fix(systemd): sandbox privileged hardware oneshots

Assisted-by: DeepSeek Harness (deepseek-flash)

outputs/x86_64-linux/tests/security-service-hardening/expected.nix

@@ -9,6 +9,17 @@ let
       "~@clock @cpu-emulation @debug @module @mount @obsolete @privileged @raw-io @reboot @swap"
     ];
   };
+
+  privilegedOneshot = {
+    CapabilityBoundingSet = "";
+    DeviceAllow = null;
+    NoNewPrivileges = true;
+    PrivateDevices = true;
+    PrivateNetwork = true;
+    ProtectKernelTunables = null;
+    ProtectSystem = "strict";
+    RestrictAddressFamilies = [ "AF_UNIX" ];
+  };
 in
 {
   # Only 80/443.
@@ -21,4 +32,13 @@ in
   whisper-asr = sandbox // {
     PrivateDevices = false;
   };
+
+  privilegedOneshot = {
+    amdgpu-power-cap = privilegedOneshot;
+    hdd-no-spindown = privilegedOneshot // {
+      CapabilityBoundingSet = [ "CAP_SYS_RAWIO" ];
+      DeviceAllow = [ "block-sd rw" ];
+      PrivateDevices = false;
+    };
+  };
 }

outputs/x86_64-linux/tests/security-service-hardening/expr.nix

@@ -12,6 +12,23 @@ let
     lib.genAttrs names (
       n: lib.getAttrs keys outputs.nixosConfigurations.${host}.config.systemd.services.${n}.serviceConfig
     );
+
+  privilegedKeys = [
+    "CapabilityBoundingSet"
+    "DeviceAllow"
+    "NoNewPrivileges"
+    "PrivateDevices"
+    "PrivateNetwork"
+    "ProtectKernelTunables"
+    "ProtectSystem"
+    "RestrictAddressFamilies"
+  ];
+  privilegedUnit =
+    host: name:
+    let
+      cfg = outputs.nixosConfigurations.${host}.config.systemd.services.${name}.serviceConfig;
+    in
+    lib.genAttrs privilegedKeys (key: cfg.${key} or null);
 in
 units "youko" [
   "caddy"
@@ -19,3 +36,9 @@ units "youko" [
   "vmalert-homelab"
 ]
 // units "aquamarine" [ "whisper-asr" ]
+// {
+  privilegedOneshot = {
+    amdgpu-power-cap = privilegedUnit "aquamarine" "amdgpu-power-cap";
+    hdd-no-spindown = privilegedUnit "youko" "hdd-no-spindown";
+  };
+}