From 964944222681114d052954d93f7e19f39380f41a Mon Sep 17 00:00:00 2001
From: smonsech <santiago@emeks.com.ar>
Date: Tue, 28 Oct 2025 17:13:17 -0300
Subject: [PATCH] restrict shared memory usage for processes

---
 configuration.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/configuration.nix b/configuration.nix
index b1fc317..51dd83f 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -432,6 +432,16 @@ rec {
       };
   };
 
+  systemd.services.enforce-dev-shm-options = {
+    after = [ "local-fs.target" ];
+    wantedBy = [ "multi-user.target" ];
+    script = "${pkgs.util-linux}/bin/mount -o remount,ro,noexec,nosuid,nodev,size=50% tmpfs /dev/shm";
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+  };
+
   # Open ports in the firewall Or disable the firewall altogether.
   networking.firewall = {
     enable = true;