108 lines
2.7 KiB
Nix
108 lines
2.7 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
...
|
|
}:
|
|
with lib;
|
|
{
|
|
config = mkIf config.hd.common.security.enable {
|
|
boot = {
|
|
kernel.sysctl = {
|
|
"net.ipv4.icmp_ignore_bogus_error_responses" = 1;
|
|
|
|
"net.ipv4.conf.default.rp_filter" = 1;
|
|
"net.ipv4.conf.all.rp_filter" = 1;
|
|
|
|
"net.ipv4.conf.all.accept_source_route" = 0;
|
|
"net.ipv6.conf.all.accept_source_route" = 0;
|
|
"net.ipv4.conf.all.send_redirects" = 0;
|
|
"net.ipv4.conf.default.send_redirects" = 0;
|
|
"net.ipv4.conf.all.accept_redirects" = 0;
|
|
"net.ipv4.conf.default.accept_redirects" = 0;
|
|
"net.ipv4.conf.all.secure_redirects" = 0;
|
|
"net.ipv4.conf.default.secure_redirects" = 0;
|
|
"net.ipv6.conf.all.accept_redirects" = 0;
|
|
"net.ipv6.conf.default.accept_redirects" = 0;
|
|
|
|
"net.ipv4.tcp_syncookies" = 1;
|
|
"net.ipv4.tcp_rfc1337" = 1;
|
|
|
|
"net.ipv4.tcp_fastopen" = 3;
|
|
|
|
"kernel.kptr_restrict" = 2;
|
|
"randomize_kstack_offset" = "on";
|
|
"spec_store_bypass_disable" = "on";
|
|
};
|
|
# otherwise /tmp is on disk. This *may* be problematic as nix
|
|
# builds in /tmp but I think my swap is large enough...
|
|
tmp.useTmpfs = lib.mkDefault true;
|
|
tmp.cleanOnBoot = lib.mkDefault (!config.boot.tmp.useTmpfs);
|
|
|
|
kernelParams = [
|
|
"init_on_free=1" # zero freed pages
|
|
"page_alloc.shuffle=1"
|
|
"page_poison=1"
|
|
"slab_nomerge"
|
|
# "slub_debug=FZ" # disabled due to https://lore.kernel.org/all/20210601182202.3011020-5-swboyd@chromium.org/T/#u
|
|
"vsyscall=none" # diable virtual syscalls
|
|
];
|
|
|
|
blacklistedKernelModules = [
|
|
"ax25"
|
|
"netrom"
|
|
"rose"
|
|
"adfs"
|
|
"affs"
|
|
"bfs"
|
|
"befs"
|
|
"cramfs"
|
|
"efs"
|
|
"erofs"
|
|
"exofs"
|
|
"freevxfs"
|
|
"f2fs"
|
|
"hfs"
|
|
"hpfs"
|
|
"jfs"
|
|
"minix"
|
|
"nilfs2"
|
|
"ntfs"
|
|
"omfs"
|
|
"qnx4"
|
|
"qnx6"
|
|
"sysv"
|
|
"ufs"
|
|
];
|
|
};
|
|
|
|
networking.firewall.enable = true;
|
|
|
|
security = {
|
|
protectKernelImage = true;
|
|
forcePageTableIsolation = true;
|
|
|
|
apparmor.enable = true;
|
|
apparmor.killUnconfinedConfinables = true;
|
|
|
|
sudo.enable = false;
|
|
|
|
doas = {
|
|
enable = true;
|
|
extraRules = [
|
|
{
|
|
groups = [ "wheel" ];
|
|
persist = true;
|
|
keepEnv = true;
|
|
}
|
|
];
|
|
};
|
|
|
|
# Pam checks wether you have a blank password before prompting your
|
|
# credentials. This computes yescrypt hash of "" which causes annoying
|
|
# delay before prompting for the `doas` password.
|
|
pam.services.doas.allowNullPassword = lib.mkForce false;
|
|
|
|
pki.certificateFiles = [ ../../pki/ca.cert ];
|
|
};
|
|
};
|
|
}
|