{ lib, config, ... }: { config.systemd.services = lib.mkIf (config.specialisation != { }) { systemd-ask-password-console.serviceConfig = { CapabilityBoundingSet = [ "" ]; NoNewPrivileges = true; RestrictNamespaces = "pid"; ProtectControlGroups = true; ProtectKernelModules = true; ProtectKernelTunables = true; MemoryDenyWriteExecute = true; RestrictSUIDSGID = true; SystemCallArchitectures = "native"; SystemCallFilter = "@system-service"; LockPersonality = true; RestrictRealtime = true; ProtectProc = "invisible"; PrivateUsers = true; }; systemd-ask-password-wall.serviceConfig = { CapabilityBoundingSet = [ "" ]; NoNewPrivileges = true; RestrictNamespaces = "pid"; ProtectControlGroups = true; ProtectKernelModules = true; ProtectKernelTunables = true; MemoryDenyWriteExecute = true; RestrictSUIDSGID = true; SystemCallArchitectures = "native"; SystemCallFilter = "@system-service"; LockPersonality = true; RestrictRealtime = true; ProtectProc = "invisible"; PrivateUsers = true; }; }; }