vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#1845): add ProtectSystem=full to hive-c0re service hardening

Browse source 
ProtectSystem=full makes /usr, /etc, and /boot read-only. Safe for
hive-c0re because it never writes to those paths directly:
- /etc writes (e.g. /etc/nixos-containers) go through hive-priv
- /etc/hyperhive/serve.json reads are read-only
- All runtime writes go to StateDirectory (/var/lib/hyperhive) and
  RuntimeDirectory (/run/hyperhive), which remain writable under full

ProtectSystem=strict (everything read-only) is still deferred — it
requires auditing ReadWritePaths for every nix path c0re touches.
RestrictAddressFamilies deferred pending a watched deploy.

Also tightens the comment block to not mention a numbered issue.
This commit is contained in:
atlas 2026-07-04 12:47:19 +02:00 • committed by mara
commit 3e5ddbd2c0
1 changed files with 11 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

15
nix/modules/hive-c0re.nix
View file

@ -1099,11 +1099,18 @@ in
# and delegates all privileged ops to hive-priv via a Unix socket.
# These directives deny the subset of kernel capabilities it
# provably doesn't need without restricting its network or
# filesystem access (ProtectSystem / RestrictAddressFamilies are
# deferred to a follow-up with a watched deploy.
# filesystem access (RestrictAddressFamilies deferred — needs a
# watched deploy to verify no AF_UNIX/AF_INET gaps in socket paths).
NoNewPrivileges = true; # already runs as unprivileged user
PrivateTmp = true; # hive-c0re and its nix subprocesses use tmpfiles under StateDirectory, not /tmp
ProtectHome = true; # HOME = /var/lib/hyperhive (StateDirectory); no /home/* access needed
PrivateTmp = true; # uses StateDirectory for tmpfiles, not /tmp
ProtectHome = true; # HOME = /var/lib/hyperhive; no /home/* access needed
# "full" makes /usr, /etc, /boot read-only. Safe: c0re never
# writes to any of those paths directly — all /etc writes (e.g.
# /etc/nixos-containers) go through hive-priv, and reads from
# /etc/hyperhive/serve.json are read-only. "strict" (everything
# read-only) requires carefully auditing ReadWritePaths for every
# nix store path c0re touches and is deferred to a follow-up.
ProtectSystem = "full";
ProtectKernelTunables = true; # no sysctl writes
ProtectKernelLogs = true; # reads logs via systemd-journal group, not /dev/kmsg
ProtectControlGroups = true; # cgroup writes go through hive-priv, not c0re directly