Configure systemd security features in keyd.service

[Expertcoderz]

This PR adds directives in the keyd.service unit definition file to enable all appropriate sandboxing/hardening features offered by systemd. This ensures that the daemon runs with least privileges (without breaking any functionality). The overall exposure level as reported by systemd-analyze security for keyd.service thence improves from "9.6 UNSAFE" to "1.4 OK".

References for the various security options: systemd.exec(5), systemd.resource-control(5)

[ThinkChaos]

It's probably worth taking a look at NixOS' service definition and copy more of what's done there since it's should be well tested. From a quick eyeball diff, SystemCallFilter and UMask are more restrictive there.

[Expertcoderz]

It's probably worth taking a look at NixOS' service definition and copy more of what's done there since it's should be well tested.

Thanks for the suggestion! I've looked through it and decided to increase the ProtectProc setting from noaccess to invisible, accordingly.

From a quick eyeball diff, SystemCallFilter and UMask are more restrictive there.

keyd requires access to the setgid and nice syscalls (under what systemd considers @resources). Removing @resources from the allowlist (or leaving CAP_SETGID/CAP_SYS_NICE out of CapabilityBoundingSet) seems to prevent keyd from starting, at least from my testing on Arch Linux.

As for the umask value, (0)177 is actually more restrictive than the 0077 given in NixOS. Umask specifies which permission bits to take away from newly created files/directories, and the 1 in 177 means to remove execute permission for the file owner by default. (Not that it's a significant issue anyway; keyd probably doesn't create any new files to begin with.)

[ThinkChaos]

Thanks for comparing and the details!

After taking a closer look I noticed nixpkgs only has keyd v2.4.2 ATM, so it never calls setgid or nice since that code was added in v2.4.3.
BTW according to the systemd docs, setgid is in @setuid, not that it changes anything here :)

EDIT: found a recent PR that updates to v2.4.3 NixOS/nixpkgs#245327, it's missing setgid it seems, but not hitting an issue because the group names it uses aren't keyd which is what ipc.c checks.