common/tooling/java.nix

@@ -21,7 +21,7 @@ in
       pkgs.jdk17
       pkgs.visualvm
       pkgs.gradle_7
-    ] ++ optionals graphical [ pkgs.jetbrains.idea-community ];
+    ]; # ++ optionals graphical [ pkgs.jetbrains.idea-community ];
 
     environment.sessionVariables.JAVA_HOME = pkgs.jdk17.home;
 

common/tooling/nix-index.nix

@@ -13,6 +13,7 @@ in
   users.users."${user}" = {
     isSystemUser = true;
     group = user;
+    uid = 995;
   };
   users.groups."${user}" = { };
 

hardening/encrypt-dns.nix

@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ pkgs, config, lib, ... }:
 {
   networking = {
     nameservers = lib.mkForce [ "127.0.0.1" "::1" ];

hardening/opensnitch/dns.nix

@@ -30,6 +30,7 @@ in
     users.groups."${dnscrypt_proxy_user}" = { };
 
     systemd.services.dnscrypt-proxy2.serviceConfig = {
+      DynamicUser = lib.mkForce true;
       User = dnscrypt_proxy_user;
       Group = dnscrypt_proxy_user;
     };
@@ -54,7 +55,7 @@ in
             {
               type = "regexp";
               operand = "dest.port";
-              data = "53|443|4434|5443|4343";
+              data = "53|443|4434|5443";
             }
             #  {
             #    type = "lists";

hardening/security.nix

@@ -41,7 +41,7 @@ in
       }
     ];
 
-    # services.pcscd.enable = true;
+    services.pcscd.enable = true;
     age.ageBin =
       let
         rage_wrapped = pkgs.symlinkJoin {

hardening/systemd/acpid.nix

@@ -5,16 +5,8 @@
       CapabilityBoundingSet = [
         ""
       ];
-      RestrictNamespaces = [
-        "~pid"
-        "~user"
-        "~net"
-        "~uts"
-        "~mnt"
-        "~cgroup"
-        "~ipc"
-      ];
-
+      NoNewPrivileges = true;
+      RestrictNamespaces = "pid";
       ProtectControlGroups = true;
       ProtectKernelModules = true;
       ProtectKernelTunables = true;
@@ -23,23 +15,12 @@
       SystemCallArchitectures = "native";
       SystemCallFilter = "@system-service";
       LockPersonality = true;
-      ProtectSystem = "strict";
+      ProtectSystem = true;
       PrivateUsers = true;
+      PrivateNetwork = true;
       RestrictRealtime = true;
-      PrivateTmp = true;
-      ProtectHome = true;
-      ProtectProc = "invisible";
-      ProtectKernelLogs = true;
       IPAddressAllow = [ ];
-
-      PrivateDevices = false; # acpi needs device access
-      PrivateNetwork = false; # required for netlink to work properly
-      NoNewPrivileges = false; # acpi hooks might want to execute things at higher/different access
-      ProcSubset = "all"; # requires access to /proc/acpi
-      RestrictAddressFamilies = [
-        "AF_NETLINK"
-        "AF_UNIX"
-      ];
+      RestrictAddressFamilies = "AF_NETLINK AF_UNIX";
     };
   };
 }

hardening/systemd/bluetooth.nix

@@ -3,25 +3,13 @@
   config.systemd.services = lib.mkIf (config.specialisation != { }) {
     bluetooth.serviceConfig = {
       CapabilityBoundingSet = [
-        "CAP_NET_BIND_SERVICE" # sockets and tethering
-      ];
-      RestrictAddressFamilies = [
-        "AF_UNIX" # sockets
-        "AF_INET" # tethering
-        "AF_INET6" # tethering
-        "AF_NETLINK" # deamon callback
+        ""
       ];
       NoNewPrivileges = true;
-      RestrictNamespaces = [
-          "~pid"
-          "~user"
-          "~net"
-          "~uts"
-          "~mnt"
-          "~cgroup"
-          "~ipc"
-        ];
+      RestrictNamespaces = "pid";
       ProtectControlGroups = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
       MemoryDenyWriteExecute = true;
       RestrictSUIDSGID = true;
       SystemCallArchitectures = "native";
@@ -29,16 +17,7 @@
       LockPersonality = true;
       RestrictRealtime = true;
       ProtectProc = "invisible";
-      PrivateTmp = true;
-      
-      PrivateUsers = false;
-
-      # loading hardware modules
-      ProtectKernelModules = false;
-      ProtectKernelTunables = false;
-
-      PrivateNetwork = false; # tethering
-
+      PrivateUsers = true;
     };
 
     blueman-mechanism.serviceConfig = {

hardening/systemd/dbus-broker.nix

@@ -1,62 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}:
-{
-  config.systemd.services = lib.mkIf (config.specialisation != { }) {
-    dbus-broker.serviceConfig = {
-      DevicePolicy = "closed";
-      KeyringMode = "private";
-      LockPersonality = true;
-      MemoryDenyWriteExecute = true;
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateTmp = true;
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = "read-only";
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "full";
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-
-      RestrictAddressFamilies = [
-        #     "AF_INET"
-        #     "AF_INET6"
-        "AF_UNIX"
-      ];
-      RestrictNamespaces = [
-        "~pid"
-        "~user"
-        "~net"
-        "~uts"
-        "~mnt"
-        "~cgroup"
-        "~ipc"
-      ];
-      SystemCallFilter = [
-        "@system-service"
-        "@privileged"
-      ];
-
-      PrivateMounts = true;
-
-      #   CapabilityBoundingSet = [
-      #     "CAP_NET_BIND_SERVICE"
-      #    "CAP_SETGID"
-      #     "CAP_SETUID"
-      #     "CAP_SYS_CHROOT"
-      #     "cap_dac_override"
-      #   ];
-
-      #   PrivateUsers = false; # important
-      #   PrivateNetwork = false; # important
-    };
-  };
-}

hardening/systemd/default.nix

@@ -25,7 +25,6 @@ in
     ./nscd.nix
     ./rtkit.nix
     ./sshd.nix
-    ./dbus-broker.nix
 
     ./global
   ];