nixos/hardened: make pti=on overridable

Introduces a new security.forcePageTableIsolation option (default false on !hardened, true on hardened) that forces pti=on.
2019-07-30 02:24:56 +02:00
parent fd2b2b5cd5
commit 67b7e70865
2 changed files with 18 additions and 3 deletions
@@ -26,6 +26,8 @@ with lib;

  security.allowSimultaneousMultithreading = mkDefault false;

+  security.forcePageTableIsolation = mkDefault true;
+
  security.virtualisation.flushL1DataCache = mkDefault "always";

  security.apparmor.enable = mkDefault true;
@@ -42,9 +44,6 @@ with lib;

    # Disable legacy virtual syscalls
    "vsyscall=none"
-
-    # Enable PTI even if CPU claims to be safe from meltdown
-    "pti=on"
  ];

  boot.blacklistedKernelModules = [