## Copyright (C) 2016 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

[Unit]
Description=kloak anti keystroke deanonymization tool
Documentation=https://github.com/Whonix/kloak
Documentation=man:kloak(8)
ConditionPathExists=!/run/qubes/this-is-templatevm
After=graphical.target
After=sysmaint-boot.target

[Service]
Type=simple

## This cannot be trivially made work on Qubes!
##
## /dev/input/event0 is not a keyboard device.
##
## ls -la /dev/input/event0
## crw-rw---- 1 root input 13, 64 May  6 08:25 /dev/input/event0
##
## ls -la /dev/input/by-path/platform-pcspkr-event-spkr
## lrwxrwxrwx 1 root root 9 May  6 08:25 /dev/input/by-path/platform-pcspkr-event-spkr -> ../event0
##
## https://github.com/QubesOS/qubes-issues/issues/2558
## https://github.com/QubesOS/qubes-issues/issues/1850
## https://forums.whonix.org/t/current-state-of-kloak/5605/6
##
## For Qubes, see Qubes Event Buffering instead.
## https://www.whonix.org/wiki/Keystroke_and_Mouse_Deanonymization#Qubes_Event_Buffering

## find_wl_compositor.py generates /run/kloak_wl_compositor_data.
ExecStartPre=+-/usr/libexec/kloak/find_wl_compositor
EnvironmentFile=-/run/kloak_wl_compositor_data
ExecStart=/usr/bin/kloak

Restart=always
RestartSec=2s

CapabilityBoundingSet=CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_TTY_CONFIG CAP_SYS_PTRACE

ProtectSystem=strict
#ProtectHome=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
## hardened kernels without CONFIG_USER_NS_UNPRIVILEGED=Y
## need to:
## * disable or comment out the 3 'Private' namespaces below
## $ systemctl edit --full kloak
PrivateTmp=true
#PrivateUsers=true
PrivateNetwork=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
RestrictRealtime=true
RestrictNamespaces=true
SystemCallArchitectures=native
SystemCallFilter=brk open poll close ioctl mmap munmap read pread64 getdents64 socket connect getsockopt epoll_create1 epoll_ctl rt_sigprocmask epoll_wait inotify_init1 access openat fstat prctl sendmsg recvmsg newfstatat unlink ftruncate fcntl timerfd_create statx readlinkat faccessat2 fstatfs inotify_add_watch timerfd_settime madvise sigaltstack rt_sigaction

[Install]
WantedBy=graphical.target
