nixos/systemd/shutdown: stricter sandboxing

Copied the config from archlinux's mkinitcpio: 318ae30f6a/systemd/mkinitcpio-generate-shutdown-ramfs.service
2025-10-10 23:18:06 +02:00
parent 7fe74bb833
commit b9d0fd8be4
1 changed files with 13 additions and 1 deletions
--- a/nixos/modules/system/boot/systemd/shutdown.nix
+++ b/nixos/modules/system/boot/systemd/shutdown.nix
@@ -71,9 +71,21 @@ in

      serviceConfig = {
        Type = "oneshot";
+        ExecStart = "${pkgs.makeInitrdNGTool}/bin/make-initrd-ng ${ramfsContents} /run/initramfs";
+
+        # Sandboxing
        ProtectSystem = "strict";
        ReadWritePaths = "/run/initramfs";
-        ExecStart = "${pkgs.makeInitrdNGTool}/bin/make-initrd-ng ${ramfsContents} /run/initramfs";
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectClock = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        PrivateNetwork = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
      };
    };
  };