hardened kernel + usbguard

.gitignore

@@ -0,0 +1 @@
+modules/usb-devices.nix

modules/security.nix

@@ -1,10 +1,17 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 
 {
+  imports = [
+    ./usb-devices.nix
+  ];
+
+  # Use the hardened kernel for better security
+  boot.kernelPackages = lib.mkForce pkgs.linuxPackages_hardened;
+
   # Only allow members of the wheel group to execute sudo
   security.sudo.execWheelOnly = true;
 
-  # Linux Audit Framework (suggested by Lynis)
+  # Linux Audit Framework
   security.auditd.enable = true;
   security.audit.enable = true;
 
@@ -13,16 +20,9 @@
 
   # Sysctl hardening
   boot.kernel.sysctl = {
-    # Hide kernel pointers from unprivileged users
     "kernel.kptr_restrict" = 1;
-
-    # Restrict ptrace to only child processes
     "kernel.yama.ptrace_scope" = 1;
-
-    # Disable BPF JIT for unprivileged users
     "kernel.unprivileged_bpf_disabled" = 1;
-
-    # Networking hardening
     "net.ipv4.conf.all.log_martians" = 1;
     "net.ipv4.conf.all.rp_filter" = 1;
     "net.ipv4.conf.default.log_martians" = 1;
@@ -30,4 +30,11 @@
     "net.ipv6.conf.all.accept_redirects" = 0;
     "net.ipv6.conf.default.accept_redirects" = 0;
   };
+
+  # USBGuard configuration
+  services.usbguard = {
+    enable = true;
+    dbus.enable = true;
+    implicitPolicyTarget = "block";
+  };
 }