diff --git a/nixos/modules/services/networking/gns3-server.nix b/nixos/modules/services/networking/gns3-server.nix index 637d6184bc6f5b3..e3142567c4ac98e 100644 --- a/nixos/modules/services/networking/gns3-server.nix +++ b/nixos/modules/services/networking/gns3-server.nix @@ -232,37 +232,6 @@ in { ++ lib.optional cfg.ubridge.enable "ubridge"; User = "gns3"; WorkingDirectory = "%S/gns3"; - - # Hardening - DeviceAllow = lib.optional flags.enableLibvirtd "/dev/kvm"; - DevicePolicy = "closed"; - LockPersonality = true; - MemoryDenyWriteExecute = true; - NoNewPrivileges = true; - PrivateTmp = true; - PrivateUsers = true; - # Don't restrict ProcSubset because python3Packages.psutil requires read access to /proc/stat - # ProcSubset = "pid"; - ProtectClock = true; - ProtectControlGroups = true; - ProtectHome = true; - ProtectHostname = true; - ProtectKernelLogs = true; - ProtectKernelModules = true; - ProtectKernelTunables = true; - ProtectProc = "invisible"; - ProtectSystem = "strict"; - RestrictAddressFamilies = [ - "AF_INET" - "AF_INET6" - "AF_NETLINK" - "AF_UNIX" - "AF_PACKET" - ]; - RestrictNamespaces = true; - RestrictRealtime = true; - RestrictSUIDSGID = true; - UMask = "0077"; }; }; };