diff options
| author | Alexandre Iooss <erdnaxe@crans.org> | 2021-08-15 13:55:43 +0200 |
|---|---|---|
| committer | Alexandre Iooss <erdnaxe@crans.org> | 2021-09-08 10:43:46 +0200 |
| commit | bbc51efb464211fa141f142ae3b7a667b4f41ae2 (patch) | |
| tree | bf0280ba5c57fda1a789a9be9ca94fa07c2f0945 /nixos/modules/services/monitoring/grafana.nix | |
| parent | c8f5c0a8beb4a1ac79deae607ee4ac1003c1059f (diff) | |
| download | nixpkgs-bbc51efb464211fa141f142ae3b7a667b4f41ae2.tar nixpkgs-bbc51efb464211fa141f142ae3b7a667b4f41ae2.tar.gz nixpkgs-bbc51efb464211fa141f142ae3b7a667b4f41ae2.tar.bz2 nixpkgs-bbc51efb464211fa141f142ae3b7a667b4f41ae2.tar.lz nixpkgs-bbc51efb464211fa141f142ae3b7a667b4f41ae2.tar.xz nixpkgs-bbc51efb464211fa141f142ae3b7a667b4f41ae2.tar.zst nixpkgs-bbc51efb464211fa141f142ae3b7a667b4f41ae2.zip | |
nixos/grafana: systemd unit hardening
Diffstat (limited to 'nixos/modules/services/monitoring/grafana.nix')
| -rw-r--r-- | nixos/modules/services/monitoring/grafana.nix | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix index fb67bbfb842..d46e38e82af 100644 --- a/nixos/modules/services/monitoring/grafana.nix +++ b/nixos/modules/services/monitoring/grafana.nix @@ -675,6 +675,33 @@ in { User = "grafana"; RuntimeDirectory = "grafana"; RuntimeDirectoryMode = "0755"; + # Hardening + CapabilityBoundingSet = [ "" ]; + DeviceAllow = [ "" ]; + LockPersonality = true; + MemoryDenyWriteExecute = true; + NoNewPrivileges = true; + PrivateDevices = true; + PrivateTmp = true; + PrivateUsers = true; + ProcSubset = "pid"; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectProc = "invisible"; + ProtectSystem = "full"; + RemoveIPC = true; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ]; + RestrictNamespaces = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + SystemCallArchitectures = "native"; + SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ]; + UMask = "0027"; }; preStart = '' ln -fs ${cfg.package}/share/grafana/conf ${cfg.dataDir} |