NixOS Hardening: Difference between revisions
m group sections |
m tidy up (add space between things) |
||
| Line 1: | Line 1: | ||
== Kernel == | == Kernel == | ||
=== linux-hardened === | === linux-hardened === | ||
[https://github.com/anthraxx/linux-hardened linux-hardened] is a Linux kernel with additional hardening patches applied. You can check for latest releases [https://github.com/anthraxx/linux-hardened/releases here].<syntaxhighlight lang="nix"> | [https://github.com/anthraxx/linux-hardened linux-hardened] is a Linux kernel with additional hardening patches applied. You can check for latest releases [https://github.com/anthraxx/linux-hardened/releases here]. | ||
<syntaxhighlight lang="nix"> | |||
boot.kernelPackages = let | boot.kernelPackages = let | ||
linux_hardened_pkg = { fetchFromGitHub, buildLinux, lib, ... } @ args: | linux_hardened_pkg = { fetchFromGitHub, buildLinux, lib, ... } @ args: | ||
| Line 94: | Line 96: | ||
=== Lock kernel modules === | === Lock kernel modules === | ||
This option locks kernel modules after the system is initialized. For example it prevents malicious USB devices from exploiting vulnerable kernel modules.<syntaxhighlight lang="nix"> | This option locks kernel modules after the system is initialized. For example it prevents malicious USB devices from exploiting vulnerable kernel modules. | ||
<syntaxhighlight lang="nix"> | |||
security.lockKernelModules = true; | security.lockKernelModules = true; | ||
</syntaxhighlight>All needed modules must be loaded at boot by adding them to <code>boot.kernelModules</code>. One way of knowing what modules must be enabled is to disable this option and then list all enabled modules with <code>lsmod</code>.<syntaxhighlight lang="nix"> | </syntaxhighlight> | ||
All needed modules must be loaded at boot by adding them to <code>boot.kernelModules</code>. One way of knowing what modules must be enabled is to disable this option and then list all enabled modules with <code>lsmod</code>. | |||
<syntaxhighlight lang="nix"> | |||
boot.kernelModules = [ | boot.kernelModules = [ | ||
# USB | # USB | ||
| Line 108: | Line 116: | ||
]; | ]; | ||
</syntaxhighlight> | </syntaxhighlight> | ||
=== Module blacklist === | === Module blacklist === | ||
<syntaxhighlight lang="nix"> | <syntaxhighlight lang="nix"> | ||
boot.blacklistedKernelModules = [ | boot.blacklistedKernelModules = [ | ||
| Line 132: | Line 142: | ||
=== Kernel image protection === | === Kernel image protection === | ||
Prevents replacing the running kernel image.<syntaxhighlight lang="nix"> | Prevents replacing the running kernel image. | ||
<syntaxhighlight lang="nix"> | |||
security.protectKernelImage = true; | security.protectKernelImage = true; | ||
</syntaxhighlight> | </syntaxhighlight> | ||
=== Kernel parameters === | === Kernel parameters === | ||
<syntaxhighlight lang="nix"> | <syntaxhighlight lang="nix"> | ||
boot.kernelParams = [ | boot.kernelParams = [ | ||
| Line 154: | Line 167: | ||
=== Sysctl parameters === | === Sysctl parameters === | ||
<syntaxhighlight lang="nix"># Hide kptrs even for processes with CAP_SYSLOG | |||
<syntaxhighlight lang="nix"> | |||
# Hide kptrs even for processes with CAP_SYSLOG | |||
boot.kernel.sysctl."kernel.kptr_restrict" = "2"; | boot.kernel.sysctl."kernel.kptr_restrict" = "2"; | ||
| Line 189: | Line 204: | ||
# Ignore outgoing ICMP redirects (this is ipv4 only) | # Ignore outgoing ICMP redirects (this is ipv4 only) | ||
boot.kernel.sysctl."net.ipv4.conf.all.send_redirects" = false; | boot.kernel.sysctl."net.ipv4.conf.all.send_redirects" = false; | ||
boot.kernel.sysctl."net.ipv4.conf.default.send_redirects" = false;</syntaxhighlight> | boot.kernel.sysctl."net.ipv4.conf.default.send_redirects" = false; | ||
</syntaxhighlight> | |||
=== Disable Simultaneous Multithreading (SMT) === | === Disable Simultaneous Multithreading (SMT) === | ||
Might cause significant performance cost.<syntaxhighlight lang="nix"> | |||
Might cause significant performance cost. | |||
<syntaxhighlight lang="nix"> | |||
security.allowSimultaneousMultithreading = false; | security.allowSimultaneousMultithreading = false; | ||
</syntaxhighlight> | </syntaxhighlight> | ||
=== Force Page Table Isolation === | === Force Page Table Isolation === | ||
<syntaxhighlight lang="nix"> | <syntaxhighlight lang="nix"> | ||
security.forcePageTableIsolation = true; | security.forcePageTableIsolation = true; | ||
| Line 202: | Line 222: | ||
== Nix settings == | |||
=== Nix allowed users === | |||
This option allows only <code>users</code> group to connect to the Nix daemon. | |||
<syntaxhighlight lang="nix"> | |||
nix.settings.allowed-users = [ "@users" ]; | |||
</syntaxhighlight> | |||
== Other settings == | |||
=== Memory allocator === | === Memory allocator === | ||
You can use security-focused memory allocator like [https://llvm.org/docs/ScudoHardenedAllocator.html scudo] or [https://github.com/GrapheneOS/hardened_malloc GrapheneOS hardened_malloc].<syntaxhighlight lang="nix"> | |||
You can use security-focused memory allocator like [https://llvm.org/docs/ScudoHardenedAllocator.html scudo] or [https://github.com/GrapheneOS/hardened_malloc GrapheneOS hardened_malloc]. | |||
<syntaxhighlight lang="nix"> | |||
# scudo | # scudo | ||
environment.memoryAllocator.provider = "scudo"; | environment.memoryAllocator.provider = "scudo"; | ||
environment.variables.SCUDO_OPTIONS = "zero_contents=true"; | environment.variables.SCUDO_OPTIONS = "zero_contents=true"; | ||
# hardened_malloc | # hardened_malloc | ||
environment.memoryAllocator.provider = "graphene-hardened"; | environment.memoryAllocator.provider = "graphene-hardened"; | ||
</syntaxhighlight>Some programs may not work with these memory allocators. You can force them to use the default libc allocator by blacklisting <code>/etc/ld-nix.so.preload</code> with a firejail wrap.<syntaxhighlight lang="nix">programs.firejail = { | </syntaxhighlight> | ||
Some programs may not work with these memory allocators. You can force them to use the default libc allocator by blacklisting <code>/etc/ld-nix.so.preload</code> with a firejail wrap. | |||
<syntaxhighlight lang="nix"> | |||
programs.firejail = { | |||
enable = true; | enable = true; | ||
wrappedBinaries = { | wrappedBinaries = { | ||
| Line 221: | Line 261: | ||
}; | }; | ||
}; | }; | ||
};</syntaxhighlight> | }; | ||
</syntaxhighlight> | |||
== | === Flush L1 data cache === | ||
Might cause significant performance cost. | |||
<syntaxhighlight lang="nix"> | |||
security.virtualisation.flushL1DataCache = "always"; | security.virtualisation.flushL1DataCache = "always"; | ||
</syntaxhighlight> | </syntaxhighlight> | ||
| Line 248: | Line 283: | ||
=== Secure Boot === | === Secure Boot === | ||
See [[Secure Boot]]. [[Limine]] bootloader supports coreboot's Secure Boot. | See [[Secure Boot]]. [[Limine]] bootloader supports coreboot's Secure Boot. | ||
[[Category:Guide]] | [[Category:Guide]] | ||
[[Category:NixOS]] | [[Category:NixOS]] | ||
[[Category:Security]] | [[Category:Security]] | ||