danio/nixos-matrix-modules
0
2
Fork 1
mirror of https://github.com/dali99/nixos-matrix-modules.git synced 2026-04-29 09:44:49 +02:00
Code Issues Releases Activity

Add systemd hardening

Browse Source
This commit is contained in:
Oystein Kristoffer Tveit
2025-12-24 08:41:46 +09:00
parent 82959f612f
commit 318538066f
2 changed files with 78 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
synapse-module/default.nix
+39
View File
@@ -450,6 +450,45 @@ in
in "${wrapped}/bin/synapse_homeserver ${flags}"; in "${wrapped}/bin/synapse_homeserver ${flags}";
ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -HUP $MAINPID"; ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -HUP $MAINPID";
Restart = "on-failure"; Restart = "on-failure";
CapabilityBoundingSet = [ "" ];
LockPersonality = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
ReadWritePaths = [
cfg.dataDir
cfg.settings.media_store_path
]
++ (map (listener: dirOf listener.path) (
lib.filter (listener: listener.path != null) cfg.settings.listeners
));
RemoveIPC = true;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@resources"
"~@privileged"
];
}; };
}; };
}; };
synapse-module/workers.nix
+39
View File
@@ -394,6 +394,45 @@ in {
keys-directory = cfg.dataDir; keys-directory = cfg.dataDir;
}; };
in "${wrapped}/bin/synapse_worker ${flags}"; in "${wrapped}/bin/synapse_worker ${flags}";
CapabilityBoundingSet = [ "" ];
LockPersonality = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
ReadWritePaths = [
cfg.dataDir
cfg.settings.media_store_path
]
++ (map (listener: dirOf listener.path) (
lib.filter (listener: listener.path != null) cfg.settings.listeners
));
RemoveIPC = true;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@resources"
"~@privileged"
];
}; };
}; };
})); }));