Commit a9cd681b authored by liberodark's avatar liberodark Committed by Masum Reza
Browse files

nixos/ntpd-rs: hardening

parent 5db8ee9d

nixos/modules/services/networking/ntp/ntpd-rs.nix

+81 −0
Original line number Diff line number Diff line
@@ -90,6 +90,49 @@ in 
          ""

          "${lib.makeBinPath [ cfg.package ]}/ntp-daemon --config=${validateConfig configFile}"

        ];



        CapabilityBoundingSet = [

          "CAP_SYS_TIME"

          "CAP_NET_BIND_SERVICE"

        ];

        AmbientCapabilities = [

          "CAP_SYS_TIME"

          "CAP_NET_BIND_SERVICE"

        ];

        LimitCORE = 0;

        LimitNOFILE = 65535;

        LockPersonality = true;

        MemorySwapMax = 0;

        MemoryZSwapMax = 0;

        PrivateTmp = true;

        ProcSubset = "pid";

        ProtectControlGroups = true;

        ProtectHome = true;

        ProtectHostname = true;

        ProtectKernelLogs = true;

        ProtectKernelModules = true;

        ProtectKernelTunables = true;

        ProtectProc = "invisible";

        ProtectSystem = "strict";

        Restart = "on-failure";

        RestartSec = "10s";

        RestrictAddressFamilies = [

          "AF_INET"

          "AF_INET6"

          "AF_UNIX"

          "AF_NETLINK"

        ];

        RestrictNamespaces = true;

        RestrictRealtime = true;

        SystemCallArchitectures = "native";

        SystemCallFilter = [

          "@system-service"

          "@resources"

          "@network-io"

          "@clock"

        ];

        NoNewPrivileges = true;

        UMask = "0077";

      };

    };
@@ -103,6 +146,44 @@ in 
          ""

          "${lib.makeBinPath [ cfg.package ]}/ntp-metrics-exporter --config=${validateConfig configFile}"

        ];



        CapabilityBoundingSet = [ ];

        LimitCORE = 0;

        LimitNOFILE = 65535;

        LockPersonality = true;

        MemorySwapMax = 0;

        MemoryZSwapMax = 0;

        PrivateTmp = true;

        ProcSubset = "pid";

        ProtectClock = true;

        ProtectControlGroups = true;

        ProtectHome = true;

        ProtectHostname = true;

        ProtectKernelLogs = true;

        ProtectKernelModules = true;

        ProtectKernelTunables = true;

        ProtectProc = "invisible";

        ProtectSystem = "strict";

        PrivateDevices = true;

        RestrictSUIDSGID = true;

        RemoveIPC = true;

        RestrictAddressFamilies = [

          "AF_INET"

          "AF_INET6"

          "AF_UNIX"

        ];

        RestrictNamespaces = true;

        RestrictRealtime = true;

        SystemCallArchitectures = "native";

        SystemCallFilter = [

          "@system-service"

          "@network-io"

          "~@privileged"

          "~@resources"

          "~@mount"

        ];

        NoNewPrivileges = true;

        UMask = "0077";

      };

    };

  };