harden

nix/apps/does-it-build/default.nix

@@ -3,6 +3,7 @@ let
   does-it-build-base = (import (pkgs.fetchFromGitHub my-projects-versions.does-it-build.fetchFromGitHub)) { inherit pkgs; };
   does-it-build = does-it-build-base.overrideAttrs (finalAttrs: previousAttrs: {
     DOES_IT_BUILD_OVERRIDE_VERSION = my-projects-versions.does-it-build.commit;
+    RUSTFLAGS = "-Cforce-frame-pointers=true";
   });
 in
 {

nix/apps/widetom/default.nix

@@ -8,6 +8,7 @@ let
     meta = {
       mainProgram = "widertom";
     };
+    RUSTFLAGS = "-Cforce-frame-pointers=true";
   };
 in
 {
@@ -31,6 +32,21 @@ in
     serviceConfig = {
       DynamicUser = true;
       ExecStart = lib.getExe widetom;
+      PrivateDevices = true;
+      ProtectHome = true;
+      ProtectClock = true;
+      ProtectKernelLogs = true;
+      ProtectHostname = true;
+      ProtectKernelTunables = true;
+      CapabilityBoundingSet = "";
+      ProtectProc = "noaccess";
+      RestrictNamespaces = true;
+      MemoryDenyWriteExecute = true;
+      ProtectControlGroups = true;
+      ProtectKernelModules = true;
+      SystemCallArchitectures = "";
+      SystemCallFilter = "@system-service";
+      RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
     };
   };
 

nix/modules/default/default.nix

@@ -188,6 +188,22 @@ in
   };
   systemd.services.alloy.serviceConfig = {
     DynamicUser = lib.mkForce false;
+    PrivateDevices = true;
+    ProtectClock = true;
+    ProtectKernelLogs = true;
+    PrivateMounts = true;
+    ProtectControlGroups = true;
+    ProtectHostname = true;
+    LockPersonality = true;
+    ProtectKernelTunables = true;
+    ProtectSystem = true;
+    ProtectHome = true;
+    PrivateTmp = true;
+    NoNewPrivileges = true;
+    RestrictNamespaces = "";
+    RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
+    # TODO: find what's required for /proc/kallsyms (it should be CAP_SYSLOG!)
+    # CapabilityBoundingSet = "CAP_SYS_PTRACE CAP_BPF CAP_SYSLOG";
   };
   environment.etc."alloy/config.alloy".text = ''
     discovery.process "all" {

nix/nixpkgs.json

@@ -1,5 +1,5 @@
 {
   "channel": "nixos-25.05",
-  "lastUpdated": "2025-08-03T11:42:11.747Z",
+  "lastUpdated": "2025-08-18T18:47:54.435Z",
-  "commit": "59e69648d345d6e8fef86158c555730fa12af9de"
+  "commit": "48f4c982de68d966421d2b6f1ddbeb6227cc5ceb"
 }