nixpkgs/nixos/modules/profiles
Tamara Schmitz b80c3284d5
nixos/hardened: update hardened profile to new recommendations
Borrowing from here to match hardened profile with more recent kernels:
* https://madaidans-insecurities.github.io/guides/linux-hardening.html?#boot-parameters
* https://github.com/a13xp0p0v/kernel-hardening-checker/

Removed "slub_debug" as that option disables kernel memory address
hashing. You also see a big warning about this in the dmesg:
"This system shows unhashed kernel memory addresses via the console, logs, and other interfaces."

"init_on_alloc=1" and "init_on_free=1" zeroes all SLAB and SLUB allocations. Introduced in 6471384af2a6530696fc0203bafe4de41a23c9ef. Also the default for the Android Google kernel btw. It is on by default through the KConfig.

"slab_nomerge" prevents the merging of slab/slub caches. These are
effectively slab/slub pools.

"LEGACY_VSYSCALL_NONE" disables the older vsyscall mechanic that relies on
static address. It got superseeded by vdsos a decade ago. Read some
LWN.net to learn more ;)

"debugfs=off" I'm sure there are some few userspace programs that rely on
debugfs, but they shouldn't.

Most other things mentioned on the blog where already the default on a
running machine or may not be applicable.

Most other Kconfigs changes come from the kernel hardening checker and
were added, when they were not applied to the kernel already.

Unsure about CONFIG_STATIC_USERMODEHELPER. Would need testing.
2024-01-27 20:43:58 +00:00
..
keys darwin.builder: init 2022-12-19 17:03:45 -08:00
all-hardware.nix Merge pull request #98633 from DavHau/patch-1 2022-12-01 16:07:29 +01:00
base.nix nixos/profiles/base: remove duplicate and optimize fsPackages 2023-03-03 23:32:48 +03:00
clone-config.nix nixos/*: automatically convert option docs 2022-08-06 20:39:12 +02:00
demo.nix
docker-container.nix nixos/docker-image: clean up let-in binding 2022-11-30 17:27:23 -05:00
graphical.nix
hardened.nix nixos/hardened: update hardened profile to new recommendations 2024-01-27 20:43:58 +00:00
headless.nix
image-based-appliance.nix nixos/profiles: add image-based-appliance profile 2023-10-28 13:26:39 +02:00
installation-device.nix nixos/installation-device: enable polkit 2024-01-23 16:10:31 +01:00
macos-builder.nix darwin.linux-builder: Disable installer tools 2023-11-19 21:33:58 +01:00
minimal.nix nixos/stub-ld: init module 2023-12-11 05:47:23 -05:00
perlless.nix nixos/profiles/perlless: init 2024-01-22 00:54:13 +01:00
qemu-guest.nix