From 26e590716ee883c57a72828019bb45145f49e97f Mon Sep 17 00:00:00 2001
From: Julian Sommer <115516918+juliansommer@users.noreply.github.com>
Date: Thu, 9 Apr 2026 12:09:43 +1000
Subject: [PATCH] feat: add systemd hardening directives to all service units
 (#120)

---
 build/systemd/spinifex-awsgw.service      | 9 +++++++++
 build/systemd/spinifex-daemon.service     | 8 ++++++++
 build/systemd/spinifex-nats.service       | 9 +++++++++
 build/systemd/spinifex-predastore.service | 9 +++++++++
 build/systemd/spinifex-ui.service         | 9 +++++++++
 build/systemd/spinifex-viperblock.service | 9 +++++++++
 build/systemd/spinifex-vpcd.service       | 8 ++++++++
 7 files changed, 61 insertions(+)

diff --git a/build/systemd/spinifex-awsgw.service b/build/systemd/spinifex-awsgw.service
index 64610f681..fd61d424a 100644
--- a/build/systemd/spinifex-awsgw.service
+++ b/build/systemd/spinifex-awsgw.service
@@ -39,6 +39,15 @@ ProtectKernelLogs=yes
 ProtectControlGroups=yes
 ProtectProc=invisible
 SystemCallArchitectures=native
+MemoryDenyWriteExecute=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
+CapabilityBoundingSet=
+ProtectHostname=yes
+KeyringMode=private
+RemoveIPC=yes
+LimitCORE=0
+LimitNOFILE=65536
+LimitNPROC=4096
 
 [Install]
 WantedBy=spinifex.target
diff --git a/build/systemd/spinifex-daemon.service b/build/systemd/spinifex-daemon.service
index 3a4740aa7..e8168cf51 100644
--- a/build/systemd/spinifex-daemon.service
+++ b/build/systemd/spinifex-daemon.service
@@ -40,6 +40,14 @@ ProtectKernelLogs=yes
 ProtectControlGroups=yes
 ProtectProc=invisible
 SystemCallArchitectures=native
+MemoryDenyWriteExecute=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
+ProtectHostname=yes
+KeyringMode=private
+RemoveIPC=yes
+LimitCORE=0
+LimitNOFILE=65536
+LimitNPROC=4096
 
 [Install]
 WantedBy=spinifex.target
diff --git a/build/systemd/spinifex-nats.service b/build/systemd/spinifex-nats.service
index 06cc9a014..f7995f42e 100644
--- a/build/systemd/spinifex-nats.service
+++ b/build/systemd/spinifex-nats.service
@@ -34,6 +34,15 @@ ProtectKernelLogs=yes
 ProtectControlGroups=yes
 ProtectProc=invisible
 SystemCallArchitectures=native
+MemoryDenyWriteExecute=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
+CapabilityBoundingSet=
+ProtectHostname=yes
+KeyringMode=private
+RemoveIPC=yes
+LimitCORE=0
+LimitNOFILE=65536
+LimitNPROC=4096
 
 [Install]
 WantedBy=spinifex.target
diff --git a/build/systemd/spinifex-predastore.service b/build/systemd/spinifex-predastore.service
index 060fa7e14..e42b95685 100644
--- a/build/systemd/spinifex-predastore.service
+++ b/build/systemd/spinifex-predastore.service
@@ -39,6 +39,15 @@ ProtectKernelLogs=yes
 ProtectControlGroups=yes
 ProtectProc=invisible
 SystemCallArchitectures=native
+MemoryDenyWriteExecute=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
+CapabilityBoundingSet=
+ProtectHostname=yes
+KeyringMode=private
+RemoveIPC=yes
+LimitCORE=0
+LimitNOFILE=65536
+LimitNPROC=4096
 
 [Install]
 WantedBy=spinifex.target
diff --git a/build/systemd/spinifex-ui.service b/build/systemd/spinifex-ui.service
index c23499491..270ddccfa 100644
--- a/build/systemd/spinifex-ui.service
+++ b/build/systemd/spinifex-ui.service
@@ -35,6 +35,15 @@ ProtectKernelLogs=yes
 ProtectControlGroups=yes
 ProtectProc=invisible
 SystemCallArchitectures=native
+MemoryDenyWriteExecute=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
+CapabilityBoundingSet=
+ProtectHostname=yes
+KeyringMode=private
+RemoveIPC=yes
+LimitCORE=0
+LimitNOFILE=65536
+LimitNPROC=4096
 
 [Install]
 WantedBy=spinifex.target
diff --git a/build/systemd/spinifex-viperblock.service b/build/systemd/spinifex-viperblock.service
index 7ffba717e..c9c72e289 100644
--- a/build/systemd/spinifex-viperblock.service
+++ b/build/systemd/spinifex-viperblock.service
@@ -38,6 +38,15 @@ ProtectKernelLogs=yes
 ProtectControlGroups=yes
 ProtectProc=invisible
 SystemCallArchitectures=native
+MemoryDenyWriteExecute=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
+CapabilityBoundingSet=
+ProtectHostname=yes
+KeyringMode=private
+RemoveIPC=yes
+LimitCORE=0
+LimitNOFILE=65536
+LimitNPROC=4096
 
 [Install]
 WantedBy=spinifex.target
diff --git a/build/systemd/spinifex-vpcd.service b/build/systemd/spinifex-vpcd.service
index c71dd452c..4e705762a 100644
--- a/build/systemd/spinifex-vpcd.service
+++ b/build/systemd/spinifex-vpcd.service
@@ -36,6 +36,14 @@ ProtectKernelLogs=yes
 ProtectControlGroups=yes
 ProtectProc=invisible
 SystemCallArchitectures=native
+MemoryDenyWriteExecute=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
+ProtectHostname=yes
+KeyringMode=private
+RemoveIPC=yes
+LimitCORE=0
+LimitNOFILE=65536
+LimitNPROC=4096
 
 [Install]
 WantedBy=spinifex.target