grimm-nixos-laptop/hardening/systemd/auditd.nix
2025-01-05 23:03:11 +01:00

24 lines
775 B
Nix

{ lib, config, ... }:
{
config.systemd.services = lib.mkIf (config.specialisation != { }) {
auditd.serviceConfig = {
# CapabilityBoundingSet = [ "CAP_AUDIT_*" "CAP_SYSLOG" "CAP_SYS_NICE" "CAP_SYS_PACCT" "CAP_SYS_PTRACE" ];
NoNewPrivileges = true;
RestrictNamespaces = "pid";
ProtectControlGroups = true;
ProtectKernelModules = true;
MemoryDenyWriteExecute = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = "@system-service";
LockPersonality = true;
ProtectHostname=true;
ProtectSystem=true;
# PrivateUsers=true;
# PrivateNetwork=true;
RestrictRealtime=true;
IPAddressAllow=[];
RestrictAddressFamilies="AF_NETLINK";
};
};
}