fix bluetooth

common/tooling/java.nix

@@ -21,7 +21,7 @@ in
       pkgs.jdk17
       pkgs.visualvm
       pkgs.gradle_7
-    ]; # ++ optionals graphical [ pkgs.jetbrains.idea-community ];
+    ] ++ optionals graphical [ pkgs.jetbrains.idea-community ];
 
     environment.sessionVariables.JAVA_HOME = pkgs.jdk17.home;
 

common/tooling/nix-index.nix

@@ -13,7 +13,6 @@ in
   users.users."${user}" = {
     isSystemUser = true;
     group = user;
-    uid = 995;
   };
   users.groups."${user}" = { };
 

hardening/encrypt-dns.nix

@@ -1,4 +1,4 @@
-{ pkgs, config, lib, ... }:
+{ config, lib, ... }:
 {
   networking = {
     nameservers = lib.mkForce [ "127.0.0.1" "::1" ];

hardening/opensnitch/dns.nix

@@ -30,7 +30,6 @@ in
     users.groups."${dnscrypt_proxy_user}" = { };
 
     systemd.services.dnscrypt-proxy2.serviceConfig = {
-      DynamicUser = lib.mkForce true;
       User = dnscrypt_proxy_user;
       Group = dnscrypt_proxy_user;
     };
@@ -55,7 +54,7 @@ in
             {
               type = "regexp";
               operand = "dest.port";
-              data = "53|443|4434|5443";
+              data = "53|443|4434|5443|4343";
             }
             #  {
             #    type = "lists";

hardening/security.nix

@@ -41,7 +41,7 @@ in
       }
     ];
 
-    services.pcscd.enable = true;
+    # services.pcscd.enable = true;
     age.ageBin =
       let
         rage_wrapped = pkgs.symlinkJoin {

hardening/systemd/acpid.nix

@@ -5,8 +5,16 @@
       CapabilityBoundingSet = [
         ""
       ];
-      NoNewPrivileges = true;
-      RestrictNamespaces = "pid";
+      RestrictNamespaces = [
+        "~pid"
+        "~user"
+        "~net"
+        "~uts"
+        "~mnt"
+        "~cgroup"
+        "~ipc"
+      ];
+
       ProtectControlGroups = true;
       ProtectKernelModules = true;
       ProtectKernelTunables = true;
@@ -15,12 +23,23 @@
       SystemCallArchitectures = "native";
       SystemCallFilter = "@system-service";
       LockPersonality = true;
-      ProtectSystem = true;
+      ProtectSystem = "strict";
       PrivateUsers = true;
-      PrivateNetwork = true;
       RestrictRealtime = true;
+      PrivateTmp = true;
+      ProtectHome = true;
+      ProtectProc = "invisible";
+      ProtectKernelLogs = true;
       IPAddressAllow = [ ];
-      RestrictAddressFamilies = "AF_NETLINK AF_UNIX";
+
+      PrivateDevices = false; # acpi needs device access
+      PrivateNetwork = false; # required for netlink to work properly
+      NoNewPrivileges = false; # acpi hooks might want to execute things at higher/different access
+      ProcSubset = "all"; # requires access to /proc/acpi
+      RestrictAddressFamilies = [
+        "AF_NETLINK"
+        "AF_UNIX"
+      ];
     };
   };
 }

hardening/systemd/bluetooth.nix

@@ -3,13 +3,25 @@
   config.systemd.services = lib.mkIf (config.specialisation != { }) {
     bluetooth.serviceConfig = {
       CapabilityBoundingSet = [
-        ""
+        "CAP_NET_BIND_SERVICE" # sockets and tethering
+      ];
+      RestrictAddressFamilies = [
+        "AF_UNIX" # sockets
+        "AF_INET" # tethering
+        "AF_INET6" # tethering
+        "AF_NETLINK" # deamon callback
       ];
       NoNewPrivileges = true;
-      RestrictNamespaces = "pid";
+      RestrictNamespaces = [
+          "~pid"
+          "~user"
+          "~net"
+          "~uts"
+          "~mnt"
+          "~cgroup"
+          "~ipc"
+        ];
       ProtectControlGroups = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
       MemoryDenyWriteExecute = true;
       RestrictSUIDSGID = true;
       SystemCallArchitectures = "native";
@@ -17,7 +29,16 @@
       LockPersonality = true;
       RestrictRealtime = true;
       ProtectProc = "invisible";
-      PrivateUsers = true;
+      PrivateTmp = true;
+      
+      PrivateUsers = false;
+
+      # loading hardware modules
+      ProtectKernelModules = false;
+      ProtectKernelTunables = false;
+
+      PrivateNetwork = false; # tethering
+
     };
 
     blueman-mechanism.serviceConfig = {

hardening/systemd/dbus-broker.nix

@@ -0,0 +1,62 @@
+{
+  lib,
+  config,
+  ...
+}:
+{
+  config.systemd.services = lib.mkIf (config.specialisation != { }) {
+    dbus-broker.serviceConfig = {
+      DevicePolicy = "closed";
+      KeyringMode = "private";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      PrivateDevices = true;
+      PrivateTmp = true;
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = "read-only";
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "full";
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+
+      RestrictAddressFamilies = [
+        #     "AF_INET"
+        #     "AF_INET6"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = [
+        "~pid"
+        "~user"
+        "~net"
+        "~uts"
+        "~mnt"
+        "~cgroup"
+        "~ipc"
+      ];
+      SystemCallFilter = [
+        "@system-service"
+        "@privileged"
+      ];
+
+      PrivateMounts = true;
+
+      #   CapabilityBoundingSet = [
+      #     "CAP_NET_BIND_SERVICE"
+      #    "CAP_SETGID"
+      #     "CAP_SETUID"
+      #     "CAP_SYS_CHROOT"
+      #     "cap_dac_override"
+      #   ];
+
+      #   PrivateUsers = false; # important
+      #   PrivateNetwork = false; # important
+    };
+  };
+}

hardening/systemd/default.nix

@@ -25,6 +25,7 @@ in
     ./nscd.nix
     ./rtkit.nix
     ./sshd.nix
+    ./dbus-broker.nix
 
     ./global
   ];