diff options
| author | Alyssa Ross <hi@alyssa.is> | 2019-02-07 15:19:21 +0000 |
|---|---|---|
| committer | Alyssa Ross <hi@alyssa.is> | 2019-02-07 23:35:47 +0000 |
| commit | e5013c05a2f845255debf94318ab38ecef1c186b (patch) | |
| tree | bec11a0bd31d3432a16899e5539f1098f1c168a4 /nixpkgs/nixos/modules/profiles | |
| parent | 4fc07c92ec07cafcf6d56143ea7334693143ef88 (diff) | |
| parent | 2d2f10475138b7206572dc3ec288184df2be022e (diff) | |
| download | nixlib-e5013c05a2f845255debf94318ab38ecef1c186b.tar nixlib-e5013c05a2f845255debf94318ab38ecef1c186b.tar.gz nixlib-e5013c05a2f845255debf94318ab38ecef1c186b.tar.bz2 nixlib-e5013c05a2f845255debf94318ab38ecef1c186b.tar.lz nixlib-e5013c05a2f845255debf94318ab38ecef1c186b.tar.xz nixlib-e5013c05a2f845255debf94318ab38ecef1c186b.tar.zst nixlib-e5013c05a2f845255debf94318ab38ecef1c186b.zip | |
Merge commit '2d2f10475138b7206572dc3ec288184df2be022e'
Diffstat (limited to 'nixpkgs/nixos/modules/profiles')
| -rw-r--r-- | nixpkgs/nixos/modules/profiles/hardened.nix | 9 | ||||
| -rw-r--r-- | nixpkgs/nixos/modules/profiles/headless.nix | 1 | ||||
| -rw-r--r-- | nixpkgs/nixos/modules/profiles/minimal.nix | 2 |
3 files changed, 10 insertions, 2 deletions
diff --git a/nixpkgs/nixos/modules/profiles/hardened.nix b/nixpkgs/nixos/modules/profiles/hardened.nix index a588943fe710..9ab2ee87a19e 100644 --- a/nixpkgs/nixos/modules/profiles/hardened.nix +++ b/nixpkgs/nixos/modules/profiles/hardened.nix @@ -29,11 +29,20 @@ with lib; security.apparmor.enable = mkDefault true; boot.kernelParams = [ + # Slab/slub sanity checks, redzoning, and poisoning + "slub_debug=FZP" + + # Disable slab merging to make certain heap overflow attacks harder + "slab_nomerge" + # Overwrite free'd memory "page_poison=1" # Disable legacy virtual syscalls "vsyscall=none" + + # Enable PTI even if CPU claims to be safe from meltdown + "pti=on" ]; boot.blacklistedKernelModules = [ diff --git a/nixpkgs/nixos/modules/profiles/headless.nix b/nixpkgs/nixos/modules/profiles/headless.nix index 131ee272859a..46a9b6a7d8d5 100644 --- a/nixpkgs/nixos/modules/profiles/headless.nix +++ b/nixpkgs/nixos/modules/profiles/headless.nix @@ -6,7 +6,6 @@ with lib; { - sound.enable = false; boot.vesa = false; # Don't start a tty on the serial consoles. diff --git a/nixpkgs/nixos/modules/profiles/minimal.nix b/nixpkgs/nixos/modules/profiles/minimal.nix index 138eda117c74..f044e6f39ea5 100644 --- a/nixpkgs/nixos/modules/profiles/minimal.nix +++ b/nixpkgs/nixos/modules/profiles/minimal.nix @@ -13,5 +13,5 @@ with lib; documentation.enable = mkDefault false; - sound.enable = mkDefault false; + documentation.nixos.enable = mkDefault false; } |