colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/hardened profile: use the linux_hardened kernel

Browse Source
This commit is contained in:
Joachim Fasting 2017-04-30 01:22:32 +02:00
parent 62f2a1c2be
commit 8c98e8ca2f
No known key found for this signature in database
GPG Key ID: 7544761007FE4E08
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
nixos/modules/profiles/hardened.nix
View File

@ -6,6 +6,8 @@
with lib; with lib;
{ {
boot.kernelPackages = mkDefault pkgs.linuxPackages_hardened;
security.hideProcessInformation = mkDefault true; security.hideProcessInformation = mkDefault true;
security.lockKernelModules = mkDefault true; security.lockKernelModules = mkDefault true;
@ -13,6 +15,9 @@ with lib;
security.apparmor.enable = mkDefault true; security.apparmor.enable = mkDefault true;
boot.kernelParams = [ boot.kernelParams = [
# Overwrite free'd memory
"page_poison=1"
# Disable legacy virtual syscalls # Disable legacy virtual syscalls
"vsyscall=none" "vsyscall=none"
]; ];