nyancat/flake
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

nixos: apply more hardening

Browse source
This commit is contained in:
Guanran Wang 2024-02-05 13:42:06 +08:00
parent 099fe0b60c
commit ac8475706e
Signed by: nyancat
SSH key fingerprint: SHA256:8oWGKciPALWut/6WA27oFKofX+6Wtc0gQnsefXLQx/8
2 changed files with 217 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
nixos/profiles/common/core/hardening/default.nix
View file

@ -4,6 +4,7 @@
# ref: https://madaidans-insecurities.github.io/guides/linux-hardening.html
imports = [
./sysctl.nix
./systemd.nix
];
environment.etc.machine-id.text = "b08dfa6083e7567a1921a715000001fb"; # whonix id
@ -14,8 +15,12 @@
boot.blacklistedKernelModules = [
# Obscure network protocols
"ax25"
"dccp"
"netrom"
"rds"
"rose"
"stcp"
"tipc"
# Old or rare or insufficiently audited filesystems
"adfs"

212
nixos/profiles/common/core/hardening/systemd.nix Normal file
View file

@ -0,0 +1,212 @@
# Stolen from https://github.com/CPlusPatch/infra/blob/main/traits/hardening/systemd.nix
{
systemd.services = {
NetworkManager.serviceConfig = {
RestrictAddressFamilies = "AF_INET AF_INET6 AF_NETLINK AF_PACKET AF_UNIX";
ProtectHome = true;
ProtectSystem = "strict";
ProtectProc = "invisible";
ReadWritePaths = "/etc -/proc/sys/net -/var/lib/NetworkManager/";
PrivateTmp = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
CapabilityBoundingSet = "~CAP_SYS_ADMIN CAP_SETUID CAP_SETGID CAP_SYS_CHROOT";
NoNewPrivileges = true;
ProtectHostname = true;
ProtectClock = true;
ProtectControlGroups = true;
RestrictNamespaces = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallFilter = "@system-service @privileged";
SystemCallArchitectures = "native";
};
bluetooth.serviceConfig = {
RestrictAddressFamilies = "AF_UNIX AF_BLUETOOTH";
IPAddressDeny = "any";
ProtectSystem = "strict";
ReadWritePaths = "-/var/lib/bluetooth -/run/systemd/unit-root";
PrivateTmp = true;
ProtectProc = "ptraceable";
ProcSubset = "pid";
DevicePolicy = "closed";
DeviceAllow = ["/dev/rfkill rw" "/dev/uinput rw"];
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
NoNewPrivileges = true;
ProtectHostname = true;
ProtectClock = true;
ProtectControlGroups = true;
RestrictNamespaces = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallFilter = ["@system-service" "~@resources @privileged"];
SystemCallArchitectures = "native";
};
cups.serviceConfig = {
RestrictAddressFamilies = "AF_INET AF_INET6 AF_NETLINK AF_UNIX";
IPAddressDeny = "any";
IPAddressAllow = ["localhost" "192.168.1.0/8" "172.16.1.0/8" "10.0.1.0/8"];
ProtectHome = true;
ProtectSystem = "strict";
ReadWritePaths = "/etc/cups /etc/printcap /var/cache/cups /var/spool/cups";
LogsDirectory = "cups";
RuntimeDirectory = "cups";
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
CapabilityBoundingSet = "CAP_CHOWN CAP_AUDIT_WRITE CAP_DAC_OVERRIDE CAP_FSETID CAP_KILL CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID";
ProtectHostname = true;
ProtectClock = true;
ProtectControlGroups = true;
RestrictNamespaces = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallFilter = "@system-service";
SystemCallArchitectures = "native";
};
systemd-networkd.serviceConfig = {
After = "apparmor.service systemd-udevd.service network-pre.target systemd-sysusers.service systemd-sysctl.service";
ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
RestrictNamespaces = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
};
auditd.serviceConfig = {
ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
SystemCallFilter = "~@clock @cpu-emulation @debug @obsolete @module @mount @raw-io @reboot @swap";
ProtectControlGroups = true;
RestrictNamespaces = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
};
NetworkManager-dispatcher.serviceConfig = {
ProtectHome = true;
ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
SystemCallFilter = "~@clock @cpu-emulation @debug @obsolete @module @mount @raw-io @reboot @swap";
ProtectControlGroups = true;
RestrictNamespaces = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
};
emergency.serviceConfig = {
ProtectHome = true;
ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
SystemCallFilter = "~@clock @cpu-emulation @obsolete @module @raw-io @swap";
ProtectControlGroups = true;
RestrictNamespaces = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
};
logrotate.serviceConfig = {
ProtectHome = true;
ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
SystemCallFilter = "~@clock @cpu-emulation @debug @obsolete @module @mount @raw-io @reboot @swap";
ProtectControlGroups = true;
RestrictNamespaces = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
};
power-profiles-daemon.serviceConfig = {
ProtectHome = true;
ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
SystemCallFilter = "~@clock @cpu-emulation @debug @obsolete @module @mount @swap";
ProtectControlGroups = true;
RestrictNamespaces = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
};
ncsd.serviceConfig = {
ProtectHome = true;
ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
SystemCallFilter = "~@clock @cpu-emulation @debug @obsolete @module @mount @raw-io @reboot @swap";
ProtectControlGroups = true;
RestrictNamespaces = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
};
reload-systemd-vconsole-setup.serviceConfig = {
ProtectHome = true;
ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
SystemCallFilter = "~@clock @cpu-emulation @debug @obsolete @module @mount @raw-io @reboot @swap";
ProtectControlGroups = true;
RestrictNamespaces = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
};
rescue.serviceConfig = {
ProtectHome = true;
ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
SystemCallFilter = "~@clock @cpu-emulation @debug @obsolete @module @mount @raw-io @reboot @swap";
ProtectControlGroups = true;
RestrictNamespaces = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
};
};
}