earlyoom: Apply security recommendations from package maintainer (First attempt)

[kaindlnetwork]

My pull request might not be the most elegant solution, but it implements the security restrictions recommended by the package maintainer. I would appreciate any help with verifying and testing the changes. Thank you very much! :D

Source for my changes: https://github.com/rfjakob/earlyoom/blob/master/earlyoom.service.in

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[06kellyjac]

Hello. Firstly, welcome to nixpkgs.

Your changes aren't indented correctly, if you could address that it'd be great.
Please also view CONTRIBUTING.md to see how commits should be titled.

If you can link the documentation from easyoom which recommends these options that would be helpful for review.

[kaindlnetwork]

Hi @06kellyjac,

Thank you so much for your suggestions!
I've updated my Pull Request to include the documentation I referenced for my change. Additionally, I’ve edited the title of the Pull Request to better reflect the changes.

Could you please let me know what is incorrect or missing to make my commit approvable? Specifically, regarding the comment "Your changes aren't indented correctly."

[06kellyjac]

By indentation I mean this

It was originally indented twice (2 spaces each indentation) by a total of 4 spaces. Now it's not indented.

Also your commits will need squashing together which I don't think you can do via the github interface

[kaindlnetwork]

Hi @06kellyjac,

I've implemented all your suggestions except for the SystemCallFilter so far. I must say, NixOS has impressively high standards for PRs!

To be honest, I'm not sure how to squash the commits. If you could assist with that, I’d really appreciate it (I rarely use Git commands). It looks like all the checks have passed successfully so far. :D

Thanks!