cfg/common/security.nix
2025-10-04 14:04:17 +02:00

99 lines
2.2 KiB
Nix

{
config,
lib,
pkgs,
...
}:
{
boot = {
kernel.sysctl = {
"net.ipv4.icmp_ignore_bogus_error_responses" = 1;
"net.ipv4.conf.default.rp_filter" = 1;
"net.ipv4.conf.all.rp_filter" = 1;
"net.ipv4.conf.all.accept_source_route" = 0;
"net.ipv6.conf.all.accept_source_route" = 0;
"net.ipv4.conf.all.send_redirects" = 0;
"net.ipv4.conf.default.send_redirects" = 0;
"net.ipv4.conf.all.accept_redirects" = 0;
"net.ipv4.conf.default.accept_redirects" = 0;
"net.ipv4.conf.all.secure_redirects" = 0;
"net.ipv4.conf.default.secure_redirects" = 0;
"net.ipv6.conf.all.accept_redirects" = 0;
"net.ipv6.conf.default.accept_redirects" = 0;
"net.ipv4.tcp_syncookies" = 1;
"net.ipv4.tcp_rfc1337" = 1;
"net.ipv4.tcp_fastopen" = 3;
"kernel.kptr_restrict" = 2;
"randomize_kstack_offset" = "on";
"spec_store_bypass_disable" = "on";
};
# otherwise /tmp is on disk. This *may* be problematic as nix
# builds in /tmp but I think my swap is large enough...
tmp.useTmpfs = lib.mkDefault true;
tmp.cleanOnBoot = lib.mkDefault (!config.boot.tmp.useTmpfs);
kernelParams = [
"init_on_free=1" # zero freed pages
"page_alloc.shuffle=1"
"page_poison=1"
"slab_nomerge"
# "slub_debug=FZ" # disabled due to https://lore.kernel.org/all/20210601182202.3011020-5-swboyd@chromium.org/T/#u
"vsyscall=none" # diable virtual syscalls
];
blacklistedKernelModules = [
"ax25"
"netrom"
"rose"
"adfs"
"affs"
"bfs"
"befs"
"cramfs"
"efs"
"erofs"
"exofs"
"freevxfs"
"f2fs"
"hfs"
"hpfs"
"jfs"
"minix"
"nilfs2"
"ntfs"
"omfs"
"qnx4"
"qnx6"
"sysv"
"ufs"
];
};
security = {
protectKernelImage = true;
forcePageTableIsolation = true;
apparmor.enable = true;
apparmor.killUnconfinedConfinables = true;
sudo.enable = false;
doas = {
enable = true;
extraRules = [
{
groups = [ "wheel" ];
persist = true;
keepEnv = true;
}
];
};
pki.certificateFiles = [ ../pki/ca.cert ];
};
}