControlGroups = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
MemoryDenyWriteExecute = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = "@system-service";
LockPersonality = true;
ProtectHostname=true;
ProtectSystem=true;
PrivateUsers=true;
PrivateNetwork=true;
RestrictRealtime=true;
IPAddressAllow=[];
RestrictAddressFamilies="AF_NETLINK AF_UNIX";
};
};
}

24
hardening/systemd/auditd.nix Normal file
View file

@ -0,0 +1,24 @@
{ lib, config, ... }:
{
config.systemd.services = lib.mkIf (config.specialisation != { }) {
auditd.serviceConfig = {
# CapabilityBoundingSet = [ "CAP_AUDIT_*" "CAP_SYSLOG" "CAP_SYS_NICE" "CAP_SYS_PACCT" "CAP_SYS_PTRACE" ];
NoNewPrivileges = true;
RestrictNamespaces = "pid";
ProtectControlGroups = true;
ProtectKernelModules = true;
MemoryDenyWriteExecute = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = "@system-service";
LockPersonality = true;
ProtectHostname=true;
ProtectSystem=true;
# PrivateUsers=true;
# PrivateNetwork=true;
RestrictRealtime=true;
IPAddressAllow=[];
RestrictAddressFamilies="AF_NETLINK";
};
};
}

28
hardening/systemd/cups.nix Normal file
View file

@ -0,0 +1,28 @@
{ lib, config, ... }:
{
config.systemd.services = lib.mkIf (config.specialisation != { }) {
cups.serviceConfig = {
#CapabilityBoundingSet = [
# ""
#];
NoNewPrivileges = true;
RestrictNamespaces = "pid";
ProtectControlGroups = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
MemoryDenyWriteExecute = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = "@system-service";
LockPersonality = true;
ProtectHostname=true;
RestrictRealtime=true;
# PrivateUsers=true;
# PrivateNetwork=true;
# RestrictAddressFamilies="AF_UNIX";
# ProtectSystem=true;
};
};
}

3
hardening/systemd/default.nix
View file

@ -15,6 +15,9 @@ in
imports = [
./NetworkManager.nix
./wpa_supplicant.nix
./auditd.nix
./acpid.nix
./cups.nix
];
options.systemd.services = lib.mkOption {