move cross and kernels into seporate profile things
This commit is contained in:
ChaotiCryptidz
parent
a439a91de1
commit
1a07cd8e27
|
|
@ -9,6 +9,9 @@
|
||||||
profiles.printing
|
profiles.printing
|
||||||
profiles.sshd
|
profiles.sshd
|
||||||
|
|
||||||
|
# required for dualsense controller
|
||||||
|
profiles.kernels.latest
|
||||||
|
|
||||||
profiles.laptop
|
profiles.laptop
|
||||||
|
|
||||||
profiles.gui
|
profiles.gui
|
||||||
|
|
@ -22,6 +25,9 @@
|
||||||
|
|
||||||
# for sci-hub and whenever websites break
|
# for sci-hub and whenever websites break
|
||||||
profiles.tor
|
profiles.tor
|
||||||
|
|
||||||
|
# For cross compiling and deploying to raspberry
|
||||||
|
profiles.cross.arm64
|
||||||
];
|
];
|
||||||
|
|
||||||
home-manager.users.root = { imports = with tree; [ home.base ]; };
|
home-manager.users.root = { imports = with tree; [ home.base ]; };
|
||||||
|
|
@ -53,18 +59,9 @@
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
boot.binfmt = {
|
|
||||||
emulatedSystems = [ "aarch64-linux" ];
|
|
||||||
registrations.aarch64-linux = {
|
|
||||||
interpreter = lib.mkForce "${pkgs.qemu}/bin/qemu-aarch64";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.getty.extraArgs =
|
services.getty.extraArgs =
|
||||||
[ "--skip-login" "--login-options" "chaoticryptidz" ];
|
[ "--skip-login" "--login-options" "chaoticryptidz" ];
|
||||||
|
|
||||||
boot.kernelPackages = pkgs.linuxPackages_latest;
|
|
||||||
|
|
||||||
networking.firewall.enable = true;
|
networking.firewall.enable = true;
|
||||||
# let vscode, vivaldi, etc work.
|
# let vscode, vivaldi, etc work.
|
||||||
security.unprivilegedUsernsClone = true;
|
security.unprivilegedUsernsClone = true;
|
||||||
|
|
|
||||||
8
profiles/cross/arm64.nix
Normal file
8
profiles/cross/arm64.nix
Normal file
|
|
@ -0,0 +1,8 @@
|
||||||
|
{ pkgs, lib, ... }: {
|
||||||
|
boot.binfmt = {
|
||||||
|
emulatedSystems = [ "aarch64-linux" ];
|
||||||
|
registrations.aarch64-linux = {
|
||||||
|
interpreter = lib.mkForce "${pkgs.qemu}/bin/qemu-aarch64";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -1,101 +0,0 @@
|
||||||
{ config, pkgs, lib, ... }: {
|
|
||||||
# modified from https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/profiles/hardened.nix
|
|
||||||
# but with some stuff not turned on
|
|
||||||
|
|
||||||
boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_hardened;
|
|
||||||
|
|
||||||
environment.memoryAllocator.provider = "scudo";
|
|
||||||
environment.variables.SCUDO_OPTIONS = "ZeroContents=1";
|
|
||||||
|
|
||||||
# TODO: this breaks NetworkManager
|
|
||||||
# security.lockKernelModules = true;
|
|
||||||
|
|
||||||
security.protectKernelImage = true;
|
|
||||||
|
|
||||||
security.forcePageTableIsolation = true;
|
|
||||||
|
|
||||||
# This is required by podman to run containers in rootless mode.
|
|
||||||
security.unprivilegedUsernsClone =
|
|
||||||
lib.mkDefault config.virtualisation.containers.enable;
|
|
||||||
|
|
||||||
security.virtualisation.flushL1DataCache = "always";
|
|
||||||
|
|
||||||
boot.kernelParams = [
|
|
||||||
# Slab/slub sanity checks, redzoning, and poisoning
|
|
||||||
"slub_debug=FZP"
|
|
||||||
|
|
||||||
# Overwrite free'd memory
|
|
||||||
"page_poison=1"
|
|
||||||
|
|
||||||
# Enable page allocator randomization
|
|
||||||
"page_alloc.shuffle=1"
|
|
||||||
|
|
||||||
# Disable slab merging
|
|
||||||
"slab_nomerge"
|
|
||||||
|
|
||||||
# Zero memory on alloc and init
|
|
||||||
# Scudo should do this but make kernel do it as well
|
|
||||||
"init_on_alloc=1"
|
|
||||||
"init_on_free=1"
|
|
||||||
|
|
||||||
# Make page allocations less predictable
|
|
||||||
"page_alloc.shuffle=1"
|
|
||||||
|
|
||||||
# Turn on page table isolation
|
|
||||||
"pti=on"
|
|
||||||
|
|
||||||
# Disable vsyscalls
|
|
||||||
"vsyscall=none"
|
|
||||||
|
|
||||||
# Disable debugfs
|
|
||||||
"debugfs=off"
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.kernel.sysctl = {
|
|
||||||
# Restrict ptrace() usage to processes with a pre-defined relationship
|
|
||||||
# (e.g., parent/child)
|
|
||||||
"kernel.yama.ptrace_scope" = 1;
|
|
||||||
|
|
||||||
# Hide kptrs even for processes with CAP_SYSLOG
|
|
||||||
"kernel.kptr_restrict" = 2;
|
|
||||||
|
|
||||||
# Disable bpf() JIT (to eliminate spray attacks)
|
|
||||||
"net.core.bpf_jit_enable" = false;
|
|
||||||
|
|
||||||
# Disable unprivileged bpf
|
|
||||||
"kernel.unprivileged_bpf_disabled" = 1;
|
|
||||||
|
|
||||||
# Disable ftrace debugging
|
|
||||||
"kernel.ftrace_enabled" = false;
|
|
||||||
|
|
||||||
# Disable kexec
|
|
||||||
"kernel.kexec_load_disabled" = 1;
|
|
||||||
|
|
||||||
# Disable sysrq
|
|
||||||
"kernel.sysrq" = 0;
|
|
||||||
|
|
||||||
# Enable strict reverse path filtering (that is, do not attempt to route
|
|
||||||
# packets that "obviously" do not belong to the iface's network; dropped
|
|
||||||
# packets are logged as martians).
|
|
||||||
"net.ipv4.conf.all.log_martians" = true;
|
|
||||||
"net.ipv4.conf.all.rp_filter" = "1";
|
|
||||||
"net.ipv4.conf.default.log_martians" = true;
|
|
||||||
"net.ipv4.conf.default.rp_filter" = "1";
|
|
||||||
|
|
||||||
# Ignore broadcast ICMP (mitigate SMURF)
|
|
||||||
"net.ipv4.icmp_echo_ignore_broadcasts" = true;
|
|
||||||
|
|
||||||
# Ignore incoming ICMP redirects (note: default is needed to ensure that the
|
|
||||||
# setting is applied to interfaces added after the sysctls are set)
|
|
||||||
"net.ipv4.conf.all.accept_redirects" = false;
|
|
||||||
"net.ipv4.conf.all.secure_redirects" = false;
|
|
||||||
"net.ipv4.conf.default.accept_redirects" = false;
|
|
||||||
"net.ipv4.conf.default.secure_redirects" = false;
|
|
||||||
"net.ipv6.conf.all.accept_redirects" = false;
|
|
||||||
"net.ipv6.conf.default.accept_redirects" = false;
|
|
||||||
|
|
||||||
# Ignore outgoing ICMP redirects (this is ipv4 only)
|
|
||||||
"net.ipv4.conf.all.send_redirects" = false;
|
|
||||||
"net.ipv4.conf.default.send_redirects" = false;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
1
profiles/kernels/latest.nix
Normal file
1
profiles/kernels/latest.nix
Normal file
|
|
@ -0,0 +1 @@
|
||||||
|
{ pkgs, ... }: { boot.kernelPackages = pkgs.linuxPackages_latest; }
|
||||||
Loading…
Reference in a new issue