move cross and kernels into seporate profile things
This commit is contained in:
ChaotiCryptidz
parent
a439a91de1
commit
1a07cd8e27
|
|
@ -9,6 +9,9 @@
|
|||
profiles.printing
|
||||
profiles.sshd
|
||||
|
||||
# required for dualsense controller
|
||||
profiles.kernels.latest
|
||||
|
||||
profiles.laptop
|
||||
|
||||
profiles.gui
|
||||
|
|
@ -22,6 +25,9 @@
|
|||
|
||||
# for sci-hub and whenever websites break
|
||||
profiles.tor
|
||||
|
||||
# For cross compiling and deploying to raspberry
|
||||
profiles.cross.arm64
|
||||
];
|
||||
|
||||
home-manager.users.root = { imports = with tree; [ home.base ]; };
|
||||
|
|
@ -53,18 +59,9 @@
|
|||
];
|
||||
};
|
||||
|
||||
boot.binfmt = {
|
||||
emulatedSystems = [ "aarch64-linux" ];
|
||||
registrations.aarch64-linux = {
|
||||
interpreter = lib.mkForce "${pkgs.qemu}/bin/qemu-aarch64";
|
||||
};
|
||||
};
|
||||
|
||||
services.getty.extraArgs =
|
||||
[ "--skip-login" "--login-options" "chaoticryptidz" ];
|
||||
|
||||
boot.kernelPackages = pkgs.linuxPackages_latest;
|
||||
|
||||
networking.firewall.enable = true;
|
||||
# let vscode, vivaldi, etc work.
|
||||
security.unprivilegedUsernsClone = true;
|
||||
|
|
|
|||
8
profiles/cross/arm64.nix
Normal file
8
profiles/cross/arm64.nix
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
{ pkgs, lib, ... }: {
|
||||
boot.binfmt = {
|
||||
emulatedSystems = [ "aarch64-linux" ];
|
||||
registrations.aarch64-linux = {
|
||||
interpreter = lib.mkForce "${pkgs.qemu}/bin/qemu-aarch64";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,101 +0,0 @@
|
|||
{ config, pkgs, lib, ... }: {
|
||||
# modified from https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/profiles/hardened.nix
|
||||
# but with some stuff not turned on
|
||||
|
||||
boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_hardened;
|
||||
|
||||
environment.memoryAllocator.provider = "scudo";
|
||||
environment.variables.SCUDO_OPTIONS = "ZeroContents=1";
|
||||
|
||||
# TODO: this breaks NetworkManager
|
||||
# security.lockKernelModules = true;
|
||||
|
||||
security.protectKernelImage = true;
|
||||
|
||||
security.forcePageTableIsolation = true;
|
||||
|
||||
# This is required by podman to run containers in rootless mode.
|
||||
security.unprivilegedUsernsClone =
|
||||
lib.mkDefault config.virtualisation.containers.enable;
|
||||
|
||||
security.virtualisation.flushL1DataCache = "always";
|
||||
|
||||
boot.kernelParams = [
|
||||
# Slab/slub sanity checks, redzoning, and poisoning
|
||||
"slub_debug=FZP"
|
||||
|
||||
# Overwrite free'd memory
|
||||
"page_poison=1"
|
||||
|
||||
# Enable page allocator randomization
|
||||
"page_alloc.shuffle=1"
|
||||
|
||||
# Disable slab merging
|
||||
"slab_nomerge"
|
||||
|
||||
# Zero memory on alloc and init
|
||||
# Scudo should do this but make kernel do it as well
|
||||
"init_on_alloc=1"
|
||||
"init_on_free=1"
|
||||
|
||||
# Make page allocations less predictable
|
||||
"page_alloc.shuffle=1"
|
||||
|
||||
# Turn on page table isolation
|
||||
"pti=on"
|
||||
|
||||
# Disable vsyscalls
|
||||
"vsyscall=none"
|
||||
|
||||
# Disable debugfs
|
||||
"debugfs=off"
|
||||
];
|
||||
|
||||
boot.kernel.sysctl = {
|
||||
# Restrict ptrace() usage to processes with a pre-defined relationship
|
||||
# (e.g., parent/child)
|
||||
"kernel.yama.ptrace_scope" = 1;
|
||||
|
||||
# Hide kptrs even for processes with CAP_SYSLOG
|
||||
"kernel.kptr_restrict" = 2;
|
||||
|
||||
# Disable bpf() JIT (to eliminate spray attacks)
|
||||
"net.core.bpf_jit_enable" = false;
|
||||
|
||||
# Disable unprivileged bpf
|
||||
"kernel.unprivileged_bpf_disabled" = 1;
|
||||
|
||||
# Disable ftrace debugging
|
||||
"kernel.ftrace_enabled" = false;
|
||||
|
||||
# Disable kexec
|
||||
"kernel.kexec_load_disabled" = 1;
|
||||
|
||||
# Disable sysrq
|
||||
"kernel.sysrq" = 0;
|
||||
|
||||
# Enable strict reverse path filtering (that is, do not attempt to route
|
||||
# packets that "obviously" do not belong to the iface's network; dropped
|
||||
# packets are logged as martians).
|
||||
"net.ipv4.conf.all.log_martians" = true;
|
||||
"net.ipv4.conf.all.rp_filter" = "1";
|
||||
"net.ipv4.conf.default.log_martians" = true;
|
||||
"net.ipv4.conf.default.rp_filter" = "1";
|
||||
|
||||
# Ignore broadcast ICMP (mitigate SMURF)
|
||||
"net.ipv4.icmp_echo_ignore_broadcasts" = true;
|
||||
|
||||
# Ignore incoming ICMP redirects (note: default is needed to ensure that the
|
||||
# setting is applied to interfaces added after the sysctls are set)
|
||||
"net.ipv4.conf.all.accept_redirects" = false;
|
||||
"net.ipv4.conf.all.secure_redirects" = false;
|
||||
"net.ipv4.conf.default.accept_redirects" = false;
|
||||
"net.ipv4.conf.default.secure_redirects" = false;
|
||||
"net.ipv6.conf.all.accept_redirects" = false;
|
||||
"net.ipv6.conf.default.accept_redirects" = false;
|
||||
|
||||
# Ignore outgoing ICMP redirects (this is ipv4 only)
|
||||
"net.ipv4.conf.all.send_redirects" = false;
|
||||
"net.ipv4.conf.default.send_redirects" = false;
|
||||
};
|
||||
}
|
||||
1
profiles/kernels/latest.nix
Normal file
1
profiles/kernels/latest.nix
Normal file
|
|
@ -0,0 +1 @@
|
|||
{ pkgs, ... }: { boot.kernelPackages = pkgs.linuxPackages_latest; }
|
||||
Loading…
Reference in a new issue