diff options
| author | Collin Williams <96917990+bluedragon1221@users.noreply.github.com> | 2026-01-09 20:36:36 -0600 |
|---|---|---|
| committer | Collin Williams <96917990+bluedragon1221@users.noreply.github.com> | 2026-01-09 20:36:36 -0600 |
| commit | 547d6dc4731b04a240048b0b95c0ea12e0d1f6bd (patch) | |
| tree | dd3d63dfb21c62d2d71a1f8e937d3247c2e78b11 /modules/services/nixos/bluetooth.nix | |
| parent | 7b9a5eb561948521ac4669074cc746a0f848ed23 (diff) | |
lots of changes, including revamp of network services boot chain on mercury
Diffstat (limited to 'modules/services/nixos/bluetooth.nix')
| -rw-r--r-- | modules/services/nixos/bluetooth.nix | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/modules/services/nixos/bluetooth.nix b/modules/services/nixos/bluetooth.nix index a86b5b3..bdcaa00 100644 --- a/modules/services/nixos/bluetooth.nix +++ b/modules/services/nixos/bluetooth.nix @@ -12,6 +12,18 @@ in powerOnBoot = true; }; + # hardening (down to 2.1 OK) + systemd.services."bluetooth".serviceConfig = { + IPAddressDeny = "any"; + ProtectHostname = true; + ProtectKernelTunables = lib.mkForce true; + ProtectKernelLogs = true; + ProtectKernelModules = lib.mkForce true; + RestrictAddressFamilies = ["AF_UNIX" "AF_BLUETOOTH"]; + ProtectClock = true; + ProcSubset = "pid"; + }; + environment.systemPackages = [ (lib.mkIf cfg.blueman.enable pkgs.blueman) (lib.mkIf cfg.bluetuith.enable pkgs.bluetuith) |