From 3e5ddbd2c0fa2d7453e37e1125fd89a33a77943a Mon Sep 17 00:00:00 2001 From: atlas Date: Sat, 4 Jul 2026 12:47:19 +0200 Subject: [PATCH] fix(#1845): add ProtectSystem=full to hive-c0re service hardening MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ProtectSystem=full makes /usr, /etc, and /boot read-only. Safe for hive-c0re because it never writes to those paths directly: - /etc writes (e.g. /etc/nixos-containers) go through hive-priv - /etc/hyperhive/serve.json reads are read-only - All runtime writes go to StateDirectory (/var/lib/hyperhive) and RuntimeDirectory (/run/hyperhive), which remain writable under full ProtectSystem=strict (everything read-only) is still deferred — it requires auditing ReadWritePaths for every nix path c0re touches. RestrictAddressFamilies deferred pending a watched deploy. Also tightens the comment block to not mention a numbered issue. --- nix/modules/hive-c0re.nix | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix index 7da5b1c5..1a3f5360 100644 --- a/nix/modules/hive-c0re.nix +++ b/nix/modules/hive-c0re.nix @@ -1099,11 +1099,18 @@ in # and delegates all privileged ops to hive-priv via a Unix socket. # These directives deny the subset of kernel capabilities it # provably doesn't need without restricting its network or - # filesystem access (ProtectSystem / RestrictAddressFamilies are - # deferred to a follow-up with a watched deploy. + # filesystem access (RestrictAddressFamilies deferred — needs a + # watched deploy to verify no AF_UNIX/AF_INET gaps in socket paths). NoNewPrivileges = true; # already runs as unprivileged user - PrivateTmp = true; # hive-c0re and its nix subprocesses use tmpfiles under StateDirectory, not /tmp - ProtectHome = true; # HOME = /var/lib/hyperhive (StateDirectory); no /home/* access needed + PrivateTmp = true; # uses StateDirectory for tmpfiles, not /tmp + ProtectHome = true; # HOME = /var/lib/hyperhive; no /home/* access needed + # "full" makes /usr, /etc, /boot read-only. Safe: c0re never + # writes to any of those paths directly — all /etc writes (e.g. + # /etc/nixos-containers) go through hive-priv, and reads from + # /etc/hyperhive/serve.json are read-only. "strict" (everything + # read-only) requires carefully auditing ReadWritePaths for every + # nix store path c0re touches and is deferred to a follow-up. + ProtectSystem = "full"; ProtectKernelTunables = true; # no sysctl writes ProtectKernelLogs = true; # reads logs via systemd-journal group, not /dev/kmsg ProtectControlGroups = true; # cgroup writes go through hive-priv, not c0re directly