cleanup

common/tooling/java.nix

@@ -21,7 +21,7 @@ in
       pkgs.jdk17
       pkgs.visualvm
       pkgs.gradle_7
-    ]; # ++ optionals graphical [ pkgs.jetbrains.idea-community ];
+    ] ++ optionals graphical [ pkgs.jetbrains.idea-community ];
 
     environment.sessionVariables.JAVA_HOME = pkgs.jdk17.home;
 

common/tooling/nix-index.nix

@@ -13,7 +13,6 @@ in
   users.users."${user}" = {
     isSystemUser = true;
     group = user;
-    uid = 995;
   };
   users.groups."${user}" = { };
 

hardening/opensnitch/dns.nix

@@ -30,7 +30,6 @@ in
     users.groups."${dnscrypt_proxy_user}" = { };
 
     systemd.services.dnscrypt-proxy2.serviceConfig = {
-      DynamicUser = lib.mkForce true;
       User = dnscrypt_proxy_user;
       Group = dnscrypt_proxy_user;
     };

hardening/systemd/acpid.nix

@@ -5,7 +5,6 @@
       CapabilityBoundingSet = [
         ""
       ];
-      NoNewPrivileges = true;
       RestrictNamespaces = [
         "~pid"
         "~user"
@@ -33,8 +32,9 @@
       ProtectKernelLogs = true;
       IPAddressAllow = [ ];
 
-      PrivateDevices = false; # acpi obviously needs device access
+      PrivateDevices = false; # acpi needs device access
       PrivateNetwork = false; # required for netlink to work properly
+      NoNewPrivileges = false; # acpi hooks might want to execute things at higher/different access
       RestrictAddressFamilies = [
         "AF_NETLINK"
         "AF_UNIX"

hardening/systemd/default.nix

@@ -21,7 +21,7 @@ in
     ./bluetooth.nix
     # ./tty.nix
     ./ask-password.nix
-    ./nix-daemon.nix
+    # ./nix-daemon.nix
     ./nscd.nix
     ./rtkit.nix
     ./sshd.nix