diff options
| author | Tom Fitzhenry <tom@tom-fitzhenry.me.uk> | 2023-09-15 15:06:20 +1000 |
|---|---|---|
| committer | Tom Fitzhenry <tom@tom-fitzhenry.me.uk> | 2023-09-16 06:37:00 +1000 |
| commit | dd1b3b077af7250742b710d53f983e271bff0b5b (patch) | |
| tree | 2d6d920937fbcb2e9d3ff090d511d07588e1b2d0 /nixos | |
| parent | 4b790413b4cb67615f2efcdde5066d9c57138369 (diff) | |
nixos/postfix: add systemd hardening directives
Inspired by https://github.com/gentoo/gentoo/blob/a9ccc48242da316f37b8e6ddf99bae660fadef48/mail-mta/postfix/files/postfix.service This decreases the systemd-analyze exposure level from UNSAFE to MEDIUM: ``` $ systemd-analyze security --offline=true postfix-hardened.service | grep Overall → Overall exposure level for postfix-hardened.service: 6.2 MEDIUM 😐 $ systemd-analyze security --offline=true postfix-original.service | grep Overall → Overall exposure level for postfix-original.service: 9.6 UNSAFE 😨 ```
Diffstat (limited to 'nixos')
| -rw-r--r-- | nixos/modules/services/mail/postfix.nix | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix index 23c47aaca7e23..e8b5f832e66eb 100644 --- a/nixos/modules/services/mail/postfix.nix +++ b/nixos/modules/services/mail/postfix.nix @@ -779,6 +779,19 @@ in ExecStart = "${pkgs.postfix}/bin/postfix start"; ExecStop = "${pkgs.postfix}/bin/postfix stop"; ExecReload = "${pkgs.postfix}/bin/postfix reload"; + + # Hardening + PrivateTmp = true; + PrivateDevices = true; + ProtectSystem = "full"; + CapabilityBoundingSet = [ "~CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE" ]; + MemoryDenyWriteExecute = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectControlGroups = true; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_NETLINK" "AF_UNIX" ]; + RestrictNamespaces = true; + RestrictRealtime = true; }; }; |