aviallon/nixos-lib
1
0
Fork 0
mirror of https://github.com/aviallon/nixos-lib.git synced 2026-04-06 01:38:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

[Hardening] use hardened kernel by default, but do not force it

Browse source
This commit is contained in:
Antoine Viallon 2024-03-08 23:27:09 +01:00
parent 07893642d7
commit 3080d90d2c
Signed by: aviallon
GPG key ID: 186FC35EDEB25716
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
security/hardening.nix
View file

@ -35,7 +35,7 @@ in
]; ];
config = mkIf cfg.enable { config = mkIf cfg.enable {
aviallon.boot.kernel.package = mkIf cfg.hardcore pkgs.linuxKernel.kernels.linux_hardened; aviallon.boot.kernel.package = mkIf cfg.hardcore (mkDefault pkgs.linuxKernel.kernels.linux_hardened);
security.lockKernelModules = mkIf cfg.hardcore (mkQuasiForce true); security.lockKernelModules = mkIf cfg.hardcore (mkQuasiForce true);
# security.protectKernelImage = mkIf cfg.hardcore (mkOverride 500 false); # needed for kexec # security.protectKernelImage = mkIf cfg.hardcore (mkOverride 500 false); # needed for kexec