nixos/prometheus: systemd unit hardening of exporters

nixos/modules/services/monitoring/prometheus/exporters.nix

@@ -185,6 +185,28 @@ let
         serviceConfig.DynamicUser = mkDefault enableDynamicUser;
         serviceConfig.User = mkDefault conf.user;
         serviceConfig.Group = conf.group;
+        # Hardening
+        serviceConfig.CapabilityBoundingSet = mkDefault [ "" ];
+        serviceConfig.DeviceAllow = [ "" ];
+        serviceConfig.LockPersonality = true;
+        serviceConfig.MemoryDenyWriteExecute = true;
+        serviceConfig.NoNewPrivileges = true;
+        serviceConfig.PrivateDevices = true;
+        serviceConfig.ProtectClock = true;
+        serviceConfig.ProtectControlGroups = true;
+        serviceConfig.ProtectHome = true;
+        serviceConfig.ProtectHostname = true;
+        serviceConfig.ProtectKernelLogs = true;
+        serviceConfig.ProtectKernelModules = true;
+        serviceConfig.ProtectKernelTunables = true;
+        serviceConfig.ProtectSystem = mkDefault "strict";
+        serviceConfig.RemoveIPC = true;
+        serviceConfig.RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        serviceConfig.RestrictNamespaces = true;
+        serviceConfig.RestrictRealtime = true;
+        serviceConfig.RestrictSUIDSGID = true;
+        serviceConfig.SystemCallArchitectures = "native";
+        serviceConfig.UMask = "0077";
       } serviceOpts ]);
   };
 in

nixos/modules/services/monitoring/prometheus/exporters/bird.nix

@@ -41,6 +41,10 @@ in
           -format.new=${if cfg.newMetricFormat then "true" else "false"} \
           ${concatStringsSep " \\\n  " cfg.extraFlags}
       '';
+      RestrictAddressFamilies = [
+        # Need AF_UNIX to collect data
+        "AF_UNIX"
+      ];
     };
   };
 }

nixos/modules/services/monitoring/prometheus/exporters/dovecot.nix

@@ -83,6 +83,10 @@ in
           --dovecot.scopes ${concatStringsSep "," cfg.scopes} \
           ${concatStringsSep " \\\n  " cfg.extraFlags}
       '';
+      RestrictAddressFamilies = [
+        # Need AF_UNIX to collect data
+        "AF_UNIX"
+      ];
     };
   };
 }

nixos/modules/services/monitoring/prometheus/exporters/kea.nix

@@ -34,6 +34,10 @@ in {
           ${concatStringsSep " \\n" cfg.controlSocketPaths}
       '';
       SupplementaryGroups = [ "kea" ];
+      RestrictAddressFamilies = [
+        # Need AF_UNIX to collect data
+        "AF_UNIX"
+      ];
     };
   };
 }

nixos/modules/services/monitoring/prometheus/exporters/knot.nix

@@ -45,6 +45,10 @@ in {
           ${concatStringsSep " \\\n  " cfg.extraFlags}
       '';
       SupplementaryGroups = [ "knot" ];
+      RestrictAddressFamilies = [
+        # Need AF_UNIX to collect data
+        "AF_UNIX"
+      ];
     };
   };
 }

nixos/modules/services/monitoring/prometheus/exporters/modemmanager.nix

@@ -28,6 +28,10 @@ in
           -rate ${cfg.refreshRate} \
           ${concatStringsSep " \\\n  " cfg.extraFlags}
       '';
+      RestrictAddressFamilies = [
+        # Need AF_UNIX to collect data
+        "AF_UNIX"
+      ];
     };
   };
 }

nixos/modules/services/monitoring/prometheus/exporters/postgres.nix

@@ -79,6 +79,10 @@ in
           --web.telemetry-path ${cfg.telemetryPath} \
           ${concatStringsSep " \\\n  " cfg.extraFlags}
       '';
+      RestrictAddressFamilies = [
+        # Need AF_UNIX to collect data
+        "AF_UNIX"
+      ];
     };
   };
 }

nixos/modules/services/monitoring/prometheus/exporters/smokeping.nix

@@ -45,6 +45,7 @@ in
   serviceOpts = {
     serviceConfig = {
       AmbientCapabilities = [ "CAP_NET_RAW" ];
+      CapabilityBoundingSet = [ "CAP_NET_RAW" ];
       ExecStart = ''
         ${pkgs.prometheus-smokeping-prober}/bin/smokeping_prober \
           --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \

nixos/modules/services/monitoring/prometheus/exporters/sql.nix

@@ -99,6 +99,10 @@ in
           -config.file ${configFile} \
           ${concatStringsSep " \\\n  " cfg.extraFlags}
       '';
+      RestrictAddressFamilies = [
+        # Need AF_UNIX to collect data
+        "AF_UNIX"
+      ];
     };
   };
 }

nixos/modules/services/monitoring/prometheus/exporters/systemd.nix

@@ -13,6 +13,10 @@ in {
         ${pkgs.prometheus-systemd-exporter}/bin/systemd_exporter \
           --web.listen-address ${cfg.listenAddress}:${toString cfg.port}
       '';
+      RestrictAddressFamilies = [
+        # Need AF_UNIX to collect data
+        "AF_UNIX"
+      ];
     };
   };
 }

nixos/modules/services/monitoring/prometheus/exporters/unbound.nix

@@ -49,6 +49,10 @@ in
           ${optionalString (cfg.controlInterface != null) "--control-interface ${cfg.controlInterface}"} \
           ${toString cfg.extraFlags}
       '';
+      RestrictAddressFamilies = [
+        # Need AF_UNIX to collect data
+        "AF_UNIX"
+      ];
     };
   }] ++ [
     (mkIf config.services.unbound.enable {

nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix

@@ -52,6 +52,7 @@ in {
 
     serviceConfig = {
       AmbientCapabilities = [ "CAP_NET_ADMIN" ];
+      CapabilityBoundingSet = [ "CAP_NET_ADMIN" ];
       ExecStart = ''
         ${pkgs.prometheus-wireguard-exporter}/bin/prometheus_wireguard_exporter \
           -p ${toString cfg.port} \
@@ -61,6 +62,10 @@ in {
           ${optionalString cfg.withRemoteIp "-r"} \
           ${optionalString (cfg.wireguardConfig != null) "-n ${escapeShellArg cfg.wireguardConfig}"}
       '';
+      RestrictAddressFamilies = [
+        # Need AF_NETLINK to collect data
+        "AF_NETLINK"
+      ];
     };
   };
 }