greetd.service hardening

- Hardened service config for greetd - Exposure level after hardening: 3.5 Signed-off-by: Ganga Ram <[email protected]>
tiiuae · Dec 17, 2024 · 469e354 · 469e354
1 parent 340ac3a
commit 469e354
Showing 1 changed file with 89 additions and 0 deletions.
diff --git a/modules/common/systemd/hardened-configs/common/greetd.nix b/modules/common/systemd/hardened-configs/common/greetd.nix
@@ -0,0 +1,89 @@
+# Copyright 2022-2024 TII (SSRC) and the Ghaf contributors
+# SPDX-License-Identifier: Apache-2.0
+#
+{
+  ##############
+  # Networking #
+  ##############
+  IPAccounting = true;
+  IPAddressDeny = "any";
+  RestrictAddressFamilies = [
+    "~AF_PACKET"
+  ];
+
+  ###############
+  # File system #
+  ###############
+
+  ProtectSystem = "full";
+  ProtectProc = "noaccess";
+  ReadWritePaths = [
+    "/run"
+    "/var/"
+    "/dev/"
+  ];
+
+  PrivateMounts = true;
+  ProcSubset = "all";
+
+  ##########
+  # Kernel #
+  ##########
+
+  ProtectKernelTunables = true;
+  ProtectKernelModules = true;
+  ProtectKernelLogs = true;
+
+  ########
+  # Misc #
+  ########
+  NoNewPrivileges = true;
+  UMask = 77;
+  ProtectHostname = true;
+  ProtectClock = true;
+  ProtectControlGroups = true;
+  RestrictNamespaces = true;
+  LockPersonality = true;
+  MemoryDenyWriteExecute = true;
+  RestrictRealtime = true;
+  RestrictSUIDSGID = true;
+  SystemCallArchitectures = "native";
+  NotifyAccess = false;
+
+  ################
+  # Capabilities #
+  ################
+
+  CapabilityBoundingSet = [
+    "CAP_IPC_LOCK"
+    "CAP_SYS_TTY_CONFIG"
+    "CAP_SETGID"
+    "CAP_CHOWN"
+    "CAP_SETUID"
+    "CAP_IPC_OWNER"
+    "CAP_DAC_OVERRIDE"
+    "CAP_DAC_READ_SEARCH"
+  ];
+
+  ################
+  # System calls #
+  ################
+  SystemCallFilter = [
+    "@setuid"
+    "@chown"
+    "@system-service"
+    "@file-system"
+    "@basic-io"
+    "@ipc"
+    "@signal"
+    "~@clock"
+    "~@cpu-emulation"
+    "~@debug"
+    "~@module"
+    "~@mount"
+    "~@obsolete"
+    "~@raw-io"
+    "~@reboot"
+    "~@swap"
+  ];
+}