You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

69 lines
2.2 KiB

10 years ago
  1. { config, pkgs, ... }:
  2. with pkgs.lib;
  3. let
  4. sysctlOption = mkOptionType {
  5. name = "sysctl option value";
  6. check = x: builtins.isBool x || builtins.isString x || builtins.isInt x;
  7. merge = xs: last xs; # FIXME: hacky way to allow overriding in configuration.nix.
  8. };
  9. in
  10. {
  11. options = {
  12. boot.kernel.sysctl = mkOption {
  13. default = {};
  14. example = {
  15. "net.ipv4.tcp_syncookies" = false;
  16. "vm.swappiness" = 60;
  17. };
  18. type = types.attrsOf sysctlOption;
  19. description = ''
  20. Runtime parameters of the Linux kernel, as set by
  21. <citerefentry><refentrytitle>sysctl</refentrytitle>
  22. <manvolnum>8</manvolnum></citerefentry>. Note that sysctl
  23. parameters names must be enclosed in quotes
  24. (e.g. <literal>"vm.swappiness"</literal> instead of
  25. <literal>vm.swappiness</literal>). The value of each parameter
  26. may be a string, integer or Boolean.
  27. '';
  28. };
  29. };
  30. config = {
  31. environment.etc."sysctl.d/nixos.conf".text =
  32. concatStrings (mapAttrsToList (n: v: "${n}=${if v == false then "0" else toString v}\n") config.boot.kernel.sysctl);
  33. systemd.services.systemd-sysctl =
  34. { description = "Apply Kernel Variables";
  35. before = [ "sysinit.target" "shutdown.target" ];
  36. wantedBy = [ "sysinit.target" "multi-user.target" ];
  37. restartTriggers = [ config.environment.etc."sysctl.d/nixos.conf".source ];
  38. unitConfig.DefaultDependencies = false; # needed to prevent a cycle
  39. serviceConfig = {
  40. Type = "oneshot";
  41. RemainAfterExit = true;
  42. ExecStart = "${config.systemd.package}/lib/systemd/systemd-sysctl";
  43. };
  44. };
  45. # Enable hardlink and symlink restrictions. See
  46. # https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=800179c9b8a1e796e441674776d11cd4c05d61d7
  47. # for details.
  48. boot.kernel.sysctl."fs.protected_hardlinks" = true;
  49. boot.kernel.sysctl."fs.protected_symlinks" = true;
  50. # Hide kernel pointers (e.g. in /proc/modules) for unprivileged
  51. # users as these make it easier to exploit kernel vulnerabilities.
  52. boot.kernel.sysctl."kernel.kptr_restrict" = 1;
  53. };
  54. }