systemd: lock down systemctl status

Mitigates a security issue that allows unprivileged users to read other
unprivileged user's processes' credentials from CGroup using `systemctl
status`.

modules/presets/secure-node.nix

@@ -42,6 +42,9 @@ in {
 
     networking.firewall.enable = true;
 
+    # hideProcessInformation even if hardened kernel profile is disabled
+    security.hideProcessInformation = true;
+
     # Tor
     services.tor = {
       enable = true;