Alertonotify hardening part 1

2025-05-18 15:08:26 +02:00
parent fe2e87658a
commit 8e0b97c9e0
1 changed files with 12 additions and 0 deletions
--- a/services/monitoring/alerttonotify.nix
+++ b/services/monitoring/alerttonotify.nix
@@ -19,6 +19,18 @@
    serviceConfig = {
      Type = "exec";
      ExecStart = "${pkgs.alerttonotify}/bin/alerttonotify";
+      DynamicUser = "yes";
+      CapabilityBoundingSet = "";
+      RestrictAddressFamilies = "AF_INET AF_INET6";
+      SystemCallArchitectures = "native";
+      LockPersonality = "yes";
+      MemoryDenyWriteExecute = "yes";
+      PrivateDevices = "yes";
+      PrivateUsers = "yes";
+      ProtectControlGroups = "yes";
+      ProtectHome = "yes";
+      ProtectHostname = "yes";
+      RestrictNamespace = "yes";
    };
  };
 }