@@ -675,6 +675,33 @@ in {
675675 User = "grafana";
676676 RuntimeDirectory = "grafana";
677677 RuntimeDirectoryMode = "0755";
678+ # Hardening
679+ CapabilityBoundingSet = [ "" ];
680+ DeviceAllow = [ "" ];
681+ LockPersonality = true;
682+ MemoryDenyWriteExecute = true;
683+ NoNewPrivileges = true;
684+ PrivateDevices = true;
685+ PrivateTmp = true;
686+ PrivateUsers = true;
687+ ProcSubset = "pid";
688+ ProtectClock = true;
689+ ProtectControlGroups = true;
690+ ProtectHome = true;
691+ ProtectHostname = true;
692+ ProtectKernelLogs = true;
693+ ProtectKernelModules = true;
694+ ProtectKernelTunables = true;
695+ ProtectProc = "invisible";
696+ ProtectSystem = "full";
697+ RemoveIPC = true;
698+ RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
699+ RestrictNamespaces = true;
700+ RestrictRealtime = true;
701+ RestrictSUIDSGID = true;
702+ SystemCallArchitectures = "native";
703+ SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
704+ UMask = "0027";
678705 };
679706 preStart = ''
680707 ln -fs ${cfg.package}/share/grafana/conf ${cfg.dataDir}