diff options
| author | Collin Williams <96917990+bluedragon1221@users.noreply.github.com> | 2026-01-18 08:10:20 -0600 |
|---|---|---|
| committer | Collin Williams <96917990+bluedragon1221@users.noreply.github.com> | 2026-01-18 08:10:20 -0600 |
| commit | d6c4bd6d87d31a2c688fb2fcfdb0cb15d8f9163d (patch) | |
| tree | 07f85b8fac540f7625f90b10ee500a1bc8116ac3 /modules/services/nixos/bluetooth.nix | |
| parent | ed2550a41c8429a1d2fe897deb878717c2ebc3d1 (diff) | |
| parent | 43af7f28b28021932b318964a953463d8dd79372 (diff) | |
Merge branch 'main' into wg
Diffstat (limited to 'modules/services/nixos/bluetooth.nix')
| -rw-r--r-- | modules/services/nixos/bluetooth.nix | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/modules/services/nixos/bluetooth.nix b/modules/services/nixos/bluetooth.nix index a86b5b3..bdcaa00 100644 --- a/modules/services/nixos/bluetooth.nix +++ b/modules/services/nixos/bluetooth.nix @@ -12,6 +12,18 @@ in powerOnBoot = true; }; + # hardening (down to 2.1 OK) + systemd.services."bluetooth".serviceConfig = { + IPAddressDeny = "any"; + ProtectHostname = true; + ProtectKernelTunables = lib.mkForce true; + ProtectKernelLogs = true; + ProtectKernelModules = lib.mkForce true; + RestrictAddressFamilies = ["AF_UNIX" "AF_BLUETOOTH"]; + ProtectClock = true; + ProcSubset = "pid"; + }; + environment.systemPackages = [ (lib.mkIf cfg.blueman.enable pkgs.blueman) (lib.mkIf cfg.bluetuith.enable pkgs.bluetuith) |