oysteikt/nix-dotfiles
1
2
Fork 0
Code Issues 142 Pull Requests Activity

common/dbus: harden dbus-broker units

Browse Source
This commit is contained in:
Oystein Kristoffer Tveit
2025-10-28 13:46:26 +09:00
parent a3542e6a6c
commit f2931da4ab
1 changed files with 60 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
hosts/common/services/dbus.nix
View File

@@ -7,4 +7,64 @@
gcr
];
};
systemd.services.dbus-broker.serviceConfig = {
LockPersonality = "yes";
MemoryDenyWriteExecute = "yes";
NoNewPrivileges = "yes";
PrivateDevices = "yes";
ProtectClock = "yes";
ProtectControlGroups = "yes";
ProtectHome = "yes";
ProtectHostname = "yes";
ProtectKernelLogs = "yes";
ProtectKernelModules = "yes";
ProtectKernelTunables = "yes";
RestrictNamespaces = "yes";
RestrictRealtime = "yes";
RestrictSUIDSGID = "yes";
SystemCallArchitectures = "native";
UMask = "077";
RestrictAddressFamilies = [
"AF_UNIX"
"AF_NETLINK"
];
SystemCallFilter = [
"@system-service"
"~@mount"
"~@resources"
];
AmbientCapabilities = "CAP_AUDIT_WRITE";
CapabilityBoundingSet = "CAP_AUDIT_WRITE";
};
systemd.user.services.dbus-broker.serviceConfig = {
LockPersonality = "yes";
MemoryDenyWriteExecute = "yes";
NoNewPrivileges = "yes";
PrivateDevices = "yes";
ProtectClock = "yes";
ProtectControlGroups = "yes";
ProtectHome = "yes";
ProtectHostname = "yes";
ProtectKernelLogs = "yes";
ProtectKernelModules = "yes";
ProtectKernelTunables = "yes";
RestrictNamespaces = "yes";
RestrictRealtime = "yes";
RestrictSUIDSGID = "yes";
SystemCallArchitectures = "native";
UMask = "077";
RestrictAddressFamilies = [
"AF_UNIX"
"AF_NETLINK"
];
SystemCallFilter = [
"@system-service"
"~@resources"
"~@privileged"
];
AmbientCapabilities = "";
CapabilityBoundingSet = "";
};
}