94 lines
2.2 KiB
Nix
94 lines
2.2 KiB
Nix
{self, ...}: {
|
|
boot = {
|
|
kernelPackages = self.inputs."nix-cachyos-kernel".legacyPackages.x86_64-linux.linuxPackages-cachyos-hardened-lto;
|
|
|
|
kernelParams = [
|
|
"slab_nomerge"
|
|
"init_on_alloc=1"
|
|
"init_on_free=1"
|
|
"page_alloc.shuffle=1"
|
|
"oops=panic"
|
|
"mitigations=all"
|
|
"spectre_v2=on"
|
|
"spec_store_bypass_disable=on"
|
|
"l1tf=full,force"
|
|
"mds=full,force"
|
|
"tsx=off"
|
|
"tsx_async_abort=full,force"
|
|
"kvm.nx_huge_pages=force"
|
|
"page_poison=1"
|
|
"iommu=force"
|
|
"intel_iommu=on"
|
|
"amd_iommu=on"
|
|
"bpf_jit_enable=0"
|
|
];
|
|
|
|
blacklistedKernelModules = [
|
|
"dccp"
|
|
"sctp"
|
|
"rds"
|
|
"tipc"
|
|
"hfs"
|
|
"hfsplus"
|
|
"squashfs"
|
|
"jfs"
|
|
"minix"
|
|
"nilfs2"
|
|
"omfs"
|
|
"qnx4"
|
|
"qnx6"
|
|
"sysv"
|
|
"ufs"
|
|
"zfs"
|
|
"ntfs"
|
|
"bluetooth"
|
|
"btusb"
|
|
"uvcvideo"
|
|
"joydev"
|
|
"pcspkr"
|
|
"snd_pcsp"
|
|
];
|
|
|
|
kernel = {
|
|
sysctl = {
|
|
"vm.mmap_rnd_bits" = 32;
|
|
"vm.mmap_rnd_compat_bits" = 16;
|
|
|
|
"net.ipv6.conf.all.forwarding" = 1;
|
|
|
|
"net.ipv4.ip_forward" = 1;
|
|
|
|
"net.ipv4.conf.all.rp_filter" = 1;
|
|
"net.ipv4.conf.all.accept_redirects" = 0;
|
|
"net.ipv4.conf.all.secure_redirects" = 0;
|
|
"net.ipv6.conf.all.accept_redirects" = 0;
|
|
|
|
"net.ipv4.conf.default.rp_filter" = 1;
|
|
"net.ipv4.conf.default.accept_redirects" = 0;
|
|
"net.ipv4.conf.default.secure_redirects" = 0;
|
|
"net.ipv6.conf.default.accept_redirects" = 0;
|
|
|
|
"net.ipv4.tcp_rfc1337" = 1;
|
|
"net.ipv4.tcp_syncookies" = 1;
|
|
|
|
"net.core.bpf_jit_harden" = 2;
|
|
|
|
"dev.tty.ldisc_autoload" = 0;
|
|
|
|
"kernel.yama.ptrace_scope" = 2;
|
|
"kernel.core_pattern" = "|/bin/false";
|
|
"kernel.kptr_restrict" = 2;
|
|
"kernel.dmesg_restrict" = 1;
|
|
"kernel.unprivileged_bpf_disabled" = 1;
|
|
"kernel.unprivileged_userns_clone" = 0;
|
|
"kernel.perf_event_paranoid" = 3;
|
|
"kernel.kstack_override" = 0;
|
|
|
|
"fs.protected_fifos" = 2;
|
|
"fs.protected_regular" = 2;
|
|
"fs.protected_hardlinks" = 1;
|
|
"fs.protected_symlinks" = 1;
|
|
};
|
|
};
|
|
};
|
|
}
|