public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/hardened profile: use the linux_hardened kernel

Browse Source
This commit is contained in:
Joachim Fasting
2017-04-30 12:05:40 +02:00
parent 62f2a1c2be
commit 8c98e8ca2f
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/profiles/hardened.nix
+5
View File
@@ -6,6 +6,8 @@
with lib; with lib;
{ {
boot.kernelPackages = mkDefault pkgs.linuxPackages_hardened;
security.hideProcessInformation = mkDefault true; security.hideProcessInformation = mkDefault true;
security.lockKernelModules = mkDefault true; security.lockKernelModules = mkDefault true;
@@ -13,6 +15,9 @@ with lib;
security.apparmor.enable = mkDefault true; security.apparmor.enable = mkDefault true;
boot.kernelParams = [ boot.kernelParams = [
# Overwrite free'd memory
"page_poison=1"
# Disable legacy virtual syscalls # Disable legacy virtual syscalls
"vsyscall=none" "vsyscall=none"
]; ];