Harden and update to use the new features in systemd-232

[spacekitteh]

Once systemd-232 is merged (#20156) and things are working, we have a bunch of tasks:

• Set defaults for services to abide by the principle of least privilege (The service interface should abide by the principle of least privilege #14645)
  • ProtectKernelModules = true;
  • ProtectSystem = "strict";
  • ProtectKernelTunables = true;
  • ProtectControlGroups = true;
  • DynamicUser = true; (Many of our NixOS services run as root and shouldn't #11908) Requires enabling the new nss-systemd.so module. Also means going through all current services to remove now-unrequired users.
  • NoNewPrivileges = true;
  • RestrictAddressFamilies. This takes a list of address families to whitelist, but the default should be empty.
• RemoveIPC option to remove assigned IPC objects after service exit
• Include the two new user targets: "graphical-session.target" and "graphical-session-pre.target"
• Ensure Journald's SplitMode has been changed to "uid", as "login" is now deprecated
• Update cryptsetup/crypttab to enable enable VeraCrypt partitions

[peterhoeg]

This is the best practice list from the mailing list:

CapabilityBoundingSet=...
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
PrivateDevices=yes
PrivateTmp=yes
PrivateUsers=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectSystem=strict
RestrictAddressFamilies=AF_NETLINK AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @resources

[globin]

systemd 232 is on staging (a38f191)

[ckauhaus]

We are on systemd-239 now. Is this still relevant?

[peterhoeg]

Very much so - we are not really making use of the various capabilities to lock things down (yet).