Merge pull request #138516 from rnhmjoj/lock-kernel-fix
nixos/lock-kernel-modules: reorder before/after
commitea1eae5b47014d721080ec464fe44ff72f95467e
authorMichele Guerini Rocco <rnhmjoj@users.noreply.github.com>
dateMon 20 Sep 2021, 15:13 (5 years ago)
parent23acc561bd7260
nixos/modules/security/lock-kernel-modules.nix+1−1
@@ -35,10 +35,10 @@ with lib;
3535 wants = [ "systemd-udevd.service" ];
3636 wantedBy = [ config.systemd.defaultUnit ];
3737
38− before = [ config.systemd.defaultUnit ];
3938 after =
4039 [ "firewall.service"
4140 "systemd-modules-load.service"
41+ config.systemd.defaultUnit
4242 ];
4343
4444 unitConfig.ConditionPathIsReadWrite = "/proc/sys/kernel";
nixos/tests/hardened.nix+1
@@ -57,6 +57,7 @@ import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... } : {
5757 # Test kernel module hardening
5858 with subtest("No more kernel modules can be loaded"):
5959 # note: this better a be module we normally wouldn't load ...
60+ machine.wait_for_unit("disable-kernel-module-loading.service")
6061 machine.fail("modprobe dccp")
6162
6263