daniel/dotfiles
1
0
Fork 0
Code Activity Actions

anonymous-overflow: Enable some hardening flags

Browse source
This commit is contained in:
Daniel Kempkens 2023-02-16 00:43:22 +01:00
parent ce177c6f9d
commit c9cb1639b4
Signed by: daniel
SSH key fingerprint: SHA256:Ks/MyhQYcPRQiwMKLAKquWCdCPe3JXlb1WttgnAoSeM
1 changed files with 19 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
system/nixos/anonymous-overflow.nix
View file

@ -16,6 +16,25 @@ in
ExecStart = "${anonymous-overflow-pkg}/bin/anonymousoverflow";
Restart = "on-failure";
RestartSec = "5s";
# Hardening
CapabilityBoundingSet = [ "" ];
DeviceAllow = [ "" ];
LockPersonality = true;
MemoryDenyWriteExecute = true;
PrivateDevices = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
};
};