ilyakooo0/nixpkgs
1
0
Fork 0
mirror of https://github.com/ilyakooo0/nixpkgs.git synced 2024-10-16 09:28:35 +03:00
Code Issues Projects Releases Wiki Activity

Merge pull request #138001 from rnhmjoj/lock-kernel-udev

Browse Source 
nixos/lock-kernel-modules: use `udevadm settle`
This commit is contained in:
Michele Guerini Rocco 2021-09-15 23:00:13 +02:00 committed by GitHub
commit 0d1656e631
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 19 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
nixos/modules/security/lock-kernel-modules.nix
View File

@ -1,4 +1,4 @@
{ config, lib, ... }:
{ config, pkgs, lib, ... }:
with lib;
@ -13,7 +13,7 @@ with lib;
default = false;
description = ''
Disable kernel module loading once the system is fully initialised.
Module loading is disabled until the next reboot. Problems caused
Module loading is disabled until the next reboot. Problems caused
by delayed module loading can be fixed by adding the module(s) in
question to <option>boot.kernelModules</option>.
'';
@ -29,20 +29,30 @@ with lib;
else [ x.fsType ]
else []) config.system.build.fileSystems;
systemd.services.disable-kernel-module-loading = rec {
systemd.services.disable-kernel-module-loading = {
description = "Disable kernel module loading";
wants = [ "systemd-udevd.service" ];
wantedBy = [ config.systemd.defaultUnit ];
after = [ "systemd-udev-settle.service" "firewall.service" "systemd-modules-load.service" ] ++ wantedBy;
before = [ config.systemd.defaultUnit ];
after =
[ "firewall.service"
"systemd-modules-load.service"
];
unitConfig.ConditionPathIsReadWrite = "/proc/sys/kernel";
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStart = "/bin/sh -c 'echo -n 1 >/proc/sys/kernel/modules_disabled'";
};
serviceConfig =
{ Type = "oneshot";
RemainAfterExit = true;
TimeoutSec = 180;
};
script = ''
${pkgs.udev}/bin/udevadm settle
echo -n 1 >/proc/sys/kernel/modules_disabled
'';
};
};
}