Noratrieb/vps
1
0
Fork 0
mirror of https://github.com/Noratrieb/vps.git synced 2026-01-14 16:55:00 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

harden

Browse source
This commit is contained in:
nora 2025-08-18 21:54:20 +02:00
parent 6206de09bb
commit d21158e234
2 changed files with 31 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

15
nix/apps/widetom/default.nix
View file

@ -32,6 +32,21 @@ in
serviceConfig = {
DynamicUser = true;
ExecStart = lib.getExe widetom;
PrivateDevices = true;
ProtectHome = true;
ProtectClock = true;
ProtectKernelLogs = true;
ProtectHostname = true;
ProtectKernelTunables = true;
CapabilityBoundingSet = "";
ProtectProc = "noaccess";
RestrictNamespaces = true;
MemoryDenyWriteExecute = true;
ProtectControlGroups = true;
ProtectKernelModules = true;
SystemCallArchitectures = "";
SystemCallFilter = "@system-service";
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
};
};