ilyakooo0/nixpkgs
1
0
Fork 0
mirror of https://github.com/ilyakooo0/nixpkgs.git synced 2024-12-29 06:45:54 +03:00
Code Issues Projects Releases Wiki Activity

GCE image: Remove some unnecessary lib prefixes.

Browse Source
This commit is contained in:
Rob Vermaas 2015-03-26 09:15:09 +00:00
parent 80202fbd25
commit cbb14299c9
1 changed files with 25 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
nixos/modules/virtualisation/google-compute-image.nix
View File

@ -8,7 +8,7 @@ in
imports = [ ../profiles/headless.nix ../profiles/qemu-guest.nix ]; imports = [ ../profiles/headless.nix ../profiles/qemu-guest.nix ];
# https://cloud.google.com/compute/docs/tutorials/building-images # https://cloud.google.com/compute/docs/tutorials/building-images
networking.firewall.enable = lib.mkDefault false; networking.firewall.enable = mkDefault false;
system.build.googleComputeImage = system.build.googleComputeImage =
pkgs.vmTools.runInLinuxVM ( pkgs.vmTools.runInLinuxVM (
@ -112,7 +112,7 @@ in
# at instance creation time. # at instance creation time.
services.openssh.enable = true; services.openssh.enable = true;
services.openssh.permitRootLogin = "without-password"; services.openssh.permitRootLogin = "without-password";
services.openssh.passwordAuthentication = false; services.openssh.passwordAuthentication = mkDefault false;
# Force getting the hostname from Google Compute. # Force getting the hostname from Google Compute.
networking.hostName = mkDefault ""; networking.hostName = mkDefault "";
@ -188,73 +188,73 @@ in
# Setings taken from https://cloud.google.com/compute/docs/tutorials/building-images#providedkernel # Setings taken from https://cloud.google.com/compute/docs/tutorials/building-images#providedkernel
boot.kernel.sysctl = { boot.kernel.sysctl = {
# enables syn flood protection # enables syn flood protection
"net.ipv4.tcp_syncookies" = lib.mkDefault "1"; "net.ipv4.tcp_syncookies" = mkDefault "1";
# ignores source-routed packets # ignores source-routed packets
"net.ipv4.conf.all.accept_source_route" = lib.mkDefault "0"; "net.ipv4.conf.all.accept_source_route" = mkDefault "0";
# ignores source-routed packets # ignores source-routed packets
"net.ipv4.conf.default.accept_source_route" = lib.mkDefault "0"; "net.ipv4.conf.default.accept_source_route" = mkDefault "0";
# ignores ICMP redirects # ignores ICMP redirects
"net.ipv4.conf.all.accept_redirects" = lib.mkDefault "0"; "net.ipv4.conf.all.accept_redirects" = mkDefault "0";
# ignores ICMP redirects # ignores ICMP redirects
"net.ipv4.conf.default.accept_redirects" = lib.mkDefault "0"; "net.ipv4.conf.default.accept_redirects" = mkDefault "0";
# ignores ICMP redirects from non-GW hosts # ignores ICMP redirects from non-GW hosts
"net.ipv4.conf.all.secure_redirects" = lib.mkDefault "1"; "net.ipv4.conf.all.secure_redirects" = mkDefault "1";
# ignores ICMP redirects from non-GW hosts # ignores ICMP redirects from non-GW hosts
"net.ipv4.conf.default.secure_redirects" = lib.mkDefault "1"; "net.ipv4.conf.default.secure_redirects" = mkDefault "1";
# don't allow traffic between networks or act as a router # don't allow traffic between networks or act as a router
"net.ipv4.ip_forward" = lib.mkDefault "0"; "net.ipv4.ip_forward" = mkDefault "0";
# don't allow traffic between networks or act as a router # don't allow traffic between networks or act as a router
"net.ipv4.conf.all.send_redirects" = lib.mkDefault "0"; "net.ipv4.conf.all.send_redirects" = mkDefault "0";
# don't allow traffic between networks or act as a router # don't allow traffic between networks or act as a router
"net.ipv4.conf.default.send_redirects" = lib.mkDefault "0"; "net.ipv4.conf.default.send_redirects" = mkDefault "0";
# reverse path filtering - IP spoofing protection # reverse path filtering - IP spoofing protection
"net.ipv4.conf.all.rp_filter" = lib.mkDefault "1"; "net.ipv4.conf.all.rp_filter" = mkDefault "1";
# reverse path filtering - IP spoofing protection # reverse path filtering - IP spoofing protection
"net.ipv4.conf.default.rp_filter" = lib.mkDefault "1"; "net.ipv4.conf.default.rp_filter" = mkDefault "1";
# ignores ICMP broadcasts to avoid participating in Smurf attacks # ignores ICMP broadcasts to avoid participating in Smurf attacks
"net.ipv4.icmp_echo_ignore_broadcasts" = lib.mkDefault "1"; "net.ipv4.icmp_echo_ignore_broadcasts" = mkDefault "1";
# ignores bad ICMP errors # ignores bad ICMP errors
"net.ipv4.icmp_ignore_bogus_error_responses" = lib.mkDefault "1"; "net.ipv4.icmp_ignore_bogus_error_responses" = mkDefault "1";
# logs spoofed, source-routed, and redirect packets # logs spoofed, source-routed, and redirect packets
"net.ipv4.conf.all.log_martians" = lib.mkDefault "1"; "net.ipv4.conf.all.log_martians" = mkDefault "1";
# log spoofed, source-routed, and redirect packets # log spoofed, source-routed, and redirect packets
"net.ipv4.conf.default.log_martians" = lib.mkDefault "1"; "net.ipv4.conf.default.log_martians" = mkDefault "1";
# implements RFC 1337 fix # implements RFC 1337 fix
"net.ipv4.tcp_rfc1337" = lib.mkDefault "1"; "net.ipv4.tcp_rfc1337" = mkDefault "1";
# randomizes addresses of mmap base, heap, stack and VDSO page # randomizes addresses of mmap base, heap, stack and VDSO page
"kernel.randomize_va_space" = lib.mkDefault "2"; "kernel.randomize_va_space" = mkDefault "2";
# provides protection from ToCToU races # provides protection from ToCToU races
"fs.protected_hardlinks" = lib.mkDefault "1"; "fs.protected_hardlinks" = mkDefault "1";
# provides protection from ToCToU races # provides protection from ToCToU races
"fs.protected_symlinks" = lib.mkDefault "1"; "fs.protected_symlinks" = mkDefault "1";
# makes locating kernel addresses more difficult # makes locating kernel addresses more difficult
"kernel.kptr_restrict" = lib.mkDefault "1"; "kernel.kptr_restrict" = mkDefault "1";
# set ptrace protections # set ptrace protections
"kernel.yama.ptrace_scope" = lib.mkDefault "1"; "kernel.yama.ptrace_scope" = mkDefault "1";
# set perf only available to root # set perf only available to root
"kernel.perf_event_paranoid" = lib.mkDefault "2"; "kernel.perf_event_paranoid" = mkDefault "2";
}; };