[different-error]

• add systemd sandboxing to nordvpnd; sandboxing shrinks the blast radius of a compromised nordvpnd process
• add more comprehensive nixos tests to verify service prerequisites and capability bounds: loaded kernel modules, capabilities, socket permissions, tun device access

Assisted-by: Claude Code (Sonnet 5)

(edit note: I initially patched nordvpn-linux's source directly; I decided to move that change upstream instead)

---

Spin up a VM for manual verification:

{
  pkgs,
  lib,
  ...
}:

{
  imports = [
    ./hardware-configuration.nix
  ];

  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  networking.firewall.enable = true;
  networking.firewall.checkReversePath = "loose";

  services.xserver.enable = true;
  services.displayManager.gdm.enable = true;
  services.desktopManager.plasma6.enable = true;

  services.timesyncd.enable = lib.mkForce true;
  services.timesyncd.servers = [
    "time.google.com"
    "pool.ntp.org"
  ];

  services.nordvpn = {
    enable = true;
  };

  virtualisation.vmVariant = {
    virtualisation = {
      memorySize = 8192;
      cores = 3;
    };
  };
  users.groups.alice = { };
  users.users.alice = {
    isNormalUser = true;
    password = "alice";
    group = "alice";
    extraGroups = [
      "wheel"
      "nordvpn"
    ];
    shell = pkgs.bash;
    home = "/home/alice";
    createHome = true;
    packages = with pkgs; [
      dunst
      firefox
      libnotify
      nftables
      socat
      tmux
      tree
      vim
    ];
  };
  system.stateVersion = "24.11"; # Did you read the comment?
}

nixos-rebuild build-vm \
  -I nixpkgs=https://github.com/NixOS/nixpkgs/archive/refs/pull/547437/head.tar.gz \
  -I nixos-config=/path/to/configuration.nix

---

Note: since this package/service hasn't made it to stable yet, I've not updated the release notes.

Things done

• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • aarch64-darwin
• Tested, as applicable:
  • NixOS tests in nixos/tests.
  • Package tests at passthru.tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
• Ran nixpkgs-review on this PR. See nixpkgs-review usage.
• Tested basic functionality of all binary files, usually in ./result/bin/.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.
• Follows the automation/AI policy.

[h7x4]

Could you read through the Automation/AI policy and state whether the contribution adheres to it?

[different-error]

@ruffsl @andersonjoseph

Hello again. I could use your qa testing of the changes in this pr as well to facilitate review. Ty.

[andersonjoseph]

Built a VM from this PR and verified the sandboxing lands and doesn't break anything:

• All the new directives are active on nordvpnd (ProtectSystem=strict, RestrictAddressFamilies, RestrictNamespaces, ProtectControlGroups, DeviceAllow=/dev/net/tun, NoNewPrivileges, ReadWritePaths=/tmp, WorkingDirectory=/var/lib/nordvpn).
• Capabilities locked to exactly CAP_NET_ADMIN (CapEff/CapBnd/CapPrm/CapAmb/CapInh all 0x1000).
• tun + wireguard kernel modules auto-loaded.
• norduserd starts as a user service via default.target (no graphical session needed).
• A real nordvpn connect establishes a tunnel under the sandbox*(connected through a NordVPN server, got an exit IP) and disconnect works. no sandbox violations during the connection.

Looks good from my side

[romildo]

Built a VM from this PR and verified the sandboxing lands and doesn't break anything:

* All the new directives are active on `nordvpnd` (`ProtectSystem=strict`, `RestrictAddressFamilies`, `RestrictNamespaces`, `ProtectControlGroups`, `DeviceAllow=/dev/net/tun`, `NoNewPrivileges`, `ReadWritePaths=/tmp`, `WorkingDirectory=/var/lib/nordvpn`).

* Capabilities locked to exactly `CAP_NET_ADMIN` (`CapEff`/`CapBnd`/`CapPrm`/`CapAmb`/`CapInh` all `0x1000`).

* `tun` + `wireguard` kernel modules auto-loaded.

* `norduserd` starts as a user service via `default.target` (no graphical session needed).

* A real `nordvpn connect` establishes a tunnel under the sandbox*(connected through a NordVPN server, got an exit IP) and `disconnect` works. no sandbox violations during the connection.

Looks good from my side

Is this an approval for merging?

[BerriJ]

We can remove line 16 now since networking.firewall.checkReversePath now defaults to loose (see #550306) . This also means that the comment below (L20) can also be removed.

[different-error]

Oh, very cool. Thank you for pointing this out. I intend to include the following changes in the next pr (for meshnet):

Additionally, others may only want to update the unstable commit for nordvpn package and therefore might miss the new firewall change, making the proposed documentation changes premature.

I therefore think it more appropriate to move the proposed documentation changes to the next pr (which would include meshnet).

Edit: oops, I confused my local setup with unstable. Sounds good.

[different-error]

Is this an approval for merging?

@romildo yes; GITHUB actions seems to not work on this PR atm. The URL to this PR responds with a 404. I don't quite understand yet why this has happened.

[nixpkgs-ci]

Thanks for contributing to the documentation.

Follow the documentation style guide, especially:

• Show, don’t tell. Start with a minimal working example. Explain after the code.
• Avoid meta-commentary. Don’t write "This section explains how to…".
• Use present tense, imperative mood, and active voice. For example: "Run the command," not "The user should run the following command."
• Avoid vague references like "this" when the referent is unclear. Write "This command creates a folder," not "This will create a folder."
• Be direct. Avoid "should", "might", "typically", and "usually".
• Cut filler words like "simply", "just", "easily", and "basically". Use "to" instead of "in order to".

For larger changes, such as adding or removing whole sections, ask the NixOS documentation team for review.

[different-error]

@romildo I had a temporary disputed account suspension. I've rebased on top of latest master and added myself back as maintainer. Verified that cli and gui work for both protocols. Thank you for your patience and perhaps we can move forward with this?

@novalkun fyi

[novalkun]

This exact change has also been independently verified on my end via #568291 (build + VM test + live hardware, same sandboxing/test changes). Good to see you back — will close #568291 in favor of this one to avoid duplicate diffs.

[novalkun]

Approved. thanks