Official NixOS Wiki

NixOS Hardening: Difference between revisions

← Older edit
Golbinex (talk | contribs)
27 edits
VisualWikitext
Railwhale (talk | contribs)
21 edits
m group sections
Golbinex (talk | contribs)
27 edits
→linux-hardened: Update to 6.18
 
(5 intermediate revisions by 3 users not shown)
Line 1: Line 1:
== Kernel ==
== Kernel ==
=== linux-hardened ===
=== linux-hardened ===
[https://github.com/anthraxx/linux-hardened linux-hardened] is a Linux kernel with additional hardening patches applied. You can check for latest releases [https://github.com/anthraxx/linux-hardened/releases here].<syntaxhighlight lang="nix">
[https://github.com/anthraxx/linux-hardened linux-hardened] is a Linux kernel with additional hardening patches applied. You can build it from source, but you have to keep the kernel up to date for receiving security patches. You can check for latest releases [https://github.com/anthraxx/linux-hardened/releases here].
 
<syntaxhighlight lang="nix">
boot.kernelPackages = let
boot.kernelPackages = let
   linux_hardened_pkg = { fetchFromGitHub, buildLinux, lib, ... } @ args:
   linux_hardened_pkg = { fetchFromGitHub, buildLinux, lib, ... } @ args:


       buildLinux (args // rec {
       buildLinux (args // rec {
         version = "6.12.79-hardened1";
         version = "6.18.33-hardened1";
        hash = "sha256-TKrLHk4aB47vqehEdp5ks4WtMCq/XCDr9ro3eQOoPvE=";
          hash = "sha256-SlsOQjREc73E+90FiR+zrNELtUY9yZAT34vBr4Dt7h4=";
         extraMeta.branch = "6.12";
         extraMeta.branch = "6.18";


         modDirVersion = version;
         modDirVersion = version;
Line 51: Line 53:
           # Enable gcc plugin options
           # Enable gcc plugin options
           GCC_PLUGINS = yes;
           GCC_PLUGINS = yes;
          #A port of the PaX stackleak plugin
          GCC_PLUGIN_STACKLEAK = yes;


           # Runtime undefined behaviour checks
           # Runtime undefined behaviour checks
Line 94: Line 93:


=== Lock kernel modules ===
=== Lock kernel modules ===
This option locks kernel modules after the system is initialized. For example it prevents malicious USB devices from exploiting vulnerable kernel modules.<syntaxhighlight lang="nix">
This option locks kernel modules after the system is initialized. For example it prevents malicious USB devices from exploiting vulnerable kernel modules.
 
<syntaxhighlight lang="nix">
security.lockKernelModules = true;
security.lockKernelModules = true;
</syntaxhighlight>All needed modules must be loaded at boot by adding them to <code>boot.kernelModules</code>. One way of knowing what modules must be enabled is to disable this option and then list all enabled modules with <code>lsmod</code>.<syntaxhighlight lang="nix">
</syntaxhighlight>
 
All needed modules must be loaded at boot by adding them to <code>boot.kernelModules</code>. One way of knowing what modules must be enabled is to disable this option and then list all enabled modules with <code>lsmod</code>.
 
<syntaxhighlight lang="nix">
boot.kernelModules = [
boot.kernelModules = [
   # USB
   # USB
Line 108: Line 113:
];
];
</syntaxhighlight>
</syntaxhighlight>
=== Module blacklist ===
=== Module blacklist ===
<syntaxhighlight lang="nix">
<syntaxhighlight lang="nix">
boot.blacklistedKernelModules = [
boot.blacklistedKernelModules = [
Line 132: Line 139:


=== Kernel image protection ===
=== Kernel image protection ===
Prevents replacing the running kernel image.<syntaxhighlight lang="nix">
Prevents replacing the running kernel image.
 
<syntaxhighlight lang="nix">
security.protectKernelImage = true;
security.protectKernelImage = true;
</syntaxhighlight>
</syntaxhighlight>


=== Kernel parameters ===
=== Kernel parameters ===
<syntaxhighlight lang="nix">
<syntaxhighlight lang="nix">
boot.kernelParams = [
boot.kernelParams = [
Line 154: Line 164:


=== Sysctl parameters ===
=== Sysctl parameters ===
<syntaxhighlight lang="nix"># Hide kptrs even for processes with CAP_SYSLOG
 
<syntaxhighlight lang="nix">
# Hide kptrs even for processes with CAP_SYSLOG
boot.kernel.sysctl."kernel.kptr_restrict" = "2";
boot.kernel.sysctl."kernel.kptr_restrict" = "2";


Line 189: Line 201:
# Ignore outgoing ICMP redirects (this is ipv4 only)
# Ignore outgoing ICMP redirects (this is ipv4 only)
boot.kernel.sysctl."net.ipv4.conf.all.send_redirects" = false;
boot.kernel.sysctl."net.ipv4.conf.all.send_redirects" = false;
boot.kernel.sysctl."net.ipv4.conf.default.send_redirects" = false;</syntaxhighlight>
boot.kernel.sysctl."net.ipv4.conf.default.send_redirects" = false;
</syntaxhighlight>


=== Disable Simultaneous Multithreading (SMT) ===
=== Disable Simultaneous Multithreading (SMT) ===
Might cause significant performance cost.<syntaxhighlight lang="nix">
 
Might cause significant performance cost.
 
<syntaxhighlight lang="nix">
security.allowSimultaneousMultithreading = false;
security.allowSimultaneousMultithreading = false;
</syntaxhighlight>
</syntaxhighlight>


=== Force Page Table Isolation ===
=== Force Page Table Isolation ===
<syntaxhighlight lang="nix">
<syntaxhighlight lang="nix">
security.forcePageTableIsolation = true;
security.forcePageTableIsolation = true;
Line 202: Line 219:




== Nix settings ==
=== Nix allowed users ===
This option allows only <code>users</code> group to connect to the Nix daemon.
<syntaxhighlight lang="nix">
nix.settings.allowed-users = [ "@users" ];
</syntaxhighlight>
== Other settings ==


=== Memory allocator ===
=== Memory allocator ===
You can use security-focused memory allocator like [https://llvm.org/docs/ScudoHardenedAllocator.html scudo] or [https://github.com/GrapheneOS/hardened_malloc GrapheneOS hardened_malloc].<syntaxhighlight lang="nix">
 
You can use security-focused memory allocator like [https://llvm.org/docs/ScudoHardenedAllocator.html scudo] or [https://github.com/GrapheneOS/hardened_malloc GrapheneOS hardened_malloc].
 
<syntaxhighlight lang="nix">
# scudo
# scudo
environment.memoryAllocator.provider = "scudo";
environment.memoryAllocator.provider = "scudo";
environment.variables.SCUDO_OPTIONS = "zero_contents=true";
environment.variables.SCUDO_OPTIONS = "zero_contents=true";
# hardened_malloc
# hardened_malloc
environment.memoryAllocator.provider = "graphene-hardened";
environment.memoryAllocator.provider = "graphene-hardened";
</syntaxhighlight>Some programs may not work with these memory allocators. You can force them to use the default libc allocator by blacklisting <code>/etc/ld-nix.so.preload</code> with a firejail wrap.<syntaxhighlight lang="nix">programs.firejail = {
</syntaxhighlight>
 
Some programs may not work with these memory allocators. You can force them to use the default libc allocator by blacklisting <code>/etc/ld-nix.so.preload</code> with a firejail wrap.
 
<syntaxhighlight lang="nix">
programs.firejail = {
   enable = true;
   enable = true;
   wrappedBinaries = {
   wrappedBinaries = {
Line 221: Line 258:
     };
     };
   };
   };
};</syntaxhighlight>
};
</syntaxhighlight>


== Nix settings ==
=== Flush L1 data cache ===


=== Nix allowed users ===
Might cause significant performance cost.
This option allows only <code>users</code> group to connect to the Nix daemon.<syntaxhighlight lang="nix">
nix.settings.allowed-users = [ "@users" ];
</syntaxhighlight>


== Other settings ==
<syntaxhighlight lang="nix">
 
=== Flush L1 data cache ===
Might cause significant performance cost.<syntaxhighlight lang="nix">
security.virtualisation.flushL1DataCache = "always";
security.virtualisation.flushL1DataCache = "always";
</syntaxhighlight>
</syntaxhighlight>
Line 248: Line 280:


=== Secure Boot ===
=== Secure Boot ===
See [[Secure Boot]]. [[Limine]] bootloader supports coreboot's Secure Boot.
See [[Secure Boot]]. [[Limine]] bootloader supports coreboot's Secure Boot.
== See Also ==
* [https://wiki.archlinux.org/title/Security Arch Wiki Security Page]
[[Category:Guide]]
[[Category:Guide]]
[[Category:NixOS]]
[[Category:NixOS]]
[[Category:Security]]
[[Category:Security]]
Retrieved from "https://wiki.nixos.org/wiki/NixOS_Hardening"