diff options
| author | lassulus <lassulus@lassul.us> | 2019-01-28 23:02:48 +0100 |
|---|---|---|
| committer | lassulus <lassulus@lassul.us> | 2019-01-28 23:02:48 +0100 |
| commit | 33add1d75631ae2bd1c7711c43ab195f6c237fbe (patch) | |
| tree | c8a90e40f145066b244ed5c43df321485bd69059 | |
| parent | b74a981dcf4c0cb4a17270ffb3a2b41d263d99e9 (diff) | |
l mors.r: hardening
| -rw-r--r-- | lass/1systems/mors/config.nix | 1 | ||||
| -rw-r--r-- | lass/2configs/hardening.nix | 11 |
2 files changed, 12 insertions, 0 deletions
diff --git a/lass/1systems/mors/config.nix b/lass/1systems/mors/config.nix index b6565dc6a..f35ebff56 100644 --- a/lass/1systems/mors/config.nix +++ b/lass/1systems/mors/config.nix @@ -36,6 +36,7 @@ with import <stockholm/lib>; <stockholm/lass/2configs/blue-host.nix> <stockholm/lass/2configs/network-manager.nix> <stockholm/lass/2configs/nfs-dl.nix> + <stockholm/lass/2configs/hardening.nix> { krebs.iptables.tables.filter.INPUT.rules = [ #risk of rain diff --git a/lass/2configs/hardening.nix b/lass/2configs/hardening.nix new file mode 100644 index 000000000..aee4bf06f --- /dev/null +++ b/lass/2configs/hardening.nix @@ -0,0 +1,11 @@ +{ pkgs, lib, ... }: +with lib; +{ + security.chromiumSuidSandbox.enable = true; + security.lockKernelModules = false; + boot.kernel.sysctl."user.max_user_namespaces" = 63414; + + imports = [ + <nixpkgs/nixos/modules/profiles/hardened.nix> + ]; +} |