dotfiles

  1## Security & Hardening Settings ##
  2{config, ...}: let
  3  inherit (config.flake) files;
  4in {
  5  flake.modules = {
  6    nixos.security = {lib, ...}: {
  7      config = {
  8        security = {
  9          protectKernelImage = false;
 10
 11          # Sudo
 12          sudo = {
 13            execWheelOnly = true;
 14            extraConfig = ''
 15              Defaults pwfeedback
 16              Defaults lecture = always, lecture_file = ${files.ascii.groot}
 17            '';
 18          };
 19
 20          # Sandbox
 21          # ! # https://discourse.nixos.org/t/apparmor-on-nixos-roadmap/57217
 22          apparmor.enable = false;
 23        };
 24        programs.firejail.enable = true;
 25
 26        ## Hardening
 27        # Block Junk Sites
 28        networking.stevenblack = {
 29          enable = true;
 30          whitelist = ["analytics.google.com"];
 31        };
 32
 33        boot = {
 34          # Kernel
 35          kernelParams = [
 36            "page_alloc.shuffle=1"
 37            "page_poison=1"
 38            "slub_debug=FZP"
 39          ];
 40
 41          # Network
 42          kernel.sysctl = {
 43            "kernel.ftrace_enabled" = false;
 44            "kernel.kexec_load_disabled" = true;
 45            "kernel.kptr_restrict" = lib.mkOverride 500 2;
 46            "kernel.sysrq" = 176;
 47            "kernel.yama.ptrace_scope" = lib.mkOverride 500 1;
 48
 49            "net.core.bpf_jit_enable" = true;
 50            "net.core.default_qdisc" = "cake";
 51            "net.ipv4.conf.all.accept_redirects" = false;
 52            "net.ipv4.conf.all.accept_source_route" = 0;
 53            "net.ipv4.conf.all.log_martians" = true;
 54            "net.ipv4.conf.all.rp_filter" = 1;
 55            "net.ipv4.conf.all.secure_redirects" = false;
 56            "net.ipv4.conf.all.send_redirects" = false;
 57            "net.ipv4.conf.default.accept_redirects" = false;
 58            "net.ipv4.conf.default.log_martians" = true;
 59            "net.ipv4.conf.default.rp_filter" = 1;
 60            "net.ipv4.conf.default.secure_redirects" = false;
 61            "net.ipv4.conf.default.send_redirects" = false;
 62            "net.ipv4.icmp_echo_ignore_broadcasts" = true;
 63            "net.ipv4.icmp_ignore_bogus_error_responses" = 1;
 64            "net.ipv4.tcp_congestion_control" = "bbr";
 65            "net.ipv4.tcp_fastopen" = 3;
 66            "net.ipv4.tcp_rfc1337" = 1;
 67            "net.ipv4.tcp_syncookies" = 1;
 68            "net.ipv6.conf.all.accept_redirects" = false;
 69            "net.ipv6.conf.all.accept_source_route" = 0;
 70            "net.ipv6.conf.default.accept_redirects" = false;
 71          };
 72
 73          # Secure Modules
 74          kernelModules = ["tcp_bbr"];
 75
 76          # Old & Obscure Modules
 77          blacklistedKernelModules = [
 78            # Network Protocols
 79            "ax25"
 80            "netrom"
 81            "rose"
 82
 83            # Filesystems
 84            "adfs"
 85            "affs"
 86            "befs"
 87            "bfs"
 88            "cramfs"
 89            "efs"
 90            "erofs"
 91            "exofs"
 92            "f2fs"
 93            "freevxfs"
 94            "hfs"
 95            "hpfs"
 96            "jfs"
 97            "minix"
 98            "nilfs2"
 99            "omfs"
100            "qnx4"
101            "qnx6"
102            "sysv"
103            "ufs"
104          ];
105        };
106      };
107    };
108
109    # Browser Sandbox
110    homeManager.security = _: {imports = [./_browser.nix];};
111  };
112}