feat: harden some systemd units

This commit is contained in:
Nydragon 2024-11-27 03:04:43 +01:00
parent 1f43ca5d2c
commit 7e524df309
Signed by: nydragon
SSH key fingerprint: SHA256:WcjW5NJPQ8Dx4uQDmoIlVPLWE27Od3fxoe0IUvuoPHE
9 changed files with 106 additions and 27 deletions

View file

@ -1,16 +1,25 @@
{ lib, config, ... }: {
pkgs,
lib,
osConfig,
...
}:
let let
package = config.services.cliphist.package; cfg = osConfig.modules.services.cliphist;
exec = pkgs.writers.writeBash "rofi-cliphist" {
makeWrapperArgs = [
"--prefix"
"PATH"
":"
"${lib.makeBinPath [ pkgs.cliphist ]}"
];
} "cliphist-rofi-img";
in in
{ {
config = lib.mkIf config.services.cliphist.enable { config = lib.mkIf cfg.enable {
programs.rofi = { programs.rofi = {
enable = true; enable = true;
extraConfig = { extraConfig.modes = [ "clipboard:${exec}" ];
modes = [
"clipboard:${lib.my.checkPath package "cliphist-rofi-img"}"
];
};
}; };
}; };
} }

View file

@ -1,4 +1,10 @@
{ self, pkgs, ... }: {
self,
lib,
pkgs,
config,
...
}:
{ {
systemd.user.services.swww = { systemd.user.services.swww = {
Install.WantedBy = [ "graphical-session.target" ]; Install.WantedBy = [ "graphical-session.target" ];
@ -10,22 +16,17 @@
Service = { Service = {
Type = "simple"; Type = "simple";
ExecStart = "${pkgs.swww}/bin/swww-daemon"; ExecStart = "${pkgs.swww}/bin/swww-daemon";
ExecStartPost = "${pkgs.swww}/bin/swww img ${self + "/assets/landscape-pink-pastel.jpg"} -t wipe";
Restart = "on-failure"; Restart = "on-failure";
}; ProtectHome = "tmpfs";
}; BindPaths = "/run/user /home/${config.home.username}/.cache/swww";
ProtectProc = "noaccess";
systemd.user.services.swww-set-background = { RestrictNamespaces = true;
Install.WantedBy = [ "graphical-session.target" ]; CapabilityBoundingSet = "";
PrivateUsers = true;
Unit = { RestrictAddressFamilies = "AF_UNIX";
Wants = [ "graphical-session.target" ]; } // lib.my.systemdHardening;
After = [ "graphical-session.target" ];
};
Service = {
Type = "oneshot";
ExecStart = "${pkgs.swww}/bin/swww img ${self + "/assets/landscape-pink-pastel.jpg"} -t wipe";
};
}; };
home.packages = [ pkgs.swww ]; home.packages = [ pkgs.swww ];

View file

@ -38,6 +38,7 @@
}; };
services = { services = {
cliphist.enable = true;
nysh.enable = true; nysh.enable = true;
tailscale = { tailscale = {
enable = true; enable = true;
@ -60,7 +61,10 @@
}; };
media.enableAll = true; media.enableAll = true;
}; };
documentation = {
doc.enable = false;
man.generateCaches = false;
};
services = { services = {
displayManager.sddm.enable = true; displayManager.sddm.enable = true;
dbus.enable = true; dbus.enable = true;

View file

@ -31,7 +31,6 @@
services = { services = {
blueman-applet.enable = true; blueman-applet.enable = true;
syncthing.enable = true; syncthing.enable = true;
cliphist.enable = true;
}; };
home = { home = {

View file

@ -24,6 +24,7 @@
}; };
services = { services = {
cliphist.enable = true;
nysh.enable = true; nysh.enable = true;
tailscale = { tailscale = {
enable = true; enable = true;

View file

@ -40,7 +40,6 @@
services = { services = {
blueman-applet.enable = true; blueman-applet.enable = true;
syncthing.enable = true; syncthing.enable = true;
cliphist.enable = true;
}; };
home = { home = {

View file

@ -0,0 +1,44 @@
{
lib,
config,
pkgs,
...
}:
let
inherit (lib) mkEnableOption mkIf;
cfg = config.modules.services.cliphist;
in
{
options.modules.services.cliphist = {
enable = mkEnableOption "cliphist, a clipboard history manager for wayland";
package = lib.mkPackageOption pkgs "cliphist" { };
extraOptions = lib.mkOption {
type = with lib.types; listOf str;
default = [
"-max-items"
"250"
];
description = ''
Flags to append to the cliphist command.
'';
apply = lib.escapeShellArgs;
};
};
config = mkIf cfg.enable {
systemd.user.services.cliphist = {
description = "Clipboard management daemon";
partOf = [ "graphical-session.target" ];
wantedBy = [ "graphical-session.target" ];
serviceConfig = {
Type = "simple";
ExecStart = "${pkgs.wl-clipboard}/bin/wl-paste --watch ${cfg.package}/bin/cliphist ${cfg.extraOptions} store";
Restart = "on-failure";
} // lib.my.systemdHardening;
postStop = "${cfg.package}/bin/cliphist wipe";
};
};
}

View file

@ -3,5 +3,6 @@
./nysh.nix ./nysh.nix
./tailscale.nix ./tailscale.nix
./rsync-backup ./rsync-backup
./cliphist.nix
]; ];
} }

View file

@ -8,6 +8,27 @@ let
inherit (lib) mkOption; inherit (lib) mkOption;
in in
{ {
systemdHardening = {
IPAddressDeny = "any";
NoNewPrivileges = true;
ProtectSystem = "full";
PrivateDevices = true;
ProtectKernelTunables = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
MemoryDenyWriteExecute = true;
PrivateTmp = true;
LockPersonality = true;
RestrictRealtime = true;
DevicePolicy = "closed";
ProtectClock = true;
PrivateNetwork = true;
ProtectControlGroups = true;
SystemCallArchitectures = "native";
};
# Verify the existence of a binary inside of a derivation. # Verify the existence of a binary inside of a derivation.
# Returns the path to the binary or throws. # Returns the path to the binary or throws.
checkPath = checkPath =