movefasta/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-06-09 19:13:26 +03:00
Code Issues Projects Releases Packages Wiki Activity

nixos/security: add landlock, yama, and bpf defaults

Browse source
This commit is contained in:
Tristan Ross 2025-05-16 15:31:50 -07:00
parent 558478154c
commit 22f2e258af
No known key found for this signature in database
GPG key ID: B09C422035669AF8
1 changed files with 22 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

34
nixos/modules/security/default.nix
View file

@ -5,7 +5,7 @@ in
{
options = {
security.lsm = lib.mkOption {
type = lib.types.uniq (lib.types.listOf lib.types.str);
type = lib.types.listOf lib.types.str;
default = [ ];
description = ''
A list of the LSMs to initialize in order.
@ -13,16 +13,26 @@ in
};
};
config = lib.mkIf (lib.lists.length cfg.lsm > 0) {
assertions = [
{
assertion = builtins.length (lib.filter (lib.hasPrefix "security=") config.boot.kernelParams) == 0;
message = "security parameter in boot.kernelParams cannot be used when security.lsm is used";
}
];
config = lib.mkMerge [
{
# We set the default LSM's here due to them not being present if set when enabling AppArmor.
security.lsm = [
"landlock"
"yama"
"bpf"
];
}
(lib.mkIf (lib.lists.length cfg.lsm > 0) {
assertions = [
{
assertion = builtins.length (lib.filter (lib.hasPrefix "security=") config.boot.kernelParams) == 0;
message = "security parameter in boot.kernelParams cannot be used when security.lsm is used";
}
];
boot.kernelParams = [
"lsm=${lib.concatStringsSep "," cfg.lsm}"
];
};
boot.kernelParams = [
"lsm=${lib.concatStringsSep "," cfg.lsm}"
];
})
];
}