treewide: Remove ineffective capability grants.

[eduarrrd]

Systemd units with PrivateUsers set get their capabilities within the user namespace only [1].
As a result they do cannot bind to privileged ports even though they appear like they should be able to.

The units in this commit [2] set PrivateUsers unconditionally so binding to privileged ports is currently impossible.
Granting them CAP_NET_BIND_SERVICE is useless and misleading any reader of those modules.
Technically, this commit also hardens these modules ever so slightly.

(There are corner cases where this could make sense (e.g. across units, using JoinsNamspaceOf) but this is arcane enough to not to be present in nixpkgs.)

[1]: systemd.exec(5): PrivateUsers
[2]: found using rg -e 'PrivateUsers.?=\s+[^f][^a]' -l | xargs rg -e '\bCAP_' -l

Description of changes

See commit message above.

Decisions taken:

• err on side of caution: disable caps instead of missing with PrivateUsers value
• remove empty capability settings: they do not add any value unless they are acting as overrides

Observations:

• many of the services that work around this disable PrivateUsers conditionally. This is not explicitly exposed and typically a result of setting that service's .port to a privileged value. Having the port number control 2 hardening settings is clearly not the right UX. But out of scope for this PR.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[Scrumplex]

Changes LGTM. Reasoning also aligns with how user namespaces work

[fpletz]

Thank you for the catch and the fixes.

[fpletz]

Observations:

• many of the services that work around this disable PrivateUsers conditionally. This is not explicitly exposed and typically a result of setting that service's .port to a privileged value. Having the port number control 2 hardening settings is clearly not the right UX. But out of scope for this PR.

I totally agree. We should at least compile a list of affected modules and open a tracking issue to fix these. Would you like to do that?

[Flakebi]

Change looks good to me :)