Skip to content

Commit 129cf76

Browse files
theorderingmachinetheorderingmachine
committed
systemd: protect against services finding another other process
1 parent 23bccd5 commit 129cf76

File tree

8 files changed

+129
-8
lines changed

8 files changed

+129
-8
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ versioning is done in a continuous fashion without worries of breaking changes.
66

77
## patches
88

9+
- `systemd`: protect against services finding another other process 2026-04-04
910
- `nix`: import language servers and formatted linter from upstream 2026-04-04
1011
- `vhs`: record terminal demos with tapes that share in caring gifs 2026-03-30
1112
- `pnpm`: install the performant node package manager for packaging 2026-03-29

‎machines/tom/services/soft-serve/default.nix‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,23 @@ in
3030
systemd.services.soft-serve.serviceConfig = {
3131
DynamicUser = lib.mkForce false;
3232
ExecStart = lib.mkForce "${lib.getExe cfg.package} serve --sync-hooks";
33+
Group = "git";
34+
LockPersonality = true;
35+
NoNewPrivileges = true;
36+
PrivateDevices = true;
37+
PrivateTmp = true;
38+
ProtectClock = true;
39+
ProtectControlGroups = true;
40+
ProtectHome = true;
41+
ProtectHostname = true;
42+
ProtectKernelLogs = true;
43+
ProtectKernelModules = true;
44+
ProtectKernelTunables = true;
45+
ProtectSystem = "strict";
46+
RestrictRealtime = true;
47+
RestrictSUIDSGID = true;
48+
SystemCallArchitectures = "native";
3349
UMask = lib.mkForce "0022";
3450
User = "git";
35-
Group = "git";
3651
};
3752
}

‎machines/tom/systemd/services/blog/default.nix‎

Lines changed: 33 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,25 @@
2020
serviceConfig = {
2121
CacheDirectory = "blog";
2222
ExecStart = "${pkgs.nix}/bin/nix run github:zimeg/blog --refresh";
23+
Group = "blog";
24+
LockPersonality = true;
25+
NoNewPrivileges = true;
26+
PrivateDevices = true;
27+
PrivateTmp = true;
28+
ProtectClock = true;
29+
ProtectControlGroups = true;
30+
ProtectHome = true;
31+
ProtectHostname = true;
32+
ProtectKernelLogs = true;
33+
ProtectKernelModules = true;
34+
ProtectKernelTunables = true;
35+
ProtectSystem = "strict";
2336
Restart = "always";
24-
RestartSec = 2;
37+
RestartSec = 120;
38+
RestrictRealtime = true;
39+
RestrictSUIDSGID = true;
40+
SystemCallArchitectures = "native";
2541
User = "blog";
26-
Group = "blog";
2742
};
2843
};
2944
"blog:preview" = {
@@ -41,8 +56,23 @@
4156
serviceConfig = {
4257
CacheDirectory = "blog";
4358
ExecStart = "${pkgs.nix}/bin/nix run github:zimeg/blog/dev --refresh -- --port 3000";
44-
User = "blog";
4559
Group = "blog";
60+
LockPersonality = true;
61+
NoNewPrivileges = true;
62+
PrivateDevices = true;
63+
PrivateTmp = true;
64+
ProtectClock = true;
65+
ProtectControlGroups = true;
66+
ProtectHome = true;
67+
ProtectHostname = true;
68+
ProtectKernelLogs = true;
69+
ProtectKernelModules = true;
70+
ProtectKernelTunables = true;
71+
ProtectSystem = "strict";
72+
RestrictRealtime = true;
73+
RestrictSUIDSGID = true;
74+
SystemCallArchitectures = "native";
75+
User = "blog";
4676
};
4777
};
4878
};

‎machines/tom/systemd/services/endpoints/default.nix‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,25 @@
2121
serviceConfig = {
2222
CacheDirectory = "endpoints";
2323
ExecStart = "${pkgs.nix}/bin/nix run github:zimeg/endpoints --refresh";
24+
Group = "endpoints";
25+
LockPersonality = true;
26+
NoNewPrivileges = true;
27+
PrivateDevices = true;
28+
PrivateTmp = true;
29+
ProtectClock = true;
30+
ProtectControlGroups = true;
31+
ProtectHome = true;
32+
ProtectHostname = true;
33+
ProtectKernelLogs = true;
34+
ProtectKernelModules = true;
35+
ProtectKernelTunables = true;
36+
ProtectSystem = "strict";
2437
Restart = "always";
25-
RestartSec = 2;
38+
RestartSec = 120;
39+
RestrictRealtime = true;
40+
RestrictSUIDSGID = true;
41+
SystemCallArchitectures = "native";
2642
User = "endpoints";
27-
Group = "endpoints";
2843
};
2944
};
3045
};

‎machines/tom/systemd/services/quintus/default.nix‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,11 +20,26 @@
2020
serviceConfig = {
2121
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
2222
CacheDirectory = "quintus";
23+
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
2324
ExecStart = "${pkgs.nix}/bin/nix run github:zimeg/quintus --refresh";
25+
Group = "quintus";
26+
LockPersonality = true;
27+
PrivateDevices = true;
28+
PrivateTmp = true;
29+
ProtectClock = true;
30+
ProtectControlGroups = true;
31+
ProtectHome = true;
32+
ProtectHostname = true;
33+
ProtectKernelLogs = true;
34+
ProtectKernelModules = true;
35+
ProtectKernelTunables = true;
36+
ProtectSystem = "strict";
2437
Restart = "always";
25-
RestartSec = 2;
38+
RestartSec = 120;
39+
RestrictRealtime = true;
40+
RestrictSUIDSGID = true;
41+
SystemCallArchitectures = "native";
2642
User = "quintus";
27-
Group = "quintus";
2843
};
2944
};
3045
};

‎machines/tom/systemd/services/slack/snaek/default.nix‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,24 @@
2222
CacheDirectory = "snaek";
2323
EnvironmentFile = config.sops.secrets."slack/snaek".path;
2424
ExecStart = "${pkgs.nix}/bin/nix run github:zimeg/slacks/snaek --refresh";
25+
LockPersonality = true;
26+
NoNewPrivileges = true;
27+
PrivateDevices = true;
28+
PrivateTmp = true;
29+
ProtectClock = true;
30+
ProtectControlGroups = true;
31+
ProtectHome = true;
32+
ProtectHostname = true;
33+
ProtectKernelLogs = true;
34+
ProtectKernelModules = true;
35+
ProtectKernelTunables = true;
36+
ProtectSystem = "strict";
2537
Restart = "always";
2638
RestartSec = 120;
39+
RestrictRealtime = true;
40+
RestrictSUIDSGID = true;
2741
StateDirectory = "slack/snaek";
42+
SystemCallArchitectures = "native";
2843
User = "snaek";
2944
WorkingDirectory = "/var/lib/slack/snaek";
3045
};

‎machines/tom/systemd/services/slack/tails/default.nix‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,24 @@
2020
CacheDirectory = "tails";
2121
EnvironmentFile = config.sops.secrets."slack/tails".path;
2222
ExecStart = "${pkgs.nix}/bin/nix run github:zimeg/slacks/tails --refresh";
23+
LockPersonality = true;
24+
NoNewPrivileges = true;
25+
PrivateDevices = true;
26+
PrivateTmp = true;
27+
ProtectClock = true;
28+
ProtectControlGroups = true;
29+
ProtectHome = true;
30+
ProtectHostname = true;
31+
ProtectKernelLogs = true;
32+
ProtectKernelModules = true;
33+
ProtectKernelTunables = true;
34+
ProtectSystem = "strict";
2335
Restart = "always";
2436
RestartSec = 120;
37+
RestrictRealtime = true;
38+
RestrictSUIDSGID = true;
2539
StateDirectory = "slack/tails";
40+
SystemCallArchitectures = "native";
2641
User = "tails";
2742
WorkingDirectory = "/var/lib/slack/tails";
2843
};

‎machines/tom/systemd/services/slack/todos/default.nix‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,24 @@
1919
CacheDirectory = "todos";
2020
EnvironmentFile = config.sops.secrets."slack/todos".path;
2121
ExecStart = "${pkgs.nix}/bin/nix run github:zimeg/slacks/todos#server --refresh";
22+
LockPersonality = true;
23+
NoNewPrivileges = true;
24+
PrivateDevices = true;
25+
PrivateTmp = true;
26+
ProtectClock = true;
27+
ProtectControlGroups = true;
28+
ProtectHome = true;
29+
ProtectHostname = true;
30+
ProtectKernelLogs = true;
31+
ProtectKernelModules = true;
32+
ProtectKernelTunables = true;
33+
ProtectSystem = "strict";
2234
Restart = "always";
2335
RestartSec = 120;
36+
RestrictRealtime = true;
37+
RestrictSUIDSGID = true;
2438
StateDirectory = "slack/todos";
39+
SystemCallArchitectures = "native";
2540
User = "todos";
2641
WorkingDirectory = "/var/lib/slack/todos";
2742
};

0 commit comments

Comments
 (0)