Enable systemd hardened configs in gui-vm

- Fixed dynamic user login issue. - Mounting user home requires admin capability, so allowed it. Signed-off-by: Ganga Ram <[email protected]>
tiiuae · Jan 21, 2025 · 9fe5ac2 · 9fe5ac2
1 parent b2c28e0
commit 9fe5ac2
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/modules/common/systemd/hardened-configs/common/systemd-udevd.nix b/modules/common/systemd/hardened-configs/common/systemd-udevd.nix
@@ -126,7 +126,7 @@
     # "~CAP_AUDIT_CONTROL"
     # "~CAP_AUDIT_READ"
     # "~CAP_AUDIT_WRITE"
-    "~CAP_SYS_ADMIN"
+    # "~CAP_SYS_ADMIN"
     # "~CAP_SYSLOG"
     # "~CAP_SYS_TIME
   ];
@@ -137,8 +137,8 @@
 
   SystemCallFilter = [
     # "~@clock"
-    # "~@cpu-emulation"
-    # "~@debug"
+    "~@cpu-emulation"
+    "~@debug"
     # "~@module"
     # "~@mount"
     "~@obsolete"

diff --git a/modules/microvm/virtualization/microvm/guivm.nix b/modules/microvm/virtualization/microvm/guivm.nix
@@ -90,7 +90,7 @@ let
               withResolved = true;
               withTimesyncd = true;
               withDebug = config.ghaf.profiles.debug.enable;
-              withHardenedConfigs = false;
+              withHardenedConfigs = true;
             };
             givc.guivm.enable = true;