colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

trust-dns: apply some hardening (still need more)

Browse Source
This commit is contained in:
Colin 2023-07-10 08:00:45 +00:00
parent 384428756d
commit 8c4af55f82
1 changed files with 22 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
modules/services/trust-dns.nix
View File

@ -132,8 +132,29 @@ in
Type = "simple";
Restart = "on-failure";
RestartSec = "10s";
# TODO: hardening (like, don't run as root!)
# TODO: link to docs
# TODO: hardening:
# - User/DynamicUser
# - Group
# - CapabilityBoundingSet
# - SystemCallFilter ?
# - RestrictAddressFamilies
# - LockPersonality ?
# use `systemd-analyze security trust-dns`
MemoryDenyWriteExecute = true;
PrivateDevices = true;
PrivateMounts = true;
PrivateTmp = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "full";
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
};
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];