colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/asf: update hardening options to match upstream

Browse Source
This commit is contained in:
Sandro Jäckel 2023-10-18 18:01:35 +02:00 committed by Yaya
parent be1484aa1a
commit b11e3eb7d1
1 changed files with 17 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
nixos/modules/services/games/asf.nix
View File

@ -187,29 +187,41 @@ in
Group = "asf"; Group = "asf";
WorkingDirectory = cfg.dataDir; WorkingDirectory = cfg.dataDir;
Type = "simple"; Type = "simple";
ExecStart = "${cfg.package}/bin/ArchiSteamFarm --path ${cfg.dataDir} --process-required --no-restart --service --no-config-migrate"; ExecStart = "${lib.getExe cfg.package} --no-restart --process-required --service --system-required --path ${cfg.dataDir}";
Restart = "always"; Restart = "always";
# mostly copied from the default systemd service # copied from the default systemd service at
PrivateTmp = true; # https://github.com/JustArchiNET/ArchiSteamFarm/blob/main/ArchiSteamFarm/overlay/variant-base/linux/ArchiSteamFarm%40.service
CapabilityBoundingSet = "";
DevicePolicy = "closed";
LockPersonality = true; LockPersonality = true;
NoNewPrivileges = true;
PrivateDevices = true; PrivateDevices = true;
PrivateIPC = true; PrivateIPC = true;
PrivateMounts = true; PrivateMounts = true;
PrivateTmp = true; # instead of rw /tmp
PrivateUsers = true; PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true; ProtectClock = true;
ProtectControlGroups = true; ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true; ProtectHostname = true;
ProtectKernelLogs = true; ProtectKernelLogs = true;
ProtectKernelModules = true; ProtectKernelModules = true;
ProtectKernelTunables = true; ProtectKernelTunables = true;
ProtectProc = "invisible"; ProtectProc = "invisible";
ProtectSystem = "full"; ProtectSystem = "strict";
RemoveIPC = true; RemoveIPC = true;
RestrictAddressFamilies = "AF_INET AF_INET6"; RestrictAddressFamilies = "AF_INET AF_INET6 AF_NETLINK AF_UNIX";
RestrictNamespaces = true; RestrictNamespaces = true;
RestrictRealtime = true; RestrictRealtime = true;
RestrictSUIDSGID = true; RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
UMask = "0077";
# we luckily already have systemd v247+
SecureBits = "noroot-locked";
SystemCallFilter = [ "@system-service" "~@privileged" ];
} }
]; ];