From 7a45aad6b467d0177369a2ff40db7679074baac5 Mon Sep 17 00:00:00 2001 From: elwrcl Date: Thu, 27 Aug 2026 20:53:37 +0300 Subject: [PATCH] boiling opsec --- hosts/copland.ulu.nix | 3 + modules/home/home-noctalia.ulu.nix | 2 +- modules/nixos/common/common-boot.ulu.nix | 28 +--- modules/nixos/common/common-crashlog.ulu.nix | 136 ++++++++++++++++++ modules/nixos/common/common-hardening.ulu.nix | 69 +++++++++ modules/nixos/common/common-packages.ulu.nix | 1 - modules/nixos/common/common-users.ulu.nix | 1 - 7 files changed, 210 insertions(+), 30 deletions(-) create mode 100644 modules/nixos/common/common-crashlog.ulu.nix create mode 100644 modules/nixos/common/common-hardening.ulu.nix diff --git a/hosts/copland.ulu.nix b/hosts/copland.ulu.nix index e8fd252..147f619 100644 --- a/hosts/copland.ulu.nix +++ b/hosts/copland.ulu.nix @@ -95,6 +95,9 @@ in { elars.expectedHostName = "copland"; } # pool config.flake.nixosModules.common-boot + config.flake.nixosModules.common-kernel + config.flake.nixosModules.common-hardening + config.flake.nixosModules.common-crashlog config.flake.nixosModules.hw-bluetooth config.flake.nixosModules.hw-graphics config.flake.nixosModules.hw-intel-hard diff --git a/modules/home/home-noctalia.ulu.nix b/modules/home/home-noctalia.ulu.nix index 68f4fe0..36e1f91 100644 --- a/modules/home/home-noctalia.ulu.nix +++ b/modules/home/home-noctalia.ulu.nix @@ -37,7 +37,7 @@ }; brightness = { - enable_ddcutil = true; + enable_ddcutil = false; minimum_brightness = 0.01; }; diff --git a/modules/nixos/common/common-boot.ulu.nix b/modules/nixos/common/common-boot.ulu.nix index 05d2e18..38e8492 100644 --- a/modules/nixos/common/common-boot.ulu.nix +++ b/modules/nixos/common/common-boot.ulu.nix @@ -1,35 +1,9 @@ { ... }: { flake.nixosModules.common-boot = - { - pkgs, - inputs, - ... - }: + { pkgs, ... }: { environment.systemPackages = [ pkgs.efibootmgr ]; - boot.kernelPackages = pkgs.linuxPackages_latest; - # todo soryu kernel, opsec modules .. - boot.kernelParams = [ - "mitigations=off" - "nmi_watchdog=1" - "transparent_hugepage=madvise" - ]; - - boot.kernelModules = [ - "tcp_bbr" - "sch_fq" - ]; - - hardware.i2c.enable = true; - boot.kernel.sysctl = { - "net.core.default_qdisc" = "fq"; - "net.ipv4.tcp_congestion_control" = "bbr"; - "kernel.softlockup_panic" = 1; - "kernel.hardlockup_panic" = 1; - "kernel.hung_task_panic" = 1; - "kernel.panic" = 50; - }; boot.loader = { timeout = 5; diff --git a/modules/nixos/common/common-crashlog.ulu.nix b/modules/nixos/common/common-crashlog.ulu.nix new file mode 100644 index 0000000..8c0bfcb --- /dev/null +++ b/modules/nixos/common/common-crashlog.ulu.nix @@ -0,0 +1,136 @@ +{ ... }: +{ + flake.nixosModules.common-crashlog = + { pkgs, ... }: + let + netconsole = pkgs.writeShellApplication { + name = "netconsole-on"; + runtimeInputs = [ + pkgs.iproute2 + pkgs.kmod + ]; + text = '' + TARGET_DIR=/sys/kernel/config/netconsole/copland + usage() { + echo "usage: netconsole-on [interface] [port]" >&2 + echo " netconsole-on off" >&2 + echo "" >&2 + echo " e.g.: netconsole-on 192.168.1.10 aa:bb:cc:dd:ee:ff" >&2 + echo " on the receiving side: nc -u -l 6666" >&2 + echo "" >&2 + echo " target-mac: if the target is on the same network, use the target's MAC" >&2 + echo " otherwise use the gateway's MAC (find it with ip neigh)" >&2 + exit 1 + } + + if [ "''${1:-}" = "off" ]; then + if [ -d "$TARGET_DIR" ]; then + echo 0 > "$TARGET_DIR/enabled" || true + rmdir "$TARGET_DIR" + echo "netconsole disabled" + else + echo "netconsole already disabled" + fi + exit 0 + fi + + [ "$#" -ge 2 ] || usage + + TARGET_IP="$1" + TARGET_MAC="$2" + IFACE="''${3:-enp8s0}" + PORT="''${4:-6666}" + + LOCAL_IP="$(ip -4 -o addr show dev "$IFACE" | awk '{print $4}' | cut -d/ -f1 | head -1)" + if [ -z "$LOCAL_IP" ]; then + echo "error: no IPv4 address on $IFACE (is the cable plugged in?)" >&2 + exit 1 + fi + + modprobe netconsole + [ -d "$TARGET_DIR" ] && { echo 0 > "$TARGET_DIR/enabled" || true; rmdir "$TARGET_DIR"; } + mkdir -p "$TARGET_DIR" + + echo 1 > "$TARGET_DIR/extended" + echo "$IFACE" > "$TARGET_DIR/dev_name" + echo "$LOCAL_IP" > "$TARGET_DIR/local_ip" + echo "$TARGET_IP" > "$TARGET_DIR/remote_ip" + echo "$TARGET_MAC" > "$TARGET_DIR/remote_mac" + echo "$PORT" > "$TARGET_DIR/remote_port" + echo 1 > "$TARGET_DIR/enabled" + + echo "netconsole enabled: $IFACE ($LOCAL_IP) -> $TARGET_IP:$PORT" + echo "listen on receiver: nc -u -l $PORT" + echo "test it: echo 'netconsole test' | sudo tee /dev/kmsg" + ''; + }; + + drmPanicDecode = pkgs.writeShellApplication { + name = "drm-panic-decode"; + runtimeInputs = [ + pkgs.zbar + pkgs.python3 + ]; + text = '' + if [ "$#" -lt 1 ]; then + echo "usage: drm-panic-decode " >&2 + exit 1 + fi + + zbarimg --raw -q --oneshot -Sbinary "$1" | python3 -c ' +import sys, zlib +data = sys.stdin.buffer.read() +if not data: + sys.exit("Could not read QR: try taking a clearer/straighter photo") +# Try raw deflate, zlib-wrapped, and gzip variants in order +for wbits in (-15, 15, 47): + try: + sys.stdout.buffer.write(zlib.decompress(data, wbits)) + break + except zlib.error: + continue +else: + sys.stderr.write("warning: could not decompress, printing raw data\n") + sys.stdout.buffer.write(data) +' + ''; + }; + in + { + environment.systemPackages = [ + netconsole + drmPanicDecode + ]; + + boot.kernelParams = [ + "reserve_mem=8M:4096:oops" + "drm.panic_screen=qr_code" + ]; + + boot.kernelModules = [ + "ramoops" + "iTCO_wdt" + ]; + boot.extraModprobeConfig = '' + options ramoops mem_name=oops record_size=262144 max_reason=3 ecc=1 + ''; + + boot.kernel.sysctl = { + "kernel.panic" = 30; + + "kernel.hardlockup_panic" = 1; + + "kernel.softlockup_panic" = 1; + + "kernel.hung_task_panic" = 1; + + "kernel.hung_task_timeout_secs" = 300; + + "kernel.sysrq" = 184; + }; + systemd.settings.Manager = { + RuntimeWatchdogSec = "60s"; + RebootWatchdogSec = "10min"; + }; + }; +} diff --git a/modules/nixos/common/common-hardening.ulu.nix b/modules/nixos/common/common-hardening.ulu.nix new file mode 100644 index 0000000..3a4ee3b --- /dev/null +++ b/modules/nixos/common/common-hardening.ulu.nix @@ -0,0 +1,69 @@ +{ ... }: +{ + flake.nixosModules.common-hardening = + { ... }: + { + boot.kernel.sysctl = { + "kernel.dmesg_restrict" = 1; # Restrict dmesg access to privileged users. + "kernel.unprivileged_bpf_disabled" = 1; # Disable unprivileged BPF to reduce attack surface. + "fs.protected_fifos" = 2; # Prevent unsafe FIFO use in sticky world-writable dirs. + "fs.protected_regular" = 2; # Prevent unsafe regular file access in sticky world-writable dirs. + }; + + boot.kernelParams = [ + "randomize_kstack_offset=on" # Randomize kernel stack offset for harder exploitation. + "page_alloc.shuffle=1" # Randomize page allocator free lists. + "slab_nomerge" # Disable slab merging to reduce cross-cache attacks. + "vsyscall=xonly" # Keep legacy vsyscall execute-only for compatibility with less exposure. + ]; + + boot.blacklistedKernelModules = [ + "af_802154" # IEEE 802.15.4 wireless networking stack. + "appletalk" # AppleTalk networking stack. + "atm" # Asynchronous Transfer Mode networking. + "ax25" # Amateur X.25 networking. + "can" # Controller Area Network; used for vehicle and industrial buses. + "dccp" # Datagram Congestion Control Protocol. + "decnet" # DECnet networking stack. + "econet" # Acorn Econet networking. + "ipx" # Novell IPX protocol stack. + "n-hdlc" # HDLC framing support. + "netrom" # NetRom amateur packet networking. + "p8022" # IEEE 802.2 LLC networking. + "p8023" # Novell raw IEEE 802.3 Ethernet. + "psnap" # IEEE 802.2 SNAP protocol. + "rds" # Reliable Datagram Sockets. + "rose" # ROSE networking stack. + "sctp" # Stream Control Transmission Protocol. + "tipc" # Transparent Inter-Process Communication. + "x25" # CCITT X.25 networking. + + "adfs" # Adaptec ADFS filesystem. + "affs" # Amiga Fast File System. + "befs" # BeOS File System. + "bfs" # BFS filesystem. + "cramfs" # Compressed ROM filesystem. + "efs" # EFS filesystem. + "erofs" # Enhanced Read-Only File System. + "exofs" # EXOFS filesystem. + "f2fs" # Flash-Friendly File System. + "freevxfs" # Veritas VxFS filesystem. + "gfs2" # Global Filesystem 2. + "hfs" # Classic Mac HFS; hfsplus is a separate module and is not blacklisted. + "hpfs" # OS/2 High Performance File System. + "jffs2" # Journaling Flash File System v2. + "jfs" # IBM JFS filesystem. + "ksmbd" # SMB3 server module; the CIFS client is not blacklisted. + "minix" # Minix filesystem. + "nilfs2" # New Implementation of Log-structured File System v2. + "omfs" # Open Micro File System. + "qnx4" # QNX 4 filesystem. + "qnx6" # QNX 6 filesystem. + "sysv" # System V filesystem. + "udf" # DVD/ISO filesystem; load manually if mounting is needed on the host. + "vivid" # Virtual video test driver. + "firewire-core" # FireWire core stack. + "thunderbolt" # Thunderbolt networking/storage driver stack. + ]; + }; +} diff --git a/modules/nixos/common/common-packages.ulu.nix b/modules/nixos/common/common-packages.ulu.nix index 683a1c6..ddc4534 100644 --- a/modules/nixos/common/common-packages.ulu.nix +++ b/modules/nixos/common/common-packages.ulu.nix @@ -131,7 +131,6 @@ usbutils hfsprogs dmg2img - ddcutil clinfo hidapi parted diff --git a/modules/nixos/common/common-users.ulu.nix b/modules/nixos/common/common-users.ulu.nix index 42ffb1e..4e662dd 100644 --- a/modules/nixos/common/common-users.ulu.nix +++ b/modules/nixos/common/common-users.ulu.nix @@ -17,7 +17,6 @@ "input" "audio" "wheel" - "i2c" "lp" ]; shell = pkgs.zsh;