mirror of
https://github.com/elwrcl/copnix.git
synced 2026-10-31 22:28:03 +03:00
70 lines
3.0 KiB
Nix
70 lines
3.0 KiB
Nix
{ ... }:
|
|
{
|
|
flake.nixosModules.common-hardening =
|
|
{ ... }:
|
|
{
|
|
boot.kernel.sysctl = {
|
|
"kernel.dmesg_restrict" = 1; # Restrict dmesg access to privileged users.
|
|
"kernel.unprivileged_bpf_disabled" = 1; # Disable unprivileged BPF to reduce attack surface.
|
|
"fs.protected_fifos" = 2; # Prevent unsafe FIFO use in sticky world-writable dirs.
|
|
"fs.protected_regular" = 2; # Prevent unsafe regular file access in sticky world-writable dirs.
|
|
};
|
|
|
|
boot.kernelParams = [
|
|
"randomize_kstack_offset=on" # Randomize kernel stack offset for harder exploitation.
|
|
"page_alloc.shuffle=1" # Randomize page allocator free lists.
|
|
"slab_nomerge" # Disable slab merging to reduce cross-cache attacks.
|
|
"vsyscall=xonly" # Keep legacy vsyscall execute-only for compatibility with less exposure.
|
|
];
|
|
|
|
boot.blacklistedKernelModules = [
|
|
"af_802154" # IEEE 802.15.4 wireless networking stack.
|
|
"appletalk" # AppleTalk networking stack.
|
|
"atm" # Asynchronous Transfer Mode networking.
|
|
"ax25" # Amateur X.25 networking.
|
|
"can" # Controller Area Network; used for vehicle and industrial buses.
|
|
"dccp" # Datagram Congestion Control Protocol.
|
|
"decnet" # DECnet networking stack.
|
|
"econet" # Acorn Econet networking.
|
|
"ipx" # Novell IPX protocol stack.
|
|
"n-hdlc" # HDLC framing support.
|
|
"netrom" # NetRom amateur packet networking.
|
|
"p8022" # IEEE 802.2 LLC networking.
|
|
"p8023" # Novell raw IEEE 802.3 Ethernet.
|
|
"psnap" # IEEE 802.2 SNAP protocol.
|
|
"rds" # Reliable Datagram Sockets.
|
|
"rose" # ROSE networking stack.
|
|
"sctp" # Stream Control Transmission Protocol.
|
|
"tipc" # Transparent Inter-Process Communication.
|
|
"x25" # CCITT X.25 networking.
|
|
|
|
"adfs" # Adaptec ADFS filesystem.
|
|
"affs" # Amiga Fast File System.
|
|
"befs" # BeOS File System.
|
|
"bfs" # BFS filesystem.
|
|
"cramfs" # Compressed ROM filesystem.
|
|
"efs" # EFS filesystem.
|
|
"erofs" # Enhanced Read-Only File System.
|
|
"exofs" # EXOFS filesystem.
|
|
"f2fs" # Flash-Friendly File System.
|
|
"freevxfs" # Veritas VxFS filesystem.
|
|
"gfs2" # Global Filesystem 2.
|
|
"hfs" # Classic Mac HFS; hfsplus is a separate module and is not blacklisted.
|
|
"hpfs" # OS/2 High Performance File System.
|
|
"jffs2" # Journaling Flash File System v2.
|
|
"jfs" # IBM JFS filesystem.
|
|
"ksmbd" # SMB3 server module; the CIFS client is not blacklisted.
|
|
"minix" # Minix filesystem.
|
|
"nilfs2" # New Implementation of Log-structured File System v2.
|
|
"omfs" # Open Micro File System.
|
|
"qnx4" # QNX 4 filesystem.
|
|
"qnx6" # QNX 6 filesystem.
|
|
"sysv" # System V filesystem.
|
|
"udf" # DVD/ISO filesystem; load manually if mounting is needed on the host.
|
|
"vivid" # Virtual video test driver.
|
|
"firewire-core" # FireWire core stack.
|
|
"thunderbolt" # Thunderbolt networking/storage driver stack.
|
|
];
|
|
};
|
|
}
|