@@ -819,28 +819,38 @@ in
819819 # Logs directory and mode
820820 LogsDirectory = "nginx";
821821 LogsDirectoryMode = "0750";
822+ # Proc filesystem
823+ ProcSubset = "pid";
824+ ProtectProc = "invisible";
825+ # New file permissions
826+ UMask = "0027"; # 0640 / 0750
822827 # Capabilities
823828 AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_RESOURCE" ];
824829 CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_RESOURCE" ];
825830 # Security
826831 NoNewPrivileges = true;
827− # Sandboxing
832+ # Sandboxing (sorted by occurrence in https://www.freedesktop.org/software/systemd/man/systemd.exec.html)
828833 ProtectSystem = "strict";
829834 ProtectHome = mkDefault true;
830835 PrivateTmp = true;
831836 PrivateDevices = true;
832837 ProtectHostname = true;
838+ ProtectClock = true;
833839 ProtectKernelTunables = true;
834840 ProtectKernelModules = true;
841+ ProtectKernelLogs = true;
835842 ProtectControlGroups = true;
836843 RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
844+ RestrictNamespaces = true;
837845 LockPersonality = true;
838846 MemoryDenyWriteExecute = !(builtins.any (mod: (mod.allowMemoryWriteExecute or false)) cfg.package.modules);
839847 RestrictRealtime = true;
840848 RestrictSUIDSGID = true;
849+ RemoveIPC = true;
841850 PrivateMounts = true;
842851 # System Call Filtering
843852 SystemCallArchitectures = "native";
853+ SystemCallFilter = "~@chown @cpu-emulation @debug @keyring @ipc @module @mount @obsolete @privileged @raw-io @reboot @setuid @swap";
844854 };
845855 };
846856