From 33add1d75631ae2bd1c7711c43ab195f6c237fbe Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Mon, 28 Jan 2019 23:02:48 +0100
Subject: l mors.r: hardening

---
 lass/1systems/mors/config.nix |  1 +
 lass/2configs/hardening.nix   | 11 +++++++++++
 2 files changed, 12 insertions(+)
 create mode 100644 lass/2configs/hardening.nix

(limited to 'lass')

diff --git a/lass/1systems/mors/config.nix b/lass/1systems/mors/config.nix
index b6565dc6..f35ebff5 100644
--- a/lass/1systems/mors/config.nix
+++ b/lass/1systems/mors/config.nix
@@ -36,6 +36,7 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/blue-host.nix>
     <stockholm/lass/2configs/network-manager.nix>
     <stockholm/lass/2configs/nfs-dl.nix>
+    <stockholm/lass/2configs/hardening.nix>
     {
       krebs.iptables.tables.filter.INPUT.rules = [
         #risk of rain
diff --git a/lass/2configs/hardening.nix b/lass/2configs/hardening.nix
new file mode 100644
index 00000000..aee4bf06
--- /dev/null
+++ b/lass/2configs/hardening.nix
@@ -0,0 +1,11 @@
+{ pkgs, lib, ... }:
+with lib;
+{
+  security.chromiumSuidSandbox.enable = true;
+  security.lockKernelModules = false;
+  boot.kernel.sysctl."user.max_user_namespaces" = 63414;
+
+  imports = [
+    <nixpkgs/nixos/modules/profiles/hardened.nix>
+  ];
+}
-- 
cgit v1.2.3