asxpi/nixOS
asxpi/nixOS
1
0
Fork 0
Code Issues Pull requests Activity

turn off usbguard

Browse source
This commit is contained in:
Sergei Poljanski 2026-01-31 06:03:22 +02:00
commit 6c5f9fc03b
1 changed files with 5 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

15
modules/security.nix
View file

@ -1,12 +1,12 @@
{ config, pkgs, lib, ... }: { config, pkgs, lib, ... }:
{ {
imports = [ # imports = [
./usb-devices.nix # ./usb-devices.nix
]; # ];
# Use the hardened kernel for better security # Use the hardened kernel for better security
boot.kernelPackages = lib.mkForce pkgs.linuxPackages_hardened; # boot.kernelPackages = lib.mkForce pkgs.linuxPackages_hardened;
# Only allow members of the wheel group to execute sudo # Only allow members of the wheel group to execute sudo
security.sudo.execWheelOnly = true; security.sudo.execWheelOnly = true;
@ -44,7 +44,7 @@
# USBGuard configuration # USBGuard configuration
services.usbguard = { services.usbguard = {
enable = true; enable = false;
dbus.enable = true; dbus.enable = true;
implicitPolicyTarget = "block"; implicitPolicyTarget = "block";
}; };
@ -56,11 +56,6 @@
{ domain = "*"; item = "core"; type = "-"; value = "0"; } { domain = "*"; item = "core"; type = "-"; value = "0"; }
]; ];
systemd.services.systemd-udevd.serviceConfig = {
PrivateNetwork = true;
RestrictAddressFamilies = "AF_UNIX AF_NETLINK";
};
# Podman socket for all users # Podman socket for all users
systemd.user.sockets.podman.wantedBy = [ "sockets.target" ]; systemd.user.sockets.podman.wantedBy = [ "sockets.target" ];