All modules: ProtectSystem = strict

Add ReadWritePaths in all modules, except lnd which has ProtectSystem =
full.

modules/bitcoind.nix

@@ -286,6 +286,7 @@ in {
         ExecStart = "${cfg.package}/bin/bitcoind -datadir='${cfg.dataDir}'";
         Restart = "on-failure";
         UMask = mkIf cfg.dataDirReadableByGroup "0027";
+        ReadWritePaths = "${cfg.dataDir}";
       } // (if cfg.enforceTor
             then nix-bitcoin-services.allowTor
             else nix-bitcoin-services.allowAnyIP)
@@ -317,6 +318,7 @@ in {
       serviceConfig = nix-bitcoin-services.defaultHardening // {
         User = "${cfg.user}";
         Group = "${cfg.group}";
+        ReadWritePaths = "${cfg.dataDir}";
       } // nix-bitcoin-services.allowTor;
     };
 

modules/clightning.nix

@@ -102,6 +102,7 @@ in {
         User = "clightning";
         Restart = "on-failure";
         RestartSec = "10s";
+        ReadWritePaths = "${cfg.dataDir}";
       } // (if cfg.enforceTor
           then nix-bitcoin-services.allowTor
           else nix-bitcoin-services.allowAnyIP

modules/electrs.nix

@@ -97,6 +97,7 @@ in {
         Group = cfg.group;
         Restart = "on-failure";
         RestartSec = "10s";
+        ReadWritePaths = "${cfg.dataDir} ${if cfg.high-memory then "${config.services.bitcoind.dataDir}" else ""}";
       } // (if cfg.enforceTor
           then nix-bitcoin-services.allowTor
           else nix-bitcoin-services.allowAnyIP

modules/lightning-charge.nix

@@ -58,6 +58,7 @@ in {
           User = user;
           Restart = "on-failure";
           RestartSec = "10s";
+          ReadWritePaths = "${cfg.dataDir}";
       } // nix-bitcoin-services.nodejs
         // nix-bitcoin-services.allowTor;
     };

modules/liquid.nix

@@ -224,6 +224,7 @@ in {
         ExecStart = "${pkgs.nix-bitcoin.elementsd}/bin/elementsd ${cmdlineOptions}";
         PIDFile = "${pidFile}";
         Restart = "on-failure";
+        ReadWritePaths = "${cfg.dataDir}";
       } // (if cfg.enforceTor
           then nix-bitcoin-services.allowTor
           else nix-bitcoin-services.allowAnyIP

modules/lnd.nix

@@ -106,6 +106,7 @@ in {
         User = "lnd";
         Restart = "on-failure";
         RestartSec = "10s";
+        ProtectSystem = "full"; # ToDo: Make more restrictive
       } // (if cfg.enforceTor
           then nix-bitcoin-services.allowTor
           else nix-bitcoin-services.allowAnyIP

modules/nix-bitcoin-services.nix

@@ -7,7 +7,7 @@ with lib;
 {
   defaultHardening = {
       PrivateTmp = "true";
-      ProtectSystem = "full";
+      ProtectSystem = "strict";
       ProtectHome = "true";
       NoNewPrivileges = "true";
       PrivateDevices = "true";

modules/nix-bitcoin-webindex.nix

@@ -92,6 +92,7 @@ in {
         Restart = "on-failure";
         RestartSec = "10s";
         PrivateNetwork = "true"; # This service needs no network access
+        ReadWritePaths = "/var/www";
         CapabilityBoundingSet = "CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_SYS_ADMIN CAP_CHOWN CAP_FSETID CAP_SETFCAP CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_IPC_OWNER";
       } // (if cfg.enforceTor
           then nix-bitcoin-services.allowTor

modules/onion-chef.nix

@@ -81,6 +81,7 @@ in {
         Type = "oneshot";
         RemainAfterExit = true;
         PrivateNetwork = "true"; # This service needs no network access
+        ReadWritePaths = "${dataDir}";
         CapabilityBoundingSet = "CAP_CHOWN CAP_FSETID CAP_SETFCAP CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_IPC_OWNER";
       };
     };

modules/spark-wallet.nix

@@ -75,6 +75,7 @@ in {
         User = "spark-wallet";
         Restart = "on-failure";
         RestartSec = "10s";
+        ReadWritePaths = "/var/lib/onion-chef";
       } // nix-bitcoin-services.nodejs
         // nix-bitcoin-services.allowTor;
     };