movefasta/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-06-12 04:35:41 +03:00
Code Issues Projects Releases Packages Wiki Activity

nixos/security: add landlock, yama, and bpf defaults

Browse source
This commit is contained in:
Tristan Ross 2025-05-16 15:31:50 -07:00
parent 558478154c
commit 22f2e258af
No known key found for this signature in database
GPG key ID: B09C422035669AF8
1 changed files with 22 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nixos/modules/security/default.nix
View file

@ -5,7 +5,7 @@ in
{ {
options = { options = {
security.lsm = lib.mkOption { security.lsm = lib.mkOption {
type = lib.types.uniq (lib.types.listOf lib.types.str); type = lib.types.listOf lib.types.str;
default = [ ]; default = [ ];
description = '' description = ''
A list of the LSMs to initialize in order. A list of the LSMs to initialize in order.
@ -13,7 +13,16 @@ in
}; };
}; };
config = lib.mkIf (lib.lists.length cfg.lsm > 0) { config = lib.mkMerge [
{
# We set the default LSM's here due to them not being present if set when enabling AppArmor.
security.lsm = [
"landlock"
"yama"
"bpf"
];
}
(lib.mkIf (lib.lists.length cfg.lsm > 0) {
assertions = [ assertions = [
{ {
assertion = builtins.length (lib.filter (lib.hasPrefix "security=") config.boot.kernelParams) == 0; assertion = builtins.length (lib.filter (lib.hasPrefix "security=") config.boot.kernelParams) == 0;
@ -24,5 +33,6 @@ in
boot.kernelParams = [ boot.kernelParams = [
"lsm=${lib.concatStringsSep "," cfg.lsm}" "lsm=${lib.concatStringsSep "," cfg.lsm}"
]; ];
}; })
];
} }