Projects/greg-ng
Projects
/
greg-ng
7
0
Fork 0
Code Issues 24 Pull Requests Releases Activity

systemd hardening

This commit is contained in:
Oystein Kristoffer Tveit 2024-10-20 01:29:48 +02:00
parent c5f606f910
commit a476f877d2
Signed by: oysteikt
GPG Key ID: 9F2F7D8250F35146
1 changed files with 37 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
module.nix
View File

@ -97,14 +97,48 @@ in
description = "greg-ng, an mpv based media player";
wantedBy = [ "graphical-session.target" ];
partOf = [ "graphical-session.target" ];
environment = {
RUST_LOG = lib.mkIf cfg.enableDebug "greg_ng=trace,mpvipc=trace";
};
environment.RUST_LOG = lib.mkIf cfg.enableDebug "greg_ng=trace,mpvipc=trace";
serviceConfig = {
Type = "simple";
ExecStart = "${lib.getExe cfg.package} ${lib.cli.toGNUCommandLineShell { } cfg.settings}";
Restart = "always";
RestartSec = 3;
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
AmbientCapabilities = [ "" ];
CapabilityBoundingSet = [ "" ];
DeviceAllow = [ "" ];
LockPersonality = true;
# Might work, but wouldn't bet on it with embedded lua in mpv
MemoryDenyWriteExecute = false;
NoNewPrivileges = true;
# MPV and mesa tries to talk directly to the GPU.
PrivateDevices = false;
PrivateMounts = true;
PrivateTmp = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
# MPV wants ~/.cache
ProtectHome = false;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "full";
RemoveIPC = true;
UMask = "0077";
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
"~@resources"
];
};
};
})