dbus-broker hardening, acpid fixes

hardening/encrypt-dns.nix

@@ -1,4 +1,4 @@
-{ pkgs, config, lib, ... }:
+{ config, lib, ... }:
 {
   networking = {
     nameservers = lib.mkForce [ "127.0.0.1" "::1" ];

hardening/opensnitch/dns.nix

@@ -55,7 +55,7 @@ in
             {
               type = "regexp";
               operand = "dest.port";
-              data = "53|443|4434|5443";
+              data = "53|443|4434|5443|4343";
             }
             #  {
             #    type = "lists";

hardening/security.nix

@@ -41,7 +41,7 @@ in
       }
     ];
 
-    services.pcscd.enable = true;
+    # services.pcscd.enable = true;
     age.ageBin =
       let
         rage_wrapped = pkgs.symlinkJoin {

hardening/systemd/acpid.nix

@@ -6,7 +6,16 @@
         ""
       ];
       NoNewPrivileges = true;
-      RestrictNamespaces = "pid";
+      RestrictNamespaces = [
+        "~pid"
+        "~user"
+        "~net"
+        "~uts"
+        "~mnt"
+        "~cgroup"
+        "~ipc"
+      ];
+
       ProtectControlGroups = true;
       ProtectKernelModules = true;
       ProtectKernelTunables = true;
@@ -15,12 +24,21 @@
       SystemCallArchitectures = "native";
       SystemCallFilter = "@system-service";
       LockPersonality = true;
-      ProtectSystem = true;
+      ProtectSystem = "strict";
       PrivateUsers = true;
-      PrivateNetwork = true;
       RestrictRealtime = true;
+      PrivateTmp = true;
+      ProtectHome = true;
+      ProtectProc = "invisible";
+      ProtectKernelLogs = true;
       IPAddressAllow = [ ];
-      RestrictAddressFamilies = "AF_NETLINK AF_UNIX";
+
+      PrivateDevices = false; # acpi obviously needs device access
+      PrivateNetwork = false; # required for netlink to work properly
+      RestrictAddressFamilies = [
+        "AF_NETLINK"
+        "AF_UNIX"
+      ];
     };
   };
 }

hardening/systemd/dbus-broker.nix

@@ -0,0 +1,62 @@
+{
+  lib,
+  config,
+  ...
+}:
+{
+  config.systemd.services = lib.mkIf (config.specialisation != { }) {
+    dbus-broker.serviceConfig = {
+      DevicePolicy = "closed";
+      KeyringMode = "private";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      PrivateDevices = true;
+      PrivateTmp = true;
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = "read-only";
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "full";
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+
+      RestrictAddressFamilies = [
+        #     "AF_INET"
+        #     "AF_INET6"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = [
+        "~pid"
+        "~user"
+        "~net"
+        "~uts"
+        "~mnt"
+        "~cgroup"
+        "~ipc"
+      ];
+      SystemCallFilter = [
+        "@system-service"
+        "@privileged"
+      ];
+
+      PrivateMounts = true;
+
+      #   CapabilityBoundingSet = [
+      #     "CAP_NET_BIND_SERVICE"
+      #    "CAP_SETGID"
+      #     "CAP_SETUID"
+      #     "CAP_SYS_CHROOT"
+      #     "cap_dac_override"
+      #   ];
+
+      #   PrivateUsers = false; # important
+      #   PrivateNetwork = false; # important
+    };
+  };
+}

hardening/systemd/default.nix

@@ -21,10 +21,11 @@ in
     ./bluetooth.nix
     # ./tty.nix
     ./ask-password.nix
-    # ./nix-daemon.nix
+    ./nix-daemon.nix
     ./nscd.nix
     ./rtkit.nix
     ./sshd.nix
+    ./dbus-broker.nix
 
     ./global
   ];