aviallon/nixos-lib
1
0
Fork 0
mirror of https://github.com/aviallon/nixos-lib.git synced 2026-04-05 17:27:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

[Hardening] refactor overrides and make them more coherent

Browse source 
Especially, the priority was very wrong
This commit is contained in:
Antoine Viallon 2024-03-08 23:15:05 +01:00
parent a7067262de
commit f3ccaff561
Signed by: aviallon
GPG key ID: 186FC35EDEB25716
1 changed files with 9 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

17
security/hardening.nix
View file

@ -3,6 +3,7 @@ with lib;
let let
cfg = config.aviallon.hardening; cfg = config.aviallon.hardening;
desktopCfg = config.aviallon.desktop; desktopCfg = config.aviallon.desktop;
mkQuasiForce = x: lib.mkOverride 2 x;
in in
{ {
options.aviallon.hardening = { options.aviallon.hardening = {
@ -42,10 +43,10 @@ in
# (modulesPath + "/profiles/hardened.nix") # (modulesPath + "/profiles/hardened.nix")
# ]; # ];
aviallon.boot.kernel.package = mkIf cfg.hardcore pkgs.linuxKernel.kernels.linux_hardened; aviallon.boot.kernel.package = mkIf cfg.hardcore pkgs.linuxKernel.kernels.linux_hardened;
security.lockKernelModules = mkIf cfg.hardcore (mkOverride 500 true); security.lockKernelModules = mkIf cfg.hardcore (mkQuasiForce true);
# security.protectKernelImage = mkIf cfg.hardcore (mkOverride 500 false); # needed for kexec # security.protectKernelImage = mkIf cfg.hardcore (mkOverride 500 false); # needed for kexec
aviallon.hardening.expensive = mkIf cfg.hardcore (mkForce true); aviallon.hardening.expensive = mkIf cfg.hardcore (mkQuasiForce true);
security.sudo.execWheelOnly = true; security.sudo.execWheelOnly = true;
@ -83,14 +84,14 @@ in
boot.kernel.sysctl = { boot.kernel.sysctl = {
# Almost free security. https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html # Almost free security. https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html
"kernel.yama.ptrace_scope" = mkOverride 999 1; "kernel.yama.ptrace_scope" = mkQuasiForce 1;
# https://lwn.net/Articles/420403/ # https://lwn.net/Articles/420403/
"kernel.kptr_restrict" = mkOverride 999 2; "kernel.kptr_restrict" = mkQuasiForce 2;
# Can be used by developers. Should be disabled on regular desktops. # Can be used by developers. Should be disabled on regular desktops.
# https://www.kernel.org/doc/html/latest/trace/ftrace.html # https://www.kernel.org/doc/html/latest/trace/ftrace.html
"kernel.ftrace_enabled" = mkIf cfg.hardcore (mkOverride 999 false); "kernel.ftrace_enabled" = mkIf cfg.hardcore (mkQuasiForce false);
}; };
# Is used in podman containers, for instance # Is used in podman containers, for instance
@ -98,11 +99,11 @@ in
# boot.blacklistedKernelModules = mkForce [ ]; # boot.blacklistedKernelModules = mkForce [ ];
# Only authorize admins to use nix in hardcore mode # Only authorize admins to use nix in hardcore mode
nix.allowedUsers = mkIf cfg.hardcore (mkForce [ "@wheel" ]); nix.allowedUsers = mkIf cfg.hardcore (mkQuasiForce [ "@wheel" ]);
# Can really badly affect performance in some occasions. # Can really badly affect performance in some occasions.
security.audit.enable = mkIf cfg.expensive true; security.audit.enable = mkDefault true;
security.auditd.enable = mkIf cfg.expensive true; security.auditd.enable = mkQuasiForce false;
security.audit.rules = concatLists [ security.audit.rules = concatLists [
(optional cfg.expensive "-a exit,always -F arch=b64 -S execve") (optional cfg.expensive "-a exit,always -F arch=b64 -S execve")