nixos/usbguard: update systemd sandboxing features
Apply upstream systemd service configuration options to improve sandboxing.
This commit is contained in:
parent
2198d015e5
commit
2827491c23
|
@ -207,6 +207,29 @@ in {
|
|||
Type = "simple";
|
||||
ExecStart = ''${cfg.package}/bin/usbguard-daemon -P -k -c ${daemonConfFile}'';
|
||||
Restart = "on-failure";
|
||||
|
||||
AmbientCapabilities = "";
|
||||
CapabilityBoundingSet = "CAP_CHOWN CAP_FOWNER";
|
||||
DeviceAllow = "/dev/null rw";
|
||||
DevicePolicy = "strict";
|
||||
IPAddressDeny = "any";
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
PrivateTmp = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectSystem = true;
|
||||
ReadOnlyPaths = "-/";
|
||||
ReadWritePaths = "-/dev/shm -${dirOf cfg.auditFilePath} -/tmp -${dirOf cfg.ruleFile}";
|
||||
RestrictAddressFamilies = "AF_UNIX AF_NETLINK";
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = "@system-service";
|
||||
UMask = "0077";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
Loading…
Reference in a new issue