Grimmauld/grimm-nixos-laptop
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

cleanup

Browse source
This commit is contained in:
Grimmauld 2025-01-29 18:37:35 +01:00
parent e8e11182c2
commit d021739983
No known key found for this signature in database
5 changed files with 4 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
common/tooling/java.nix
View file

@ -21,7 +21,7 @@ in
pkgs.jdk17 pkgs.jdk17
pkgs.visualvm pkgs.visualvm
pkgs.gradle_7 pkgs.gradle_7
]; # ++ optionals graphical [ pkgs.jetbrains.idea-community ]; ] ++ optionals graphical [ pkgs.jetbrains.idea-community ];
environment.sessionVariables.JAVA_HOME = pkgs.jdk17.home; environment.sessionVariables.JAVA_HOME = pkgs.jdk17.home;

1
common/tooling/nix-index.nix
View file

@ -13,7 +13,6 @@ in
users.users."${user}" = { users.users."${user}" = {
isSystemUser = true; isSystemUser = true;
group = user; group = user;
uid = 995;
}; };
users.groups."${user}" = { }; users.groups."${user}" = { };

1
hardening/opensnitch/dns.nix
View file

@ -30,7 +30,6 @@ in
users.groups."${dnscrypt_proxy_user}" = { }; users.groups."${dnscrypt_proxy_user}" = { };
systemd.services.dnscrypt-proxy2.serviceConfig = { systemd.services.dnscrypt-proxy2.serviceConfig = {
DynamicUser = lib.mkForce true;
User = dnscrypt_proxy_user; User = dnscrypt_proxy_user;
Group = dnscrypt_proxy_user; Group = dnscrypt_proxy_user;
}; };

4
hardening/systemd/acpid.nix
View file

@ -5,7 +5,6 @@
CapabilityBoundingSet = [ CapabilityBoundingSet = [
"" ""
]; ];
NoNewPrivileges = true;
RestrictNamespaces = [ RestrictNamespaces = [
"~pid" "~pid"
"~user" "~user"
@ -33,8 +32,9 @@
ProtectKernelLogs = true; ProtectKernelLogs = true;
IPAddressAllow = [ ]; IPAddressAllow = [ ];
PrivateDevices = false; # acpi obviously needs device access PrivateDevices = false; # acpi needs device access
PrivateNetwork = false; # required for netlink to work properly PrivateNetwork = false; # required for netlink to work properly
NoNewPrivileges = false; # acpi hooks might want to execute things at higher/different access
RestrictAddressFamilies = [ RestrictAddressFamilies = [
"AF_NETLINK" "AF_NETLINK"
"AF_UNIX" "AF_UNIX"

2
hardening/systemd/default.nix
View file

@ -21,7 +21,7 @@ in
./bluetooth.nix ./bluetooth.nix
# ./tty.nix # ./tty.nix
./ask-password.nix ./ask-password.nix
./nix-daemon.nix # ./nix-daemon.nix
./nscd.nix ./nscd.nix
./rtkit.nix ./rtkit.nix
./sshd.nix ./sshd.nix