Commit 2a2abfb

@@ -0,0 +1,14 @@
+{
+  den.aspects.core.harden.apparmor = {
+    nixos = {pkgs, ...}: {
+      security.apparmor = {
+        enable = true;
+        killUnconfinedConfinables = true;
+        packages = with pkgs; [
+          apparmor-utils
+          apparmor-profiles
+        ];
+      };
+    };
+  };
+}

@@ -0,0 +1,36 @@
+{
+  den.aspects.core.harden.misc = {
+    nixos = {
+      # Copy from https://wiki.nixos.org/wiki/NixOS_Hardening#Module_blacklist
+      boot.blacklistedKernelModules = [
+        # Obscure network protocols
+        "ax25"
+        "netrom"
+        "rose"
+
+        # Old or rare or insufficiently audited filesystems
+        "adfs"
+        "affs"
+        "bfs"
+        "befs"
+        "cramfs"
+        "efs"
+        "erofs"
+        "exofs"
+        "freevxfs"
+        "f2fs"
+        "hfs"
+        "hpfs"
+        "jfs"
+        "minix"
+        "nilfs2"
+        "ntfs"
+        "omfs"
+        "qnx4"
+        "qnx6"
+        "sysv"
+        "ufs"
+      ];
+    };
+  };
+}

@@ -9,6 +9,9 @@
       core.nix.substituters
       core.nix.tokens
 
+      core.harden.apparmor
+      core.harden.misc
+
       core.hardware.cpu.intel
       core.hardware.graphic.intel
       core.hardware.graphic.nvidia