vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-priv: lock personality, deny realtime, kernel logs and module loading

Browse source 
Adds LockPersonality, RestrictRealtime, ProtectKernelLogs and
ProtectKernelModules to the hive-priv unit. Nothing in hive-priv's
sources or its children uses personality(2), real-time scheduling,
/dev/kmsg, /proc/kmsg or explicit module loading.

A module-eval case pins the four directives on the rendered unit.
This commit is contained in:
atlas 2026-10-16 14:11:55 +02:00 • committed by mara
commit b8897e7c7a
3 changed files with 30 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

14
nix/module-eval/core-toggle.nix
View file

@ -1083,6 +1083,20 @@ let
{ unit, ... }: !(bare.systemd.services ? ${unit}) && !(bare.systemd.timers ? ${unit})
) storeRefreshed;
}
{
# `or false` so a dropped key fails this case by name instead of
# aborting eval. Only the rendered unit is pinned; eval cannot show
# that hive-priv still works under the directives.
name = "hive-priv locks personality and denies real-time scheduling, kernel logs and module loading";
ok =
let
sc = allLocal.systemd.services.hive-priv.serviceConfig;
in
(sc.LockPersonality or false)
&& (sc.RestrictRealtime or false)
&& (sc.ProtectKernelLogs or false)
&& (sc.ProtectKernelModules or false);
}
]
# Starting a unit that stays `active (exited)` is a no-op, so a timer aimed
# at one fires and fetches nothing.