greetd.service hardening

- Hardened service config for greetd
- Exposure level after hardening: 2.5

Signed-off-by: Ganga Ram <[email protected]>

modules/common/systemd/hardened-configs/common/greetd.nix

@@ -0,0 +1,127 @@
+# Copyright 2022-2024 TII (SSRC) and the Ghaf contributors
+# SPDX-License-Identifier: Apache-2.0
+#
+{
+  ##############
+  # Networking #
+  ##############
+  PrivateNetwork = true;
+  IPAccounting = true;
+  IPAddressDeny = "any";
+  RestrictAddressFamilies = [
+    "AF_UNIX"
+    "AF_NETLINK"
+  ];
+
+  ###############
+  # File system #
+  ###############
+
+  # ProtectHome=true;
+  ProtectSystem = "full";
+  ProtectProc = "noaccess";
+  ReadWritePaths = [
+    "/run"
+    "/var/"
+  ];
+  #PrivateTmp = true;
+
+  PrivateMounts = true;
+  ProcSubset = "all";
+
+  ###################
+  # User separation #
+  ###################
+
+  # Not applicable for the service runs as root
+  # PrivateUsers = true;
+  # DynamicUser=true;
+
+  ###########
+  # Devices #
+  ###########
+
+  # PrivateDevices=true;
+  # DeviceAllow=["/dev/dri/*" "/dev/tty*" "/dev/input/*" "/dev/snd/*" "/dev/urandom"];
+
+  ##########
+  # Kernel #
+  ##########
+
+  ProtectKernelTunables = true;
+  ProtectKernelModules = true;
+  ProtectKernelLogs = true;
+
+  ########
+  # Misc #
+  ########
+
+  # KeyringMode="private";
+  NoNewPrivileges = true;
+  UMask = 77;
+  ProtectHostname = true;
+  ProtectClock = true;
+  ProtectControlGroups = true;
+  RestrictNamespaces = true;
+
+  /*
+      RestrictNamespaces=[
+     #"~user"
+     #"~pid"
+     #"~net"
+     #"~uts"
+     #"~mnt"
+     #"~cgroup"
+     #"~ipc"
+    ];
+  */
+
+  LockPersonality = true;
+  MemoryDenyWriteExecute = true;
+  RestrictRealtime = true;
+  RestrictSUIDSGID = true;
+  #RemoveIPC=true;
+  SystemCallArchitectures = "native";
+  NotifyAccess = false;
+
+  ################
+  # Capabilities #
+  ################
+
+  #AmbientCapabilities=
+  CapabilityBoundingSet = [
+    #"CAP_DAC_*"
+    "CAP_IPC_LOCK"
+    "CAP_SYS_TTY_CONFIG"
+    "CAP_SETGID"
+    "CAP_CHOWN"
+    "CAP_SETUID"
+    "CAP_IPC_OWNER"
+
+  ];
+
+  ################
+  # System calls #
+  ################
+
+  SystemCallFilter = [
+    "@setuid"
+    "@chown"
+    "@system-service"
+    "@file-system"
+    "@basic-io"
+    "@ipc"
+    "@signal"
+    "~@clock"
+    "~@cpu-emulation"
+    "~@debug"
+    "~@module"
+    "~@mount"
+    "~@obsolete"
+    #"~@privileged"
+    "~@raw-io"
+    "~@reboot"
+    "~@swap"
+  ];
+
+}