NixOS Hardening - Revision history

Golbinex: /* linux-hardened */ Update to 6.18

2026-05-31T10:15:41Z

linux-hardened: Update to 6.18

← Older revision		Revision as of 10:15, 31 May 2026
Line 8:		Line 8:

	buildLinux (args // rec {		buildLinux (args // rec {
	version = "6.12.79-hardened1";		version = "6.18.33-hardened1";
	hash = "sha256-~~TKrLHk4aB47vqehEdp5ks4WtMCq/XCDr9ro3eQOoPvE~~=";		hash = "sha256-SlsOQjREc73E+90FiR+zrNELtUY9yZAT34vBr4Dt7h4=";
	extraMeta.branch = "6.12";		extraMeta.branch = "6.18";

	modDirVersion = version;		modDirVersion = version;
Line 53:		Line 53:
	# Enable gcc plugin options		# Enable gcc plugin options
	GCC_PLUGINS = yes;		GCC_PLUGINS = yes;

	~~#A port of the PaX stackleak plugin~~
	~~GCC_PLUGIN_STACKLEAK = yes;~~

	# Runtime undefined behaviour checks		# Runtime undefined behaviour checks

Golbinex at 09:17, 31 May 2026

2026-05-31T09:17:43Z

← Older revision		Revision as of 09:17, 31 May 2026
Line 1:		Line 1:
	== Kernel ==		== Kernel ==
	=== linux-hardened ===		=== linux-hardened ===
	[https://github.com/anthraxx/linux-hardened linux-hardened] is a Linux kernel with additional hardening patches applied. You can build it from source, but you have ~~too~~ keep the kernel up to date. You can check for latest releases [https://github.com/anthraxx/linux-hardened/releases here].		[https://github.com/anthraxx/linux-hardened linux-hardened] is a Linux kernel with additional hardening patches applied. You can build it from source, but you have to keep the kernel up to date for receiving security patches. You can check for latest releases [https://github.com/anthraxx/linux-hardened/releases here].

	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">

Golbinex: Undo revision 32112 by Pandapip1 (talk) Even though linux-hardened was removed from nixpkgs, linux-hardened itself is not discontinued and this part shows how to build it from source.

2026-05-31T09:15:24Z

Undo revision 32112 by Pandapip1 (talk) Even though linux-hardened was removed from nixpkgs, linux-hardened itself is not discontinued and this part shows how to build it from source.

@@ Line 1: / Line 1: @@
 == Kernel ==
 === Lock kernel modules ===
 This option locks kernel modules after the system is initialized. For example it prevents malicious USB devices from exploiting vulnerable kernel modules.

Pandapip1: linux-hardened removed in 26.05

2026-05-29T02:54:52Z

linux-hardened removed in 26.05

@@ Line 1: / Line 1: @@
 == Kernel ==
 === Lock kernel modules ===
 This option locks kernel modules after the system is initialized. For example it prevents malicious USB devices from exploiting vulnerable kernel modules.

Railwhale: add see also

2026-05-16T23:33:47Z

add see also

← Older revision		Revision as of 23:33, 16 May 2026
Line 285:		Line 285:

	See [[Secure Boot]]. [[Limine]] bootloader supports coreboot's Secure Boot.		See [[Secure Boot]]. [[Limine]] bootloader supports coreboot's Secure Boot.

			== See Also ==
			* [https://wiki.archlinux.org/title/Security Arch Wiki Security Page]

Railwhale: tidy up (add space between things)

2026-05-16T23:30:07Z

tidy up (add space between things)

← Older revision		Revision as of 23:30, 16 May 2026
Line 1:		Line 1:
	== Kernel ==		== Kernel ==
	=== linux-hardened ===		=== linux-hardened ===
	[https://github.com/anthraxx/linux-hardened linux-hardened] is a Linux kernel with additional hardening patches applied. You can check for latest releases [https://github.com/anthraxx/linux-hardened/releases here].<syntaxhighlight lang="nix">		[https://github.com/anthraxx/linux-hardened linux-hardened] is a Linux kernel with additional hardening patches applied. You can check for latest releases [https://github.com/anthraxx/linux-hardened/releases here].

			<syntaxhighlight lang="nix">
	boot.kernelPackages = let		boot.kernelPackages = let
	linux_hardened_pkg = { fetchFromGitHub, buildLinux, lib, ... } @ args:		linux_hardened_pkg = { fetchFromGitHub, buildLinux, lib, ... } @ args:
Line 94:		Line 96:

	=== Lock kernel modules ===		=== Lock kernel modules ===
	This option locks kernel modules after the system is initialized. For example it prevents malicious USB devices from exploiting vulnerable kernel modules.<syntaxhighlight lang="nix">		This option locks kernel modules after the system is initialized. For example it prevents malicious USB devices from exploiting vulnerable kernel modules.

			<syntaxhighlight lang="nix">
	security.lockKernelModules = true;		security.lockKernelModules = true;
	</syntaxhighlight>All needed modules must be loaded at boot by adding them to <code>boot.kernelModules</code>. One way of knowing what modules must be enabled is to disable this option and then list all enabled modules with <code>lsmod</code>.<syntaxhighlight lang="nix">		</syntaxhighlight>

			All needed modules must be loaded at boot by adding them to <code>boot.kernelModules</code>. One way of knowing what modules must be enabled is to disable this option and then list all enabled modules with <code>lsmod</code>.

			<syntaxhighlight lang="nix">
	boot.kernelModules = [		boot.kernelModules = [
	# USB		# USB
Line 108:		Line 116:
	];		];
	</syntaxhighlight>		</syntaxhighlight>

	=== Module blacklist ===		=== Module blacklist ===

	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
	boot.blacklistedKernelModules = [		boot.blacklistedKernelModules = [
Line 132:		Line 142:

	=== Kernel image protection ===		=== Kernel image protection ===
	Prevents replacing the running kernel image.<syntaxhighlight lang="nix">		Prevents replacing the running kernel image.

			<syntaxhighlight lang="nix">
	security.protectKernelImage = true;		security.protectKernelImage = true;
	</syntaxhighlight>		</syntaxhighlight>

	=== Kernel parameters ===		=== Kernel parameters ===

	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
	boot.kernelParams = [		boot.kernelParams = [
Line 154:		Line 167:

	=== Sysctl parameters ===		=== Sysctl parameters ===
	<syntaxhighlight lang="nix"># Hide kptrs even for processes with CAP_SYSLOG
			<syntaxhighlight lang="nix">
			# Hide kptrs even for processes with CAP_SYSLOG
	boot.kernel.sysctl."kernel.kptr_restrict" = "2";		boot.kernel.sysctl."kernel.kptr_restrict" = "2";

Line 189:		Line 204:
	# Ignore outgoing ICMP redirects (this is ipv4 only)		# Ignore outgoing ICMP redirects (this is ipv4 only)
	boot.kernel.sysctl."net.ipv4.conf.all.send_redirects" = false;		boot.kernel.sysctl."net.ipv4.conf.all.send_redirects" = false;
	boot.kernel.sysctl."net.ipv4.conf.default.send_redirects" = false;</syntaxhighlight>		boot.kernel.sysctl."net.ipv4.conf.default.send_redirects" = false;
			</syntaxhighlight>

	=== Disable Simultaneous Multithreading (SMT) ===		=== Disable Simultaneous Multithreading (SMT) ===
	Might cause significant performance cost.<syntaxhighlight lang="nix">
			Might cause significant performance cost.

			<syntaxhighlight lang="nix">
	security.allowSimultaneousMultithreading = false;		security.allowSimultaneousMultithreading = false;
	</syntaxhighlight>		</syntaxhighlight>

	=== Force Page Table Isolation ===		=== Force Page Table Isolation ===

	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
	security.forcePageTableIsolation = true;		security.forcePageTableIsolation = true;
Line 202:		Line 222:


			== Nix settings ==

			=== Nix allowed users ===

			This option allows only <code>users</code> group to connect to the Nix daemon.

			<syntaxhighlight lang="nix">
			nix.settings.allowed-users = [ "@users" ];
			</syntaxhighlight>

			== Other settings ==

	=== Memory allocator ===		=== Memory allocator ===
	You can use security-focused memory allocator like [https://llvm.org/docs/ScudoHardenedAllocator.html scudo] or [https://github.com/GrapheneOS/hardened_malloc GrapheneOS hardened_malloc].<syntaxhighlight lang="nix">
			You can use security-focused memory allocator like [https://llvm.org/docs/ScudoHardenedAllocator.html scudo] or [https://github.com/GrapheneOS/hardened_malloc GrapheneOS hardened_malloc].

			<syntaxhighlight lang="nix">
	# scudo		# scudo
	environment.memoryAllocator.provider = "scudo";		environment.memoryAllocator.provider = "scudo";
	environment.variables.SCUDO_OPTIONS = "zero_contents=true";		environment.variables.SCUDO_OPTIONS = "zero_contents=true";

	# hardened_malloc		# hardened_malloc
	environment.memoryAllocator.provider = "graphene-hardened";		environment.memoryAllocator.provider = "graphene-hardened";
	</syntaxhighlight>Some programs may not work with these memory allocators. You can force them to use the default libc allocator by blacklisting <code>/etc/ld-nix.so.preload</code> with a firejail wrap.<syntaxhighlight lang="nix">programs.firejail = {		</syntaxhighlight>

			Some programs may not work with these memory allocators. You can force them to use the default libc allocator by blacklisting <code>/etc/ld-nix.so.preload</code> with a firejail wrap.

			<syntaxhighlight lang="nix">
			programs.firejail = {
	enable = true;		enable = true;
	wrappedBinaries = {		wrappedBinaries = {
Line 221:		Line 261:
	};		};
	};		};
	};</syntaxhighlight>		};
			</syntaxhighlight>

	== ~~Nix settings~~ ==		=== Flush L1 data cache ===

	~~=== Nix allowed users ===~~		Might cause significant performance cost.
	~~This option allows only <code>users</code> group to connect to the Nix daemon~~.~~<syntaxhighlight lang="nix">~~
	~~nix.settings.allowed-users = [ "@users" ];~~
	~~</syntaxhighlight>~~

	~~== Other settings ==~~		<syntaxhighlight lang="nix">

	~~=== Flush L1 data cache ===~~
	~~Might cause significant performance cost.~~<syntaxhighlight lang="nix">
	security.virtualisation.flushL1DataCache = "always";		security.virtualisation.flushL1DataCache = "always";
	</syntaxhighlight>		</syntaxhighlight>
Line 248:		Line 283:

	=== Secure Boot ===		=== Secure Boot ===

	See [[Secure Boot]]. [[Limine]] bootloader supports coreboot's Secure Boot.		See [[Secure Boot]]. [[Limine]] bootloader supports coreboot's Secure Boot.


	[[Category:Guide]]		[[Category:Guide]]
	[[Category:NixOS]]		[[Category:NixOS]]
	[[Category:Security]]		[[Category:Security]]

Railwhale: group sections

2026-05-16T23:16:10Z

group sections

← Older revision		Revision as of 23:16, 16 May 2026
Line 1:		Line 1:
			== Kernel ==
	=== linux-hardened ===		=== linux-hardened ===
	[https://github.com/anthraxx/linux-hardened linux-hardened] is a Linux kernel with additional hardening patches applied. You can check for latest releases [https://github.com/anthraxx/linux-hardened/releases here].<syntaxhighlight lang="nix">		[https://github.com/anthraxx/linux-hardened linux-hardened] is a Linux kernel with additional hardening patches applied. You can check for latest releases [https://github.com/anthraxx/linux-hardened/releases here].<syntaxhighlight lang="nix">
Line 199:		Line 200:
	security.forcePageTableIsolation = true;		security.forcePageTableIsolation = true;
	</syntaxhighlight>		</syntaxhighlight>



	=== Memory allocator ===		=== Memory allocator ===
Line 219:		Line 222:
	};		};
	};</syntaxhighlight>		};</syntaxhighlight>

			== Nix settings ==

	=== Nix allowed users ===		=== Nix allowed users ===
Line 224:		Line 229:
	nix.settings.allowed-users = [ "@users" ];		nix.settings.allowed-users = [ "@users" ];
	</syntaxhighlight>		</syntaxhighlight>

			== Other settings ==

	=== Flush L1 data cache ===		=== Flush L1 data cache ===
Line 237:		Line 244:
	security.apparmor.killUnconfinedConfinables = true;		security.apparmor.killUnconfinedConfinables = true;
	</syntaxhighlight>		</syntaxhighlight>

			== Lower-level ==

	=== Secure Boot ===		=== Secure Boot ===

Rhendric: /* Sysctl parameters */ Add kernel.io_uring_disabled=2

2026-05-08T16:57:31Z

Sysctl parameters: Add kernel.io_uring_disabled=2

← Older revision		Revision as of 16:57, 8 May 2026
Line 161:		Line 161:
	# Disable ftrace debugging		# Disable ftrace debugging
	boot.kernel.sysctl."kernel.ftrace_enabled" = false;		boot.kernel.sysctl."kernel.ftrace_enabled" = false;

			# Disable io_uring, a large source of security vulnerabilities
			# https://security.googleblog.com/2023/06/learnings-from-kctf-vrps-42-linux.html
			boot.kernel.sysctl."kernel.io_uring_disabled" = 2;

	# Enable strict reverse path filtering (that is, do not attempt to route		# Enable strict reverse path filtering (that is, do not attempt to route

Arch is the best: Link to Security#AppArmor

2026-05-01T00:15:47Z

Link to Security#AppArmor

← Older revision		Revision as of 00:15, 1 May 2026
Line 227:		Line 227:

	=== AppArmor ===		=== AppArmor ===
			See [[Security#AppArmor]] for more details.

	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
	security.apparmor.enable = true;		security.apparmor.enable = true;

Golbinex: Add categories

2026-04-07T16:25:06Z

Add categories

← Older revision		Revision as of 16:25, 7 April 2026
Line 234:		Line 234:
	=== Secure Boot ===		=== Secure Boot ===
	See [[Secure Boot]]. [[Limine]] bootloader supports coreboot's Secure Boot.		See [[Secure Boot]]. [[Limine]] bootloader supports coreboot's Secure Boot.
			[[Category:Guide]]
			[[Category:NixOS]]
			[[Category:Security]]