Security - Revision history

Arch is the best: Add AppArmor

2026-05-01T00:14:46Z

Add AppArmor

← Older revision		Revision as of 00:14, 1 May 2026
Line 115:		Line 115:

	It is possible to use [https://en.wikipedia.org/wiki/Security-Enhanced_Linux Security-Enhanced Linux (SELinux)] in NixOS, but proper integration does not exist. This does not appear to have gotten much attention [https://github.com/NixOS/rfcs/pull/41 since 2019]. However, there has been revived work in 2025 but there's no telling when things will land in NixOS.		It is possible to use [https://en.wikipedia.org/wiki/Security-Enhanced_Linux Security-Enhanced Linux (SELinux)] in NixOS, but proper integration does not exist. This does not appear to have gotten much attention [https://github.com/NixOS/rfcs/pull/41 since 2019]. However, there has been revived work in 2025 but there's no telling when things will land in NixOS.

			=== AppArmor ===

			As of April 2026, AppArmor is available for NixOS but also has [https://discourse.nixos.org/t/apparmor-on-nixos-roadmap/57217 not yet been properly integrated].

	== Nix official references ==		== Nix official references ==

Golbinex: Add NixOS Hardening link

2026-03-24T08:41:24Z

Add NixOS Hardening link

← Older revision		Revision as of 08:41, 24 March 2026
Line 124:		Line 124:
	=== NixOS ===		=== NixOS ===

			* [[NixOS Hardening]]
	* [https://christine.website/blog/paranoid-nixos-2021-07-18 Blog - Paranoid NixOS Setup]		* [https://christine.website/blog/paranoid-nixos-2021-07-18 Blog - Paranoid NixOS Setup]
	* [https://github.com/flyingcircusio/vulnix vulnix] - Vulnerability (CVE) scanner for Nix/NixOS		* [https://github.com/flyingcircusio/vulnix vulnix] - Vulnerability (CVE) scanner for Nix/NixOS

Klinger: Category:Security added

2025-12-29T10:16:13Z

Category:Security added

← Older revision		Revision as of 10:16, 29 December 2025
Line 149:		Line 149:
	[[Category:NixOS]]		[[Category:NixOS]]
	[[Category:Nix]]		[[Category:Nix]]
			[[Category:Security]]

Mightyiam: Link to Nixcademy blog post on supply chain security

2025-12-29T01:23:42Z

Link to Nixcademy blog post on supply chain security

← Older revision		Revision as of 01:23, 29 December 2025
Line 142:		Line 142:
	* [https://github.com/decalage2/awesome-security-hardening awesome-security-hardening] - Collection of security hardening guides, tools and other resources.		* [https://github.com/decalage2/awesome-security-hardening awesome-security-hardening] - Collection of security hardening guides, tools and other resources.

			=== Supply chain security ===

			* [https://nixcademy.com/posts/secure-supply-chain-with-nix/ Demonstrably Secure Software Supply Chains with Nix], Nixcademy

	[[Category:Guide]]		[[Category:Guide]]
	[[Category:NixOS]]		[[Category:NixOS]]
	[[Category:Nix]]		[[Category:Nix]]

Golbinex: Add Limine to Secure Boot section

2025-12-02T19:12:25Z

Add Limine to Secure Boot section

← Older revision		Revision as of 19:12, 2 December 2025
Line 110:		Line 110:
	=== Secure Boot ===		=== Secure Boot ===

	Development of [https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#Secure_Boot UEFI Secure Boot] support is [https://github.com/NixOS/nixpkgs/issues/42127 in flight]. An experimental ~~secure boot~~ implementation is available in [https://github.com/nix-community/lanzaboote Lanzaboote]		Development of [https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#Secure_Boot UEFI Secure Boot] support is [https://github.com/NixOS/nixpkgs/issues/42127 in flight]. An experimental Secure Boot implementation is available in [https://github.com/nix-community/lanzaboote Lanzaboote]. [[Limine]] bootloader also supports Secure Boot.

	=== SELinux ===		=== SELinux ===

Wo2wz: fix typo

2025-10-08T23:36:59Z

fix typo

← Older revision		Revision as of 23:36, 8 October 2025
Line 46:		Line 46:
	==== Flatpaks ====		==== Flatpaks ====

	[https://en.wikipedia.org/wiki/Flatpak Flatpak]'ed applications are [https://docs.flatpak.org/en/latest/sandbox-permissions.html sandboxed] and require explicit privilege declaration for most access outside their own path. NixOS includes [https://nixos.org/manual/nixos/unstable/index.html#module-services-flatpak support for Flatpak]. Note that, since Flatpak application dependencies are [https://stackoverflow.com/questions/26217488/what-is-vendoring bundled/vendored], this introduces [https://blogs.gentoo.org/mgorny/2021/02/19/the-modern-packagers-security-nightmare/ other security risks] for the application . Also, most application flatpaks [https://flatkill.org/ do no not make meaningful use of the sandbox].		[https://en.wikipedia.org/wiki/Flatpak Flatpak]'ed applications are [https://docs.flatpak.org/en/latest/sandbox-permissions.html sandboxed] and require explicit privilege declaration for most access outside their own path. NixOS includes [https://nixos.org/manual/nixos/unstable/index.html#module-services-flatpak support for Flatpak]. Note that, since Flatpak application dependencies are [https://stackoverflow.com/questions/26217488/what-is-vendoring bundled/vendored], this introduces [https://blogs.gentoo.org/mgorny/2021/02/19/the-modern-packagers-security-nightmare/ other security risks] for the application . Also, most application flatpaks [https://flatkill.org/ do not make meaningful use of the sandbox].

	==== Linux Containers ====		==== Linux Containers ====

TheComputerGuy: /* SELinux */ Added a note since I'm working on it

2025-04-05T01:37:43Z

SELinux: Added a note since I'm working on it

← Older revision		Revision as of 01:37, 5 April 2025
Line 114:		Line 114:
	=== SELinux ===		=== SELinux ===

	It is possible to use [https://en.wikipedia.org/wiki/Security-Enhanced_Linux Security-Enhanced Linux (SELinux)] in NixOS, but proper integration does not exist. This does not appear to have gotten much attention [https://github.com/NixOS/rfcs/pull/41 since 2019].		It is possible to use [https://en.wikipedia.org/wiki/Security-Enhanced_Linux Security-Enhanced Linux (SELinux)] in NixOS, but proper integration does not exist. This does not appear to have gotten much attention [https://github.com/NixOS/rfcs/pull/41 since 2019]. However, there has been revived work in 2025 but there's no telling when things will land in NixOS.

	== Nix official references ==		== Nix official references ==

Elikoga: /* Core Nix features */ Reorder paragraphs to place Security by Obscurity last

2024-04-22T12:20:18Z

Core Nix features: Reorder paragraphs to place Security by Obscurity last

← Older revision		Revision as of 12:20, 22 April 2024
Line 6:		Line 6:

	These are security elements that are core features of using Nix(OS).		These are security elements that are core features of using Nix(OS).

	~~=== Obscurity of Nix store ===~~

	In a vanilla NixOS system, the typical [https://en.wikipedia.org/wiki/Filesystem_Hierarchy_Standard Linux filesystem hierarchy] is, in large part, replaced with the Nix store's [[User Environment\|user environments]]. This means that some malware which might rely on finding system tools in particular places might fail. This is a form of [https://en.wikipedia.org/wiki/Security_through_obscurity security through obscurity] and is only a minor layer of protection.

	=== Effort to isolate runtime search paths ===		=== Effort to isolate runtime search paths ===

	In general, there is an effort to avoid [~~https~~:~~//en.wikipedia.org/wiki/~~Rpath rpath] collisions across users [https://github.com/NixOS/nix/commit/eba840c8a13b465ace90172ff76a0db2899ab11b].		In general, there is an effort to avoid [[wikipedia:Rpath\|rpath]] collisions across users [https://github.com/NixOS/nix/commit/eba840c8a13b465ace90172ff76a0db2899ab11b].

	=== Multi-user installation ===		=== Multi-user installation ===
Line 21:		Line 17:
	=== Data integrity and authenticity ===		=== Data integrity and authenticity ===

	The core installation resources for Nix(OS) have [~~https~~:~~//en.wikipedia.org/wiki/~~SHA-2 SHA256] checksums which are [~~https~~:~~//en.wikipedia.org/wiki/~~GNU_Privacy_Guard GPG] signed by the [https://nixos.org/download.html#nix-verify-installation Nix team] for authenticity. Within the installation data are all the SHA256 checksums for packages that were available within Nixpkgs at build time.		The core installation resources for Nix(OS) have [[wikipedia:SHA-2\|SHA256]] checksums which are [[wikipedia:GNU_Privacy_Guard\|GPG]] signed by the [https://nixos.org/download.html#nix-verify-installation Nix team] for authenticity. Within the installation data are all the SHA256 checksums for packages that were available within Nixpkgs at build time.

	All packages which are pulled into your Nix system via Nixpkgs derivation builds are checked against SHA256 checksums which are already available on your local system (and should be traceable to the signed core Nix install materials).		All packages which are pulled into your Nix system via Nixpkgs derivation builds are checked against SHA256 checksums which are already available on your local system (and should be traceable to the signed core Nix install materials).

			=== Obscurity of Nix store ===

			In a vanilla NixOS system, the typical [https://en.wikipedia.org/wiki/Filesystem_Hierarchy_Standard Linux filesystem hierarchy] is, in large part, replaced with the Nix store's [[User Environment\|user environments]]. This means that some malware which might rely on finding system tools in particular places might fail. This is a form of [https://en.wikipedia.org/wiki/Security_through_obscurity security through obscurity] and is only a minor layer of protection.

	== Supported by Nix ==		== Supported by Nix ==

imported>Snowman6081: Update secure boot section to directly mention lanzaboote.

2023-04-24T09:22:22Z

Update secure boot section to directly mention lanzaboote.

← Older revision		Revision as of 09:22, 24 April 2023
Line 110:		Line 110:
	=== Secure Boot ===		=== Secure Boot ===

	Development of [https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#Secure_Boot UEFI Secure Boot] support is [https://github.com/NixOS/nixpkgs/issues/42127 in flight]. ~~Looking<ref>~~[https://~~nlnet~~.nl/~~project/NixOS~~-~~UEFI~~/ ~~NLnet Foundation project ''UEFI Secure Boot support for NixOS''~~]~~</ref> potential for release in 22.11.~~		Development of [https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#Secure_Boot UEFI Secure Boot] support is [https://github.com/NixOS/nixpkgs/issues/42127 in flight]. An experimental secure boot implementation is available in [https://github.com/nix-community/lanzaboote Lanzaboote]

	=== SELinux ===		=== SELinux ===

imported>Astro: /* Virtual machines */ add microvm.nix

2022-09-26T21:43:30Z

Virtual machines: add microvm.nix

← Older revision		Revision as of 21:43, 26 September 2022
Line 73:		Line 73:
	* [https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/virtualisation/qemu-vm.nix qemu-vm.nix - Implementation of QEMU builds of NixOS machine configurations]		* [https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/virtualisation/qemu-vm.nix qemu-vm.nix - Implementation of QEMU builds of NixOS machine configurations]
	* [https://github.com/firecracker-microvm/firecracker Firecracker microVM] - packages [https://search.nixos.org/packages?channel=unstable&show=firecracker&from=0&size=30&sort=relevance&type=packages&query=firecracker available]		* [https://github.com/firecracker-microvm/firecracker Firecracker microVM] - packages [https://search.nixos.org/packages?channel=unstable&show=firecracker&from=0&size=30&sort=relevance&type=packages&query=firecracker available]
			* [https://github.com/astro/microvm.nix microvm.nix] builds and runs NixOS on various hypervisors

	===== Test machines =====		===== Test machines =====