diff options
| author | Michele Guerini Rocco <rnhmjoj@users.noreply.github.com> | 2021-09-20 15:13:12 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-09-20 15:13:12 +0200 |
| commit | ea1eae5b47014d721080ec464fe44ff72f95467e (patch) | |
| tree | 8c9b861917046cb29b3b9e291815d4402e96a6d0 /nixos | |
| parent | 23acc562d28bcffa29e66a83a85cfdc7158e852a (diff) | |
| parent | 1bd7260adb4233816cc33ef6e7da667aee1c0a79 (diff) | |
| download | nixlib-ea1eae5b47014d721080ec464fe44ff72f95467e.tar nixlib-ea1eae5b47014d721080ec464fe44ff72f95467e.tar.gz nixlib-ea1eae5b47014d721080ec464fe44ff72f95467e.tar.bz2 nixlib-ea1eae5b47014d721080ec464fe44ff72f95467e.tar.lz nixlib-ea1eae5b47014d721080ec464fe44ff72f95467e.tar.xz nixlib-ea1eae5b47014d721080ec464fe44ff72f95467e.tar.zst nixlib-ea1eae5b47014d721080ec464fe44ff72f95467e.zip | |
Merge pull request #138516 from rnhmjoj/lock-kernel-fix
nixos/lock-kernel-modules: reorder before/after
Diffstat (limited to 'nixos')
| -rw-r--r-- | nixos/modules/security/lock-kernel-modules.nix | 2 | ||||
| -rw-r--r-- | nixos/tests/hardened.nix | 1 |
2 files changed, 2 insertions, 1 deletions
diff --git a/nixos/modules/security/lock-kernel-modules.nix b/nixos/modules/security/lock-kernel-modules.nix index 3c4cc69e0e3d..065587bc286e 100644 --- a/nixos/modules/security/lock-kernel-modules.nix +++ b/nixos/modules/security/lock-kernel-modules.nix @@ -35,10 +35,10 @@ with lib; wants = [ "systemd-udevd.service" ]; wantedBy = [ config.systemd.defaultUnit ]; - before = [ config.systemd.defaultUnit ]; after = [ "firewall.service" "systemd-modules-load.service" + config.systemd.defaultUnit ]; unitConfig.ConditionPathIsReadWrite = "/proc/sys/kernel"; diff --git a/nixos/tests/hardened.nix b/nixos/tests/hardened.nix index a0b629086b5a..b76ae83a3287 100644 --- a/nixos/tests/hardened.nix +++ b/nixos/tests/hardened.nix @@ -57,6 +57,7 @@ import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... } : { # Test kernel module hardening with subtest("No more kernel modules can be loaded"): # note: this better a be module we normally wouldn't load ... + machine.wait_for_unit("disable-kernel-module-loading.service") machine.fail("modprobe dccp") |