NixOS Hardening: Difference between revisions
m tidy up (add space between things) |
→linux-hardened: Update to 6.18 |
||
| (4 intermediate revisions by 3 users not shown) | |||
| Line 1: | Line 1: | ||
== Kernel == | == Kernel == | ||
=== linux-hardened === | === linux-hardened === | ||
[https://github.com/anthraxx/linux-hardened linux-hardened] is a Linux kernel with additional hardening patches applied. You can check for latest releases [https://github.com/anthraxx/linux-hardened/releases here]. | [https://github.com/anthraxx/linux-hardened linux-hardened] is a Linux kernel with additional hardening patches applied. You can build it from source, but you have to keep the kernel up to date for receiving security patches. You can check for latest releases [https://github.com/anthraxx/linux-hardened/releases here]. | ||
<syntaxhighlight lang="nix"> | <syntaxhighlight lang="nix"> | ||
| Line 8: | Line 8: | ||
buildLinux (args // rec { | buildLinux (args // rec { | ||
version = "6. | version = "6.18.33-hardened1"; | ||
hash = "sha256-SlsOQjREc73E+90FiR+zrNELtUY9yZAT34vBr4Dt7h4="; | |||
extraMeta.branch = "6. | extraMeta.branch = "6.18"; | ||
modDirVersion = version; | modDirVersion = version; | ||
| Line 53: | Line 53: | ||
# Enable gcc plugin options | # Enable gcc plugin options | ||
GCC_PLUGINS = yes; | GCC_PLUGINS = yes; | ||
# Runtime undefined behaviour checks | # Runtime undefined behaviour checks | ||
| Line 285: | Line 282: | ||
See [[Secure Boot]]. [[Limine]] bootloader supports coreboot's Secure Boot. | See [[Secure Boot]]. [[Limine]] bootloader supports coreboot's Secure Boot. | ||
== See Also == | |||
* [https://wiki.archlinux.org/title/Security Arch Wiki Security Page] | |||