services: improve default hardening

2021-01-30 23:08:38 +01:00 · 2021-01-30 23:08:38 +01:00 · d56a363d3d
parent 3b938a909f
commit d56a363d3d
1 changed files with 5 additions and 0 deletions
--- a/pkgs/lib.nix
+++ b/pkgs/lib.nix
@ -15,6 +15,11 @@ let self = {
      MemoryDenyWriteExecute = "true";
      ProtectKernelTunables = "true";
      ProtectKernelModules = "true";
+      ProtectKernelLogs = "true";
+      ProtectClock = "true";
+      # Test and enable these when systemd v247 is available
+      # ProtectProc = "invisible";
+      # ProcSubset = "pid";
      ProtectControlGroups = "true";
      RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
      RestrictNamespaces = "true";