|
1 | | -# A profile with most (vanilla) hardening options enabled by default, |
2 | | -# potentially at the cost of stability, features and performance. |
3 | | -# |
4 | | -# This profile enables options that are known to affect system |
5 | | -# stability. If you experience any stability issues when using the |
6 | | -# profile, try disabling it. If you report an issue and use this |
7 | | -# profile, always mention that you do. |
| 1 | +# This profile included most standard hardening options enabled by default, |
| 2 | +# which may have impacted system stability, feature availability, and performance. |
8 | 3 |
|
| 4 | +{ lib, ... }: |
9 | 5 | { |
10 | | - config, |
11 | | - lib, |
12 | | - pkgs, |
13 | | - ... |
14 | | -}: |
15 | | -let |
16 | | - inherit (lib) |
17 | | - mkDefault |
18 | | - mkOverride |
19 | | - mkEnableOption |
20 | | - mkIf |
21 | | - maintainers |
22 | | - ; |
23 | | -in |
24 | | -{ |
25 | | - options.profiles.hardened = mkEnableOption "hardened" // { |
26 | | - default = true; |
27 | | - example = false; |
28 | | - }; |
29 | | - config = mkIf config.profiles.hardened { |
30 | | - meta = { |
31 | | - maintainers = [ |
32 | | - maintainers.emily |
33 | | - ]; |
34 | | - }; |
35 | | - |
36 | | - boot.kernelPackages = mkDefault pkgs.linuxKernel.packages.linux_hardened; |
37 | | - |
38 | | - nix.settings.allowed-users = mkDefault [ "@users" ]; |
39 | | - |
40 | | - environment.memoryAllocator.provider = mkDefault "scudo"; |
41 | | - environment.variables.SCUDO_OPTIONS = mkDefault "zero_contents=true"; |
42 | | - |
43 | | - security.lockKernelModules = mkDefault true; |
44 | | - |
45 | | - security.protectKernelImage = mkDefault true; |
46 | | - |
47 | | - security.allowSimultaneousMultithreading = mkDefault false; |
48 | | - |
49 | | - security.forcePageTableIsolation = mkDefault true; |
50 | | - |
51 | | - # This is required by podman to run containers in rootless mode. |
52 | | - security.unprivilegedUsernsClone = mkDefault config.virtualisation.containers.enable; |
53 | | - |
54 | | - security.virtualisation.flushL1DataCache = mkDefault "always"; |
55 | | - |
56 | | - security.apparmor.enable = mkDefault true; |
57 | | - security.apparmor.killUnconfinedConfinables = mkDefault true; |
58 | | - |
59 | | - boot.kernelParams = [ |
60 | | - # Don't merge slabs |
61 | | - "slab_nomerge" |
62 | | - |
63 | | - # Overwrite free'd pages |
64 | | - "page_poison=1" |
65 | | - |
66 | | - # Enable page allocator randomization |
67 | | - "page_alloc.shuffle=1" |
68 | | - |
69 | | - # Disable debugfs |
70 | | - "debugfs=off" |
71 | | - ]; |
72 | | - |
73 | | - boot.blacklistedKernelModules = [ |
74 | | - # Obscure network protocols |
75 | | - "ax25" |
76 | | - "netrom" |
77 | | - "rose" |
78 | | - |
79 | | - # Old or rare or insufficiently audited filesystems |
80 | | - "adfs" |
81 | | - "affs" |
82 | | - "bfs" |
83 | | - "befs" |
84 | | - "cramfs" |
85 | | - "efs" |
86 | | - "erofs" |
87 | | - "exofs" |
88 | | - "freevxfs" |
89 | | - "f2fs" |
90 | | - "hfs" |
91 | | - "hpfs" |
92 | | - "jfs" |
93 | | - "minix" |
94 | | - "nilfs2" |
95 | | - "ntfs" |
96 | | - "omfs" |
97 | | - "qnx4" |
98 | | - "qnx6" |
99 | | - "sysv" |
100 | | - "ufs" |
101 | | - ]; |
102 | | - |
103 | | - # Hide kptrs even for processes with CAP_SYSLOG |
104 | | - boot.kernel.sysctl."kernel.kptr_restrict" = mkOverride 500 2; |
105 | | - |
106 | | - # Disable bpf() JIT (to eliminate spray attacks) |
107 | | - boot.kernel.sysctl."net.core.bpf_jit_enable" = mkDefault false; |
108 | | - |
109 | | - # Disable ftrace debugging |
110 | | - boot.kernel.sysctl."kernel.ftrace_enabled" = mkDefault false; |
111 | | - |
112 | | - # Enable strict reverse path filtering (that is, do not attempt to route |
113 | | - # packets that "obviously" do not belong to the iface's network; dropped |
114 | | - # packets are logged as martians). |
115 | | - boot.kernel.sysctl."net.ipv4.conf.all.log_martians" = mkDefault true; |
116 | | - boot.kernel.sysctl."net.ipv4.conf.all.rp_filter" = mkDefault "1"; |
117 | | - boot.kernel.sysctl."net.ipv4.conf.default.log_martians" = mkDefault true; |
118 | | - boot.kernel.sysctl."net.ipv4.conf.default.rp_filter" = mkDefault "1"; |
119 | | - |
120 | | - # Ignore broadcast ICMP (mitigate SMURF) |
121 | | - boot.kernel.sysctl."net.ipv4.icmp_echo_ignore_broadcasts" = mkDefault true; |
122 | | - |
123 | | - # Ignore incoming ICMP redirects (note: default is needed to ensure that the |
124 | | - # setting is applied to interfaces added after the sysctls are set) |
125 | | - boot.kernel.sysctl."net.ipv4.conf.all.accept_redirects" = mkDefault false; |
126 | | - boot.kernel.sysctl."net.ipv4.conf.all.secure_redirects" = mkDefault false; |
127 | | - boot.kernel.sysctl."net.ipv4.conf.default.accept_redirects" = mkDefault false; |
128 | | - boot.kernel.sysctl."net.ipv4.conf.default.secure_redirects" = mkDefault false; |
129 | | - boot.kernel.sysctl."net.ipv6.conf.all.accept_redirects" = mkDefault false; |
130 | | - boot.kernel.sysctl."net.ipv6.conf.default.accept_redirects" = mkDefault false; |
131 | | - |
132 | | - # Ignore outgoing ICMP redirects (this is ipv4 only) |
133 | | - boot.kernel.sysctl."net.ipv4.conf.all.send_redirects" = mkDefault false; |
134 | | - boot.kernel.sysctl."net.ipv4.conf.default.send_redirects" = mkDefault false; |
135 | | - }; |
| 6 | + imports = [ |
| 7 | + (lib.mkRemovedOptionModule [ "profiles" "hardened" ] '' |
| 8 | + The hardened profile has been removed, see the backward incompatibilities section of the 26.05 release notes for more information. |
| 9 | + '') |
| 10 | + ]; |
136 | 11 | } |
0 commit comments