nixos/babeld: update hardening

This commit is contained in:
Martin Weinelt 2021-06-20 13:52:03 +02:00
parent 34e5bf44fb
commit 8739f8cd7b
No known key found for this signature in database
GPG key ID: 87C1E9888F856759

View file

@ -104,6 +104,7 @@ in
ExecStart = "${pkgs.babeld}/bin/babeld -c ${configFile} -I /run/babeld/babeld.pid -S /var/lib/babeld/state";
AmbientCapabilities = [ "CAP_NET_ADMIN" ];
CapabilityBoundingSet = [ "CAP_NET_ADMIN" ];
DevicePolicy = "closed";
DynamicUser = true;
IPAddressAllow = [ "fe80::/64" "ff00::/8" "::1/128" "127.0.0.0/8" ];
IPAddressDeny = "any";
@ -123,12 +124,17 @@ in
RemoveIPC = true;
ProtectHome = true;
ProtectHostname = true;
ProtectProc = "invisible";
PrivateMounts = true;
PrivateTmp = true;
PrivateDevices = true;
PrivateUsers = false; # kernel_route(ADD): Operation not permitted
ProcSubset = "pid";
SystemCallArchitectures = "native";
SystemCallFilter = [ "@system-service" ];
SystemCallFilter = [
"@system-service"
"~@privileged @resources"
];
UMask = "0177";
RuntimeDirectory = "babeld";
StateDirectory = "babeld";