boiling opsec

hosts/copland.ulu.nix

@@ -95,6 +95,9 @@ in
       { elars.expectedHostName = "copland"; }
       # pool
       config.flake.nixosModules.common-boot
+      config.flake.nixosModules.common-kernel
+      config.flake.nixosModules.common-hardening
+      config.flake.nixosModules.common-crashlog
       config.flake.nixosModules.hw-bluetooth
       config.flake.nixosModules.hw-graphics
       config.flake.nixosModules.hw-intel-hard

modules/home/home-noctalia.ulu.nix

@@ -37,7 +37,7 @@
           };
 
           brightness = {
-            enable_ddcutil = true;
+            enable_ddcutil = false;
             minimum_brightness = 0.01;
           };
 

modules/nixos/common/common-boot.ulu.nix

@@ -1,35 +1,9 @@
 { ... }:
 {
   flake.nixosModules.common-boot =
-    {
+    { pkgs, ... }:
-      pkgs,
-      inputs,
-      ...
-    }:
     {
       environment.systemPackages = [ pkgs.efibootmgr ];
-      boot.kernelPackages = pkgs.linuxPackages_latest;
-      # todo soryu kernel, opsec modules ..
-      boot.kernelParams = [
-        "mitigations=off"
-        "nmi_watchdog=1"
-        "transparent_hugepage=madvise"
-      ];
-
-      boot.kernelModules = [
-        "tcp_bbr"
-        "sch_fq"
-      ];
-
-      hardware.i2c.enable = true;
-      boot.kernel.sysctl = {
-        "net.core.default_qdisc" = "fq";
-        "net.ipv4.tcp_congestion_control" = "bbr";
-        "kernel.softlockup_panic" = 1;
-        "kernel.hardlockup_panic" = 1;
-        "kernel.hung_task_panic" = 1;
-        "kernel.panic" = 50;
-      };
 
       boot.loader = {
         timeout = 5;

modules/nixos/common/common-crashlog.ulu.nix

@@ -0,0 +1,136 @@
+{ ... }:
+{
+  flake.nixosModules.common-crashlog =
+    { pkgs, ... }:
+    let
+      netconsole = pkgs.writeShellApplication {
+        name = "netconsole-on";
+        runtimeInputs = [
+          pkgs.iproute2
+          pkgs.kmod
+        ];
+        text = ''
+          TARGET_DIR=/sys/kernel/config/netconsole/copland
+          usage() {
+            echo "usage: netconsole-on <ip> <target-mac> [interface] [port]" >&2
+            echo "          netconsole-on off" >&2
+            echo "" >&2
+            echo "  e.g.: netconsole-on 192.168.1.10 aa:bb:cc:dd:ee:ff" >&2
+            echo "  on the receiving side: nc -u -l 6666" >&2
+            echo "" >&2
+            echo "  target-mac: if the target is on the same network, use the target's MAC" >&2
+            echo "              otherwise use the gateway's MAC (find it with ip neigh)" >&2
+            exit 1
+          }
+
+          if [ "''${1:-}" = "off" ]; then
+            if [ -d "$TARGET_DIR" ]; then
+              echo 0 > "$TARGET_DIR/enabled" || true
+              rmdir "$TARGET_DIR"
+              echo "netconsole disabled"
+            else
+              echo "netconsole already disabled"
+            fi
+            exit 0
+          fi
+
+          [ "$#" -ge 2 ] || usage
+
+          TARGET_IP="$1"
+          TARGET_MAC="$2"
+          IFACE="''${3:-enp8s0}"
+          PORT="''${4:-6666}"
+
+          LOCAL_IP="$(ip -4 -o addr show dev "$IFACE" | awk '{print $4}' | cut -d/ -f1 | head -1)"
+          if [ -z "$LOCAL_IP" ]; then
+            echo "error: no IPv4 address on $IFACE (is the cable plugged in?)" >&2
+            exit 1
+          fi
+
+          modprobe netconsole
+          [ -d "$TARGET_DIR" ] && { echo 0 > "$TARGET_DIR/enabled" || true; rmdir "$TARGET_DIR"; }
+          mkdir -p "$TARGET_DIR"
+
+          echo 1             > "$TARGET_DIR/extended"
+          echo "$IFACE"      > "$TARGET_DIR/dev_name"
+          echo "$LOCAL_IP"   > "$TARGET_DIR/local_ip"
+          echo "$TARGET_IP"  > "$TARGET_DIR/remote_ip"
+          echo "$TARGET_MAC" > "$TARGET_DIR/remote_mac"
+          echo "$PORT"       > "$TARGET_DIR/remote_port"
+          echo 1             > "$TARGET_DIR/enabled"
+
+          echo "netconsole enabled: $IFACE ($LOCAL_IP) -> $TARGET_IP:$PORT"
+          echo "listen on receiver: nc -u -l $PORT"
+          echo "test it:           echo 'netconsole test' | sudo tee /dev/kmsg"
+        '';
+      };
+
+      drmPanicDecode = pkgs.writeShellApplication {
+        name = "drm-panic-decode";
+        runtimeInputs = [
+          pkgs.zbar
+          pkgs.python3
+        ];
+        text = ''
+          if [ "$#" -lt 1 ]; then
+            echo "usage: drm-panic-decode <panic-screen-photo>" >&2
+            exit 1
+          fi
+
+          zbarimg --raw -q --oneshot -Sbinary "$1" | python3 -c '
+import sys, zlib
+data = sys.stdin.buffer.read()
+if not data:
+  sys.exit("Could not read QR: try taking a clearer/straighter photo")
+# Try raw deflate, zlib-wrapped, and gzip variants in order
+for wbits in (-15, 15, 47):
+    try:
+        sys.stdout.buffer.write(zlib.decompress(data, wbits))
+        break
+    except zlib.error:
+        continue
+else:
+  sys.stderr.write("warning: could not decompress, printing raw data\n")
+    sys.stdout.buffer.write(data)
+'
+        '';
+      };
+    in
+    {
+      environment.systemPackages = [
+        netconsole
+        drmPanicDecode
+      ];
+
+      boot.kernelParams = [
+        "reserve_mem=8M:4096:oops"
+        "drm.panic_screen=qr_code"
+      ];
+
+      boot.kernelModules = [
+        "ramoops"
+        "iTCO_wdt"
+      ];
+      boot.extraModprobeConfig = ''
+        options ramoops mem_name=oops record_size=262144 max_reason=3 ecc=1
+      '';
+
+      boot.kernel.sysctl = {
+        "kernel.panic" = 30;
+
+        "kernel.hardlockup_panic" = 1;
+
+        "kernel.softlockup_panic" = 1;
+
+        "kernel.hung_task_panic" = 1;
+
+        "kernel.hung_task_timeout_secs" = 300;
+
+        "kernel.sysrq" = 184;
+      };
+      systemd.settings.Manager = {
+        RuntimeWatchdogSec = "60s";
+        RebootWatchdogSec = "10min";
+      };
+    };
+}

modules/nixos/common/common-hardening.ulu.nix

@@ -0,0 +1,69 @@
+{ ... }:
+{
+  flake.nixosModules.common-hardening =
+    { ... }:
+    {
+      boot.kernel.sysctl = {
+        "kernel.dmesg_restrict" = 1; # Restrict dmesg access to privileged users.
+        "kernel.unprivileged_bpf_disabled" = 1; # Disable unprivileged BPF to reduce attack surface.
+        "fs.protected_fifos" = 2; # Prevent unsafe FIFO use in sticky world-writable dirs.
+        "fs.protected_regular" = 2; # Prevent unsafe regular file access in sticky world-writable dirs.
+      };
+
+      boot.kernelParams = [
+        "randomize_kstack_offset=on" # Randomize kernel stack offset for harder exploitation.
+        "page_alloc.shuffle=1" # Randomize page allocator free lists.
+        "slab_nomerge" # Disable slab merging to reduce cross-cache attacks.
+        "vsyscall=xonly" # Keep legacy vsyscall execute-only for compatibility with less exposure.
+      ];
+
+      boot.blacklistedKernelModules = [
+        "af_802154" # IEEE 802.15.4 wireless networking stack.
+        "appletalk" # AppleTalk networking stack.
+        "atm" # Asynchronous Transfer Mode networking.
+        "ax25" # Amateur X.25 networking.
+        "can" # Controller Area Network; used for vehicle and industrial buses.
+        "dccp" # Datagram Congestion Control Protocol.
+        "decnet" # DECnet networking stack.
+        "econet" # Acorn Econet networking.
+        "ipx" # Novell IPX protocol stack.
+        "n-hdlc" # HDLC framing support.
+        "netrom" # NetRom amateur packet networking.
+        "p8022" # IEEE 802.2 LLC networking.
+        "p8023" # Novell raw IEEE 802.3 Ethernet.
+        "psnap" # IEEE 802.2 SNAP protocol.
+        "rds" # Reliable Datagram Sockets.
+        "rose" # ROSE networking stack.
+        "sctp" # Stream Control Transmission Protocol.
+        "tipc" # Transparent Inter-Process Communication.
+        "x25" # CCITT X.25 networking.
+
+        "adfs" # Adaptec ADFS filesystem.
+        "affs" # Amiga Fast File System.
+        "befs" # BeOS File System.
+        "bfs" # BFS filesystem.
+        "cramfs" # Compressed ROM filesystem.
+        "efs" # EFS filesystem.
+        "erofs" # Enhanced Read-Only File System.
+        "exofs" # EXOFS filesystem.
+        "f2fs" # Flash-Friendly File System.
+        "freevxfs" # Veritas VxFS filesystem.
+        "gfs2" # Global Filesystem 2.
+        "hfs" # Classic Mac HFS; hfsplus is a separate module and is not blacklisted.
+        "hpfs" # OS/2 High Performance File System.
+        "jffs2" # Journaling Flash File System v2.
+        "jfs" # IBM JFS filesystem.
+        "ksmbd" # SMB3 server module; the CIFS client is not blacklisted.
+        "minix" # Minix filesystem.
+        "nilfs2" # New Implementation of Log-structured File System v2.
+        "omfs" # Open Micro File System.
+        "qnx4" # QNX 4 filesystem.
+        "qnx6" # QNX 6 filesystem.
+        "sysv" # System V filesystem.
+        "udf" # DVD/ISO filesystem; load manually if mounting is needed on the host.
+        "vivid" # Virtual video test driver.
+        "firewire-core" # FireWire core stack.
+        "thunderbolt" # Thunderbolt networking/storage driver stack.
+      ];
+    };
+}

modules/nixos/common/common-packages.ulu.nix

@@ -131,7 +131,6 @@
         usbutils
         hfsprogs
         dmg2img
-        ddcutil
         clinfo
         hidapi
         parted

modules/nixos/common/common-users.ulu.nix

@@ -17,7 +17,6 @@
           "input"
           "audio"
           "wheel"
-          "i2c"
           "lp"
         ];
         shell = pkgs.zsh;