NixOS Hardening - Revision history

Rhendric: /* Sysctl parameters */ Add kernel.io_uring_disabled=2

2026-05-08T16:57:31Z

Sysctl parameters: Add kernel.io_uring_disabled=2

← Older revision		Revision as of 16:57, 8 May 2026
Line 161:		Line 161:
	# Disable ftrace debugging		# Disable ftrace debugging
	boot.kernel.sysctl."kernel.ftrace_enabled" = false;		boot.kernel.sysctl."kernel.ftrace_enabled" = false;

			# Disable io_uring, a large source of security vulnerabilities
			# https://security.googleblog.com/2023/06/learnings-from-kctf-vrps-42-linux.html
			boot.kernel.sysctl."kernel.io_uring_disabled" = 2;

	# Enable strict reverse path filtering (that is, do not attempt to route		# Enable strict reverse path filtering (that is, do not attempt to route

Arch is the best: Link to Security#AppArmor

2026-05-01T00:15:47Z

Link to Security#AppArmor

← Older revision		Revision as of 00:15, 1 May 2026
Line 227:		Line 227:

	=== AppArmor ===		=== AppArmor ===
			See [[Security#AppArmor]] for more details.

	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
	security.apparmor.enable = true;		security.apparmor.enable = true;

Golbinex: Add categories

2026-04-07T16:25:06Z

Add categories

← Older revision		Revision as of 16:25, 7 April 2026
Line 234:		Line 234:
	=== Secure Boot ===		=== Secure Boot ===
	See [[Secure Boot]]. [[Limine]] bootloader supports coreboot's Secure Boot.		See [[Secure Boot]]. [[Limine]] bootloader supports coreboot's Secure Boot.
			[[Category:Guide]]
			[[Category:NixOS]]
			[[Category:Security]]

Golbinex: linux-hardened was removed from nixpkgs

2026-04-07T16:21:47Z

linux-hardened was removed from nixpkgs

@@ Line 1: / Line 1: @@
 === linux-hardened ===
-[https://github.com/anthraxx/linux-hardened linux-hardened] is a Linux kernel with additional hardening patches applied.<syntaxhighlight lang="nix">
+[https://github.com/anthraxx/linux-hardened linux-hardened] is a Linux kernel with additional hardening patches applied. You can check for latest releases [https://github.com/anthraxx/linux-hardened/releases here].<syntaxhighlight lang="nix">
 boot.kernelPackages = let
-    linux_hardened_pkg = { fetchFromGitHub, buildLinux, linux_6_12_hardened, ... } @ args:
+  linux_hardened_pkg = { fetchFromGitHub, buildLinux, lib, ... } @ args:
-        buildLinux (args // rec {
+      buildLinux (args // rec {
-          version = "6.12.77-hardened1";
+        version = "6.12.79-hardened1";
-          modDirVersion = version;
+        hash = "sha256-TKrLHk4aB47vqehEdp5ks4WtMCq/XCDr9ro3eQOoPvE=";
-          extraMeta.branch = "6.12";
+        extraMeta.branch = "6.12";
-          src = fetchFromGitHub {
+        modDirVersion = version;
-            owner = "anthraxx";
+        src = fetchFromGitHub {
-            repo = "linux-hardened";
+          inherit hash;
-            tag = "v${version}";
+          owner = "anthraxx";
-            hash = "sha256-txcatuTkp0gmJ4vHp//Ju4/j9d2RiVU8UuE7zUXnixw=";
+          repo = "linux-hardened";
-          };
+          tag = "v${version}";
-          # Patches are already applied in the source tarball
+        };
-          kernelPatches = [];
+        kernelPatches = [];
-          structuredExtraConfig = linux_6_12_hardened.structuredExtraConfig;
+        structuredExtraConfig = with lib.kernel; {
-           # If using different kernel version than the one used in nixpkgs, you might have to remove some unsupported parameters.
+          # Perform additional validation of commonly targeted structures.
-           structuredExtraConfig = lib.removeAttrs linux_6_12_hardened.structuredExtraConfig [ "GCC_PLUGIN_STACKLEAK" ];
+          DEBUG_NOTIFIERS = yes;
-         } // (args.argsOverride or {}));
+          DEBUG_PLIST = yes;
-      linux_hardened = pkgs.callPackage linux_hardened_pkg{};
+          DEBUG_SG = yes;
-    in
+          DEBUG_VIRTUAL = yes;
-      lib.recurseIntoAttrs (pkgs.linuxPackagesFor linux_hardened);
+          SCHED_STACK_END_CHECK = yes;
 </syntaxhighlight>

Golbinex at 22:46, 23 March 2026

2026-03-23T22:46:26Z

@@ Line 2: / Line 2: @@
 [https://github.com/anthraxx/linux-hardened linux-hardened] is a Linux kernel with additional hardening patches applied.<syntaxhighlight lang="nix">
 boot.kernelPackages = pkgs.linuxKernel.packages.linux_hardened;
 </syntaxhighlight>
@@ Line 7: / Line 32: @@
 This option locks kernel modules after the system is initialized. For example it prevents malicious USB devices from exploiting vulnerable kernel modules.<syntaxhighlight lang="nix">
 security.lockKernelModules = true;
-</syntaxhighlight>All needed modules must be loaded at boot by adding them to <code>boot.kernelModules</code>.
+</syntaxhighlight>All needed modules must be loaded at boot by adding them to <code>boot.kernelModules</code>. One way of knowing what modules must be enabled is to disable this option and then list all enabled modules with <code>lsmod</code>.<syntaxhighlight lang="nix">
+boot.kernelModules = [
 === Module blacklist ===
 <syntaxhighlight lang="nix">

Golbinex: Add Secure Boot

2026-03-23T09:52:10Z

Add Secure Boot

← Older revision		Revision as of 09:52, 23 March 2026
Line 133:		Line 133:
	security.apparmor.killUnconfinedConfinables = true;		security.apparmor.killUnconfinedConfinables = true;
	</syntaxhighlight>		</syntaxhighlight>

			=== Secure Boot ===
			See [[Secure Boot]]. [[Limine]] bootloader supports coreboot's Secure Boot.

Golbinex: Initial page

2026-03-23T09:41:32Z

Initial page

New page

=== linux-hardened ===
[https://github.com/anthraxx/linux-hardened linux-hardened] is a Linux kernel with additional hardening patches applied.<syntaxhighlight lang="nix">
boot.kernelPackages = pkgs.linuxKernel.packages.linux_hardened;
</syntaxhighlight>

=== Lock kernel modules ===
This option locks kernel modules after the system is initialized. For example it prevents malicious USB devices from exploiting vulnerable kernel modules.<syntaxhighlight lang="nix">
security.lockKernelModules = true;
</syntaxhighlight>All needed modules must be loaded at boot by adding them to <code>boot.kernelModules</code>.

=== Module blacklist ===
<syntaxhighlight lang="nix">
boot.blacklistedKernelModules = [
# Obscure network protocols
"ax25" "netrom" "rose"

# Old or rare or insufficiently audited filesystems
"adfs" "affs"
"bfs" "befs"
"cramfs"
"efs" "erofs" "exofs"
"freevxfs" "f2fs"
"hfs" "hpfs"
"jfs"
"minix"
"nilfs2" "ntfs"
"omfs"
"qnx4" "qnx6"
"sysv"
"ufs"
];
</syntaxhighlight>

=== Kernel image protection ===
Prevents replacing the running kernel image.<syntaxhighlight lang="nix">
security.protectKernelImage = true;
</syntaxhighlight>

=== Kernel parameters ===
<syntaxhighlight lang="nix">
boot.kernelParams = [
# Don't merge slabs
"slab_nomerge"

# Overwrite free'd pages
"page_poison=1"

# Enable page allocator randomization
"page_alloc.shuffle=1"

# Disable debugfs
"debugfs=off"
];
</syntaxhighlight>

=== Sysctl parameters ===
<syntaxhighlight lang="nix"># Hide kptrs even for processes with CAP_SYSLOG
boot.kernel.sysctl."kernel.kptr_restrict" = "2";

# Disable bpf() JIT (to eliminate spray attacks)
boot.kernel.sysctl."net.core.bpf_jit_enable" = false;

# Disable ftrace debugging
boot.kernel.sysctl."kernel.ftrace_enabled" = false;

# Enable strict reverse path filtering (that is, do not attempt to route
# packets that "obviously" do not belong to the iface's network; dropped
# packets are logged as martians).
boot.kernel.sysctl."net.ipv4.conf.all.log_martians" = true;
boot.kernel.sysctl."net.ipv4.conf.all.rp_filter" = "1";
boot.kernel.sysctl."net.ipv4.conf.default.log_martians" = true;
boot.kernel.sysctl."net.ipv4.conf.default.rp_filter" = "1";

# Ignore broadcast ICMP (mitigate SMURF)
boot.kernel.sysctl."net.ipv4.icmp_echo_ignore_broadcasts" = true;

# Ignore incoming ICMP redirects (note: default is needed to ensure that the
# setting is applied to interfaces added after the sysctls are set)
boot.kernel.sysctl."net.ipv4.conf.all.accept_redirects" = false;
boot.kernel.sysctl."net.ipv4.conf.all.secure_redirects" = false;
boot.kernel.sysctl."net.ipv4.conf.default.accept_redirects" = false;
boot.kernel.sysctl."net.ipv4.conf.default.secure_redirects" = false;
boot.kernel.sysctl."net.ipv6.conf.all.accept_redirects" = false;
boot.kernel.sysctl."net.ipv6.conf.default.accept_redirects" = false;

# Ignore outgoing ICMP redirects (this is ipv4 only)
boot.kernel.sysctl."net.ipv4.conf.all.send_redirects" = false;
boot.kernel.sysctl."net.ipv4.conf.default.send_redirects" = false;</syntaxhighlight>

=== Disable Simultaneous Multithreading (SMT) ===
Might cause significant performance cost.<syntaxhighlight lang="nix">
security.allowSimultaneousMultithreading = false;
</syntaxhighlight>

=== Force Page Table Isolation ===
<syntaxhighlight lang="nix">
security.forcePageTableIsolation = true;
</syntaxhighlight>

=== Memory allocator ===
You can use security-focused memory allocator like [https://llvm.org/docs/ScudoHardenedAllocator.html scudo] or [https://github.com/GrapheneOS/hardened_malloc GrapheneOS hardened_malloc].<syntaxhighlight lang="nix">
# scudo
environment.memoryAllocator.provider = "scudo";
environment.variables.SCUDO_OPTIONS = "zero_contents=true";
# hardened_malloc
environment.memoryAllocator.provider = "graphene-hardened";
</syntaxhighlight>Some programs may not work with these memory allocators. You can force them to use the default libc allocator by blacklisting <code>/etc/ld-nix.so.preload</code> with a firejail wrap.<syntaxhighlight lang="nix">programs.firejail = {
enable = true;
wrappedBinaries = {
chromium = {
executable = "${pkgs.chromium}/bin/chromium-browser";
profile = "${pkgs.firejail}/etc/firejail/chromium-browser.profile";
extraArgs = [
"--blacklist=/etc/ld-nix.so.preload"
];
};
};
};</syntaxhighlight>

=== Nix allowed users ===
This option allows only <code>users</code> group to connect to the Nix daemon.<syntaxhighlight lang="nix">
nix.settings.allowed-users = [ "@users" ];
</syntaxhighlight>

=== Flush L1 data cache ===
Might cause significant performance cost.<syntaxhighlight lang="nix">
security.virtualisation.flushL1DataCache = "always";
</syntaxhighlight>

=== AppArmor ===
<syntaxhighlight lang="nix">
security.apparmor.enable = true;
security.apparmor.killUnconfinedConfinables = true;
</syntaxhighlight>