71 lines
1.8 KiB
Nix
71 lines
1.8 KiB
Nix
{ pkgs, ... }:
|
|
{
|
|
services.dbus = {
|
|
enable = true;
|
|
implementation = "broker";
|
|
packages = with pkgs; [
|
|
gcr
|
|
];
|
|
};
|
|
|
|
systemd.services.dbus-broker.serviceConfig = {
|
|
# LockPersonality = "yes";
|
|
# MemoryDenyWriteExecute = "yes";
|
|
# NoNewPrivileges = "yes";
|
|
# PrivateDevices = "yes";
|
|
# ProtectClock = "yes";
|
|
# ProtectControlGroups = "yes";
|
|
# ProtectHome = "yes";
|
|
# ProtectHostname = "yes";
|
|
# ProtectKernelLogs = "yes";
|
|
# ProtectKernelModules = "yes";
|
|
# ProtectKernelTunables = "yes";
|
|
# RestrictNamespaces = "yes";
|
|
# RestrictRealtime = "yes";
|
|
# RestrictSUIDSGID = "yes";
|
|
# SystemCallArchitectures = "native";
|
|
# UMask = "077";
|
|
# RestrictAddressFamilies = [
|
|
# "AF_UNIX"
|
|
# "AF_NETLINK"
|
|
# ];
|
|
# SystemCallFilter = [
|
|
# "@system-service"
|
|
# "~@mount"
|
|
# "~@resources"
|
|
# ];
|
|
# AmbientCapabilities = "CAP_AUDIT_WRITE";
|
|
# CapabilityBoundingSet = "CAP_AUDIT_WRITE";
|
|
};
|
|
|
|
systemd.user.services.dbus-broker.serviceConfig = {
|
|
# LockPersonality = "yes";
|
|
# MemoryDenyWriteExecute = "yes";
|
|
# NoNewPrivileges = "yes";
|
|
# PrivateDevices = "yes";
|
|
# ProtectClock = "yes";
|
|
# ProtectControlGroups = "yes";
|
|
# ProtectHome = "yes";
|
|
# ProtectHostname = "yes";
|
|
# ProtectKernelLogs = "yes";
|
|
# ProtectKernelModules = "yes";
|
|
# ProtectKernelTunables = "yes";
|
|
# RestrictNamespaces = "yes";
|
|
# RestrictRealtime = "yes";
|
|
# RestrictSUIDSGID = "yes";
|
|
# SystemCallArchitectures = "native";
|
|
# UMask = "077";
|
|
# RestrictAddressFamilies = [
|
|
# "AF_UNIX"
|
|
# "AF_NETLINK"
|
|
# ];
|
|
# SystemCallFilter = [
|
|
# "@system-service"
|
|
# "~@resources"
|
|
# "~@privileged"
|
|
# ];
|
|
# AmbientCapabilities = "";
|
|
# CapabilityBoundingSet = "";
|
|
};
|
|
}
|