boiling opsec

modules/nixos/common/common-hardening.ulu.nix

@@ -0,0 +1,69 @@
+{ ... }:
+{
+  flake.nixosModules.common-hardening =
+    { ... }:
+    {
+      boot.kernel.sysctl = {
+        "kernel.dmesg_restrict" = 1; # Restrict dmesg access to privileged users.
+        "kernel.unprivileged_bpf_disabled" = 1; # Disable unprivileged BPF to reduce attack surface.
+        "fs.protected_fifos" = 2; # Prevent unsafe FIFO use in sticky world-writable dirs.
+        "fs.protected_regular" = 2; # Prevent unsafe regular file access in sticky world-writable dirs.
+      };
+
+      boot.kernelParams = [
+        "randomize_kstack_offset=on" # Randomize kernel stack offset for harder exploitation.
+        "page_alloc.shuffle=1" # Randomize page allocator free lists.
+        "slab_nomerge" # Disable slab merging to reduce cross-cache attacks.
+        "vsyscall=xonly" # Keep legacy vsyscall execute-only for compatibility with less exposure.
+      ];
+
+      boot.blacklistedKernelModules = [
+        "af_802154" # IEEE 802.15.4 wireless networking stack.
+        "appletalk" # AppleTalk networking stack.
+        "atm" # Asynchronous Transfer Mode networking.
+        "ax25" # Amateur X.25 networking.
+        "can" # Controller Area Network; used for vehicle and industrial buses.
+        "dccp" # Datagram Congestion Control Protocol.
+        "decnet" # DECnet networking stack.
+        "econet" # Acorn Econet networking.
+        "ipx" # Novell IPX protocol stack.
+        "n-hdlc" # HDLC framing support.
+        "netrom" # NetRom amateur packet networking.
+        "p8022" # IEEE 802.2 LLC networking.
+        "p8023" # Novell raw IEEE 802.3 Ethernet.
+        "psnap" # IEEE 802.2 SNAP protocol.
+        "rds" # Reliable Datagram Sockets.
+        "rose" # ROSE networking stack.
+        "sctp" # Stream Control Transmission Protocol.
+        "tipc" # Transparent Inter-Process Communication.
+        "x25" # CCITT X.25 networking.
+
+        "adfs" # Adaptec ADFS filesystem.
+        "affs" # Amiga Fast File System.
+        "befs" # BeOS File System.
+        "bfs" # BFS filesystem.
+        "cramfs" # Compressed ROM filesystem.
+        "efs" # EFS filesystem.
+        "erofs" # Enhanced Read-Only File System.
+        "exofs" # EXOFS filesystem.
+        "f2fs" # Flash-Friendly File System.
+        "freevxfs" # Veritas VxFS filesystem.
+        "gfs2" # Global Filesystem 2.
+        "hfs" # Classic Mac HFS; hfsplus is a separate module and is not blacklisted.
+        "hpfs" # OS/2 High Performance File System.
+        "jffs2" # Journaling Flash File System v2.
+        "jfs" # IBM JFS filesystem.
+        "ksmbd" # SMB3 server module; the CIFS client is not blacklisted.
+        "minix" # Minix filesystem.
+        "nilfs2" # New Implementation of Log-structured File System v2.
+        "omfs" # Open Micro File System.
+        "qnx4" # QNX 4 filesystem.
+        "qnx6" # QNX 6 filesystem.
+        "sysv" # System V filesystem.
+        "udf" # DVD/ISO filesystem; load manually if mounting is needed on the host.
+        "vivid" # Virtual video test driver.
+        "firewire-core" # FireWire core stack.
+        "thunderbolt" # Thunderbolt networking/storage driver stack.
+      ];
+    };
+}