diff options
Diffstat (limited to 'nixpkgs/nixos/modules/security/lock-kernel-modules.nix')
-rw-r--r-- | nixpkgs/nixos/modules/security/lock-kernel-modules.nix | 28 |
1 files changed, 19 insertions, 9 deletions
diff --git a/nixpkgs/nixos/modules/security/lock-kernel-modules.nix b/nixpkgs/nixos/modules/security/lock-kernel-modules.nix index fc9e7939d814..065587bc286e 100644 --- a/nixpkgs/nixos/modules/security/lock-kernel-modules.nix +++ b/nixpkgs/nixos/modules/security/lock-kernel-modules.nix @@ -1,4 +1,4 @@ -{ config, lib, ... }: +{ config, pkgs, lib, ... }: with lib; @@ -13,7 +13,7 @@ with lib; default = false; description = '' Disable kernel module loading once the system is fully initialised. - Module loading is disabled until the next reboot. Problems caused + Module loading is disabled until the next reboot. Problems caused by delayed module loading can be fixed by adding the module(s) in question to <option>boot.kernelModules</option>. ''; @@ -29,20 +29,30 @@ with lib; else [ x.fsType ] else []) config.system.build.fileSystems; - systemd.services.disable-kernel-module-loading = rec { + systemd.services.disable-kernel-module-loading = { description = "Disable kernel module loading"; + wants = [ "systemd-udevd.service" ]; wantedBy = [ config.systemd.defaultUnit ]; - after = [ "systemd-udev-settle.service" "firewall.service" "systemd-modules-load.service" ] ++ wantedBy; + after = + [ "firewall.service" + "systemd-modules-load.service" + config.systemd.defaultUnit + ]; unitConfig.ConditionPathIsReadWrite = "/proc/sys/kernel"; - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - ExecStart = "/bin/sh -c 'echo -n 1 >/proc/sys/kernel/modules_disabled'"; - }; + serviceConfig = + { Type = "oneshot"; + RemainAfterExit = true; + TimeoutSec = 180; + }; + + script = '' + ${pkgs.udev}/bin/udevadm settle + echo -n 1 >/proc/sys/kernel/modules_disabled + ''; }; }; } |