Relevant part of that module:

config = mkMerge [
          (mkIf (config.sandbox >= 2) {
            serviceConfig = mapAttrs (_: mkDefaulter) {
              # Filesystem stuff
              ProtectSystem = "strict"; # Prevent writing to most of /
              ProtectHome = true; # Prevent accessing /home and /root
              PrivateTmp = true; # Give an own directory under /tmp
              PrivateDevices = true; # Deny access to most of /dev
              ProtectKernelTunables = true; # Protect some parts of /sys
              ProtectControlGroups = true; # Remount cgroups read-only
              RestrictSUIDSGID = true; # Prevent creating SETUID/SETGID files
              PrivateMounts = true; # Give an own mount namespace
              RemoveIPC = true;
              UMask = "0077";

              # Capabilities
              CapabilityBoundingSet = ""; # Allow no capabilities at all
              NoNewPrivileges = true; # Disallow getting more capabilities. This is also implied by other options.

              # Kernel stuff
              ProtectKernelModules = true; # Prevent loading of kernel modules
              SystemCallArchitectures = "native"; # Usually no need to disable this
              ProtectKernelLogs = true; # Prevent access to kernel logs
              ProtectClock = true; # Prevent setting the RTC

              # Networking
              RestrictAddressFamilies = ""; # Example: "AF_UNIX AF_INET AF_INET6"
              PrivateNetwork = true; # Isolate the entire network

              # Misc
              LockPersonality = true; # Prevent change of the personality
              ProtectHostname = true; # Give an own UTS namespace
              RestrictRealtime = true; # Prevent switching to RT scheduling
              MemoryDenyWriteExecute = true; # Maybe disable this for interpreters like python
              PrivateUsers = true; # If anything randomly breaks, it's mostly because of this
              RestrictNamespaces = true;
            };
          })
        ];

In reply to @janne.hess:helsinki-systems.de
The sandbox module is basically the opt-out approach to sandboxing that hifi was talking about

In reply to @sumner:nevarro.space
https://github.com/NixOS/nixpkgs/pull/153279 would be great to get merged

In reply to @janne.hess:helsinki-systems.de
DId you test this?

In reply to @sumner:nevarro.space
yes, added screenshot. Also using analogous fix in my home-manager config: https://github.com/sumnerevans/home-manager-config/blob/master/modules/communication.nix#L5 and that works fine

In reply to @janne.hess:helsinki-systems.de
Looks like adding the backport label after merging doesn't do anything :(

In reply to @sumner:nevarro.space
I'm pretty sure it's supposed to, maybe it's just slow?

In reply to @ma27:nicht-so.sexy
Sumner Evans: are you updating synapse to https://github.com/matrix-org/synapse/releases/tag/v1.50.2 already? Otherwise I'd do it later :)

In reply to @sumner:nevarro.space
I'll do that right now

In reply to @dandellion:dodsorf.as
https://github.com/NixOS/nixpkgs/pull/155703