asxpi/nixOS
asxpi/nixOS
1
0
Fork 0
Code Issues Pull requests Activity

hardened kernel + usbguard

Browse source
This commit is contained in:
Sergei Poljanski 2026-01-13 07:58:30 +02:00
commit 7f68764d33
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
2 changed files with 17 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

1
.gitignore vendored Normal file
View file

@ -0,0 +1 @@
modules/usb-devices.nix

25
modules/security.nix
View file

@ -1,10 +1,17 @@
{ config, pkgs, ... }: { config, pkgs, lib, ... }:
{ {
imports = [
./usb-devices.nix
];
# Use the hardened kernel for better security
boot.kernelPackages = lib.mkForce pkgs.linuxPackages_hardened;
# Only allow members of the wheel group to execute sudo # Only allow members of the wheel group to execute sudo
security.sudo.execWheelOnly = true; security.sudo.execWheelOnly = true;
# Linux Audit Framework (suggested by Lynis) # Linux Audit Framework
security.auditd.enable = true; security.auditd.enable = true;
security.audit.enable = true; security.audit.enable = true;
@ -13,16 +20,9 @@
# Sysctl hardening # Sysctl hardening
boot.kernel.sysctl = { boot.kernel.sysctl = {
# Hide kernel pointers from unprivileged users
"kernel.kptr_restrict" = 1; "kernel.kptr_restrict" = 1;
# Restrict ptrace to only child processes
"kernel.yama.ptrace_scope" = 1; "kernel.yama.ptrace_scope" = 1;
# Disable BPF JIT for unprivileged users
"kernel.unprivileged_bpf_disabled" = 1; "kernel.unprivileged_bpf_disabled" = 1;
# Networking hardening
"net.ipv4.conf.all.log_martians" = 1; "net.ipv4.conf.all.log_martians" = 1;
"net.ipv4.conf.all.rp_filter" = 1; "net.ipv4.conf.all.rp_filter" = 1;
"net.ipv4.conf.default.log_martians" = 1; "net.ipv4.conf.default.log_martians" = 1;
@ -30,4 +30,11 @@
"net.ipv6.conf.all.accept_redirects" = 0; "net.ipv6.conf.all.accept_redirects" = 0;
"net.ipv6.conf.default.accept_redirects" = 0; "net.ipv6.conf.default.accept_redirects" = 0;
}; };
# USBGuard configuration
services.usbguard = {
enable = true;
dbus.enable = true;
implicitPolicyTarget = "block";
};
} }