1{den, ...}: {
 2  den.aspects.core.includes = [den.aspects.core.harden];
 3  den.aspects.core.harden = {
 4    nixos = {pkgs, ...}: {
 5      security.apparmor = {
 6        enable = true;
 7        killUnconfinedConfinables = true;
 8        packages = with pkgs; [
 9          apparmor-utils
10          apparmor-profiles
11        ];
12      };
13
14      # Copy from https://wiki.nixos.org/wiki/NixOS_Hardening#Module_blacklist
15      boot.blacklistedKernelModules = [
16        # Obscure network protocols
17        "ax25"
18        "netrom"
19        "rose"
20
21        # Old or rare or insufficiently audited filesystems
22        "adfs"
23        "affs"
24        "bfs"
25        "befs"
26        "cramfs"
27        "efs"
28        "erofs"
29        "exofs"
30        "freevxfs"
31        "f2fs"
32        "hfs"
33        "hpfs"
34        "jfs"
35        "minix"
36        "nilfs2"
37        "ntfs"
38        "omfs"
39        "qnx4"
40        "qnx6"
41        "sysv"
42        "ufs"
43      ];
44    };
45  };
46}