security: no longer depend upon upstream's hardening

diff --git a/machines/losurdo.nix b/machines/losurdo.nix
index 742177cf13d9edcb4a618abe9dfbd065c430329b..7482c1370e3da235aa4d4b5e12fe3d518375d2d9 100644 (file)
--- a/machines/losurdo.nix
+++ b/machines/losurdo.nix
@@ -19,7 +19,6 @@ extraArgs = {
   };
 };
 modules = [
-  (inputs.nixpkgs + "/nixos/modules/profiles/hardened.nix")
   ../nixos/defaults.nix
   losurdo/acme.nix
   losurdo/debug.nix

diff --git a/machines/losurdo/security.nix b/machines/losurdo/security.nix
index 38f4aea5790253ea1cfc34da2ac8fe23706efbde..b5d0eb4e00a190249c49f17d93e38ec3117c4c51 100644 (file)
--- a/machines/losurdo/security.nix
+++ b/machines/losurdo/security.nix
@@ -1,21 +1,7 @@
-{ inputs, pkgs, lib, config, machineName, ... }:
+{ inputs, pkgs, lib, config, ... }:
 {
-environment.memoryAllocator.provider = "libc";
 services.openssh.extraConfig = ''
   # This is for removing remote gpg-agent's socket
   StreamLocalBindUnlink yes
 '';
-/*
-installer.ssh-nixos = {
-  PATH = [pkgs.gnupg pkgs.openssh];
-  sshFlags = [
-    #"-R" "/var/lib/gnupg/S.gpg-agent.extra:/run/user/1000/gnupg/d.w1sj57hx3zfcwadyxpr6wko9/S.gpg-agent.extra"
-    #"-o" "StreamLocalBindUnlink=yes"
-  ];
-};
-security.wrappers = lib.mkForce {
-  ping.source = pkgs.inetutils + "/bin/ping";
-  ping.capabilities = "cap_net_raw+p";
-};
-*/
 }

diff --git a/machines/mermet.nix b/machines/mermet.nix
index b914e903092cc748c99025536760873ad87611f4..a7e4f9175e9bb0d1ac82060148fe0f42eda0c653 100644 (file)
--- a/machines/mermet.nix
+++ b/machines/mermet.nix
@@ -20,7 +20,6 @@ extraArgs = rec {
   };
 };
 modules = [
-  (inputs.nixpkgs + "/nixos/modules/profiles/hardened.nix")
   ../nixos/defaults.nix
   mermet/acme.nix
   mermet/croc.nix

diff --git a/machines/mermet/security.nix b/machines/mermet/security.nix
index 6ecd993b24271dcbd9a56eb4c96b9a19823555ec..b5d0eb4e00a190249c49f17d93e38ec3117c4c51 100644 (file)
--- a/machines/mermet/security.nix
+++ b/machines/mermet/security.nix
@@ -1,6 +1,5 @@
 { inputs, pkgs, lib, config, ... }:
 {
-environment.memoryAllocator.provider = "libc";
 services.openssh.extraConfig = ''
   # This is for removing remote gpg-agent's socket
   StreamLocalBindUnlink yes

diff --git a/nixos/defaults.nix b/nixos/defaults.nix
index c06e33579feeddd90feaa5807311980b2cf64a79..aca88a54eb5f4554b2dc23ddb2c8d0a84d3bcbdc 100644 (file)
--- a/nixos/defaults.nix
+++ b/nixos/defaults.nix
@@ -5,6 +5,7 @@ in
 {
 imports = [
   ./modules.nix
+  defaults/security.nix
   defaults/predictable-interface-names.nix
 ];
 nix = {

diff --git a/nixos/defaults/security.nix b/nixos/defaults/security.nix
new file mode 100644 (file)
index 0000000..e9e757c
--- /dev/null
+++ b/nixos/defaults/security.nix
@@ -0,0 +1,128 @@
+{ inputs, pkgs, lib, config, ... }:
+{
+boot.kernelPackages = pkgs.linuxPackages_hardened;
+#environment.memoryAllocator.provider = "libc";
+nix.allowedUsers = [ "@users" ];
+security.allowSimultaneousMultithreading = false;
+security.apparmor.enable = true;
+security.forcePageTableIsolation = true;
+security.hideProcessInformation = true;
+security.lockKernelModules = true;
+security.protectKernelImage = true;
+security.virtualisation.flushL1DataCache = "always";
+boot.blacklistedKernelModules = [
+  # Obscure network protocols
+  "ax25"
+  "netrom"
+  "rose"
+
+  # Old or rare or insufficiently audited filesystems
+  "adfs"
+  "affs"
+  "bfs"
+  "befs"
+  "cramfs"
+  "efs"
+  "erofs"
+  "exofs"
+  "freevxfs"
+  "f2fs"
+  "hfs"
+  "hpfs"
+  "jfs"
+  "minix"
+  "nilfs2"
+  "ntfs"
+  "omfs"
+  "qnx4"
+  "qnx6"
+  "sysv"
+  "ufs"
+];
+boot.kernel.sysctl = {
+  # Mitigate kernel pointer leaks
+  kernel.kptr_restrict = 2;
+  # Restricts the kernel log to the CAP_SYSLOG capability
+  kernel.dmesg_restrict = 1;
+  # Prevent information leaks
+  #kernel.printk = "3 3 3 3";
+  # Restrict eBPF to the CAP_BPF capability
+  # and enable JIT hardening techniques
+  # such as constant blinding.
+  kernel.unprivileged_bpf_disabled = 1;
+  net.core.bpf_jit_harden = 2;
+  # Restricts loading TTY line disciplines
+  # to the CAP_SYS_MODULE capability to prevent
+  # unprivileged attackers from loading vulnerable
+  # line disciplines with the TIOCSETD ioctl
+  dev.tty.ldisc_autoload = 0;
+  # The userfaultfd() syscall is often abused to exploit
+  # use-after-free flaws.
+  # Due to this, this sysctl is used to restrict
+  # this syscall to the CAP_SYS_PTRACE capability.
+  vm.unprivileged_userfaultfd = 0;
+  # kexec is a system call that is used
+  # to boot another kernel during runtime.
+  kernel.kexec_load_disabled = 1;
+  # User namespaces are a feature in the kernel which aim to
+  # improve sandboxing and make it easily accessible for
+  # unprivileged users however, this feature exposes
+  # significant kernel attack surface for privilege
+  # escalation so this sysctl restricts the usage of user
+  # namespaces to the CAP_SYS_ADMIN capability.
+  kernel.unprivileged_userns_clone = 0;
+  # Restricts all usage of performance events to the
+  # CAP_PERFMON capability
+  kernel.perf_event_paranoid = 3;
+  # Helps protect against SYN flood attacks
+  net.ipv4.tcp_syncookies = 1;
+  # Protects against time-wait assassination
+  # by dropping RST packets for sockets
+  # in the time-wait state.
+  net.ipv4.tcp_rfc1337 = 1;
+  # Disable ICMP redirect acceptance and sending to prevent
+  # man-in-the-middle attacks and minimize information disclosure.
+  net.ipv4.conf.all.accept_redirects = 0;
+  net.ipv4.conf.default.accept_redirects = 0;
+  net.ipv4.conf.all.secure_redirects = 0;
+  net.ipv4.conf.default.secure_redirects = 0;
+  net.ipv6.conf.all.accept_redirects = 0;
+  net.ipv6.conf.default.accept_redirects = 0;
+  net.ipv4.conf.all.send_redirects = 0;
+  net.ipv4.conf.default.send_redirects = 0;
+  # Disable source routing, a mechanism
+  # that allows users to redirect network traffic.
+  net.ipv4.conf.all.accept_source_route = 0;
+  net.ipv4.conf.default.accept_source_route = 0;
+  net.ipv6.conf.all.accept_source_route = 0;
+  net.ipv6.conf.default.accept_source_route = 0;
+  # Disable TCP SACK, which is commonly exploited
+  # and unnecessary for many circumstances.
+  # https://serverfault.com/questions/10955/when-to-turn-tcp-sack-off
+  net.ipv4.tcp_sack = 0;
+  net.ipv4.tcp_dsack = 0;
+  net.ipv4.tcp_fack = 0;
+  # generate a random IPv6 address
+  net.ipv6.conf.all.use_tempaddr = 2;
+  net.ipv6.conf.default.use_tempaddr = 2;
+  # restricts usage of ptrace to only processes
+  # with the CAP_SYS_PTRACE capability
+  kernel.yama.ptrace_scope = 2;
+};
+boot.kernelParams = [
+  "slab_nomerge"
+  "slub_debug=FZ"
+  #"init_on_alloc=1"
+  #"init_on_free=1"
+  "page_alloc.shuffle=1"
+  "pti=on"
+  "vsyscall=none"
+  "debugfs=off"
+  "oops=panic"
+  "module.sig_enforce=1"
+  "lockdown=confidentiality"
+  "mce=0"
+  #"quiet"
+  #"loglevel=0"
+];
+}