@@ -104,6 +104,7 @@ in
104104 ExecStart = "${pkgs.babeld}/bin/babeld -c ${configFile} -I /run/babeld/babeld.pid -S /var/lib/babeld/state";
105105 AmbientCapabilities = [ "CAP_NET_ADMIN" ];
106106 CapabilityBoundingSet = [ "CAP_NET_ADMIN" ];
107+ DevicePolicy = "closed";
107108 DynamicUser = true;
108109 IPAddressAllow = [ "fe80::/64" "ff00::/8" "::1/128" "127.0.0.0/8" ];
109110 IPAddressDeny = "any";
@@ -123,12 +124,17 @@ in
123124 RemoveIPC = true;
124125 ProtectHome = true;
125126 ProtectHostname = true;
127+ ProtectProc = "invisible";
126128 PrivateMounts = true;
127129 PrivateTmp = true;
128130 PrivateDevices = true;
129131 PrivateUsers = false; # kernel_route(ADD): Operation not permitted
132+ ProcSubset = "pid";
130133 SystemCallArchitectures = "native";
131− SystemCallFilter = [ "@system-service" ];
134+ SystemCallFilter = [
135+ "@system-service"
136+ "~@privileged @resources"
137+ ];
132138 UMask = "0177";
133139 RuntimeDirectory = "babeld";
134140 StateDirectory = "babeld";