nyancat/flake
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

nixos: harden tailscaled

Browse source
This commit is contained in:
Guanran Wang 2024-03-23 16:29:09 +08:00
parent 46c2d1589e
commit 9049baccd1
Signed by: nyancat
SSH key fingerprint: SHA256:8oWGKciPALWut/6WA27oFKofX+6Wtc0gQnsefXLQx/8
1 changed files with 34 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

35
nixos/profiles/common/core/hardening/systemd.nix
View file

@ -1,4 +1,5 @@
# Stolen from https://github.com/CPlusPatch/infra/blob/main/traits/hardening/systemd.nix
# https://github.com/CPlusPatch/infra/blob/fe96d6cc9a71c81fc5326cd1b1115ed8ae8f0073/traits/hardening/systemd.nix
# https://github.com/accelbread/config-flake/blob/d69a8b2d636b322fa1e8ba853bfbf23f9a858e38/nix/nixosModules/tailscale.nix
{
systemd.services = {
NetworkManager.serviceConfig = {
@ -208,5 +209,37 @@
RestrictRealtime = true;
RestrictSUIDSGID = true;
};
tailscaled.environment.TS_DEBUG_FIREWALL_MODE = "nftables"; # iptables requires root
tailscaled.serviceConfig = {
AmbientCapabilities = ["CAP_NET_RAW" "CAP_NET_ADMIN"];
CapabilityBoundingSet = ["CAP_NET_RAW" "CAP_NET_ADMIN"];
DeviceAllow = "/dev/net/tun rw";
DevicePolicy = "closed";
DynamicUser = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateIPC = true;
PrivateMounts = true;
PrivateTmp = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
RemoveIPC = true;
RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6" "AF_NETLINK"];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = ["@system-service" "~@privileged"];
UMask = 077;
};
};
}