1{den, ...}: {
 2  den.aspects.core.security.includes = [den.aspects.core.security.kernel];
 3  den.aspects.core.security.kernel = {
 4    nixos = {lib, ...}: {
 5      boot.kernel.sysctl = {
 6        "dev.tty.legacy_tiocsti" = lib.mkDefault "0";
 7        "fs.protected_hardlinks" = lib.mkDefault "1";
 8        "fs.protected_symlinks" = lib.mkDefault "1";
 9        "kernel.core_uses_pid" = lib.mkDefault "1";
10        "kernel.dmesg_restrict" = lib.mkDefault "1";
11        "kernel.io_uring_disabled" = lib.mkDefault "1";
12        "kernel.kexec_load_disabled" = lib.mkDefault "1";
13        "kernel.perf_event_paranoid" = lib.mkDefault "2";
14        "kernel.randomize_va_space" = lib.mkDefault "2";
15        "vm.mmap_min_addr" = lib.mkDefault "65536";
16        "vm.unprivileged_userfaultfd" = lib.mkDefault "0";
17      };
18
19      boot.kernelParams = [
20        "mitigations=auto"
21        "pti=on"
22        "slab_nomerge"
23        "init_on_alloc=1"
24        "page_alloc.shuffle=1"
25        "randomize_kstack_offset=on"
26        "hardened_usercopy=1"
27        "debugfs=off"
28        "efi_pstore.pstore_disable=1"
29        "erst_disable"
30        "kfence.sample_interval=100"
31        "bdev_allow_write_mounted=0"
32        "proc_mem.force_override=ptrace"
33      ];
34    };
35  };
36}