Commit ec3c82d

HPCesia <me@hpcesia.com>
2026-10-19 13:27:23
security: init system harden
Mainly ported from https://github.com/cynicsketch/nix-mineral Assisted-by: crush:deepseek-v4.1-flash
main
1 parent 14d1c9a
Changed files (7)
modules
core
security
audit.nix
auth.nix
default.nix
kernel.nix
network.nix
storage.nix
README.md
modules/core/security/audit.nix
@@ -0,0 +1,62 @@
+{den, ...}: {
+  den.aspects.core.security.includes = [den.aspects.core.security.audit];
+  den.aspects.core.security.audit = {
+    nixos = {
+      security.auditd.enable = true;
+
+      security.audit = {
+        enable = true;
+        rules = [
+          "-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change"
+          "-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change"
+          "-a always,exit -F arch=b64 -S clock_settime -k time-change"
+          "-a always,exit -F arch=b32 -S clock_settime -k time-change"
+          "-w /etc/localtime -p wa -k time-change"
+
+          "-w /etc/group -p wa -k identity"
+          "-w /etc/passwd -p wa -k identity"
+
+          "-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale"
+          "-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale"
+          "-w /etc/issue -p wa -k system-locale"
+          "-w /etc/issue.net -p wa -k system-locale"
+          "-w /etc/hosts -p wa -k system-locale"
+          "-w /etc/hostname -p wa -k system-locale"
+
+          "-w /etc/apparmor/ -p wa -k MAC-policy"
+          "-w /etc/apparmor.d/ -p wa -k MAC-policy"
+
+          "-w /var/log/wtmp -p wa -k logins"
+          "-w /var/log/btmp -p wa -k logins"
+
+          "-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod"
+          "-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod"
+          "-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod"
+          "-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod"
+          "-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod"
+          "-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod"
+
+          "-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access"
+          "-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access"
+          "-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access"
+          "-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access"
+
+          "-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts"
+          "-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts"
+
+          "-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete"
+          "-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete"
+
+          "-w /etc/sudoers -p wa -k scope"
+          "-w /etc/sudoers.d/ -p wa -k scope"
+
+          "-a always,exit -F arch=b64 -S execve -F uid=0 -F auid>=1000 -F auid!=4294967295 -k actions"
+          "-a always,exit -F arch=b32 -S execve -F uid=0 -F auid>=1000 -F auid!=4294967295 -k actions"
+
+          "-a always,exit -F arch=b64 -S init_module -S delete_module -k modules"
+          "-a always,exit -F arch=b32 -S init_module -S delete_module -k modules"
+        ];
+      };
+    };
+  };
+}
modules/core/sudo.nix → modules/core/security/auth.nix
@@ -1,6 +1,6 @@
 {den, ...}: {
-  den.aspects.core.includes = [den.aspects.core.sudo];
-  den.aspects.core.sudo = {
+  den.aspects.core.security.includes = [den.aspects.core.security.auth];
+  den.aspects.core.security.auth = {
     nixos = {
       security.sudo = {
         enable = true;
@@ -20,6 +20,8 @@
           }
         ];
       };
+
+      security.pam.services.su.requireWheel = true;
     };
   };
 }
modules/core/harden.nix → modules/core/security/default.nix
@@ -1,6 +1,6 @@
 {den, ...}: {
-  den.aspects.core.includes = [den.aspects.core.harden];
-  den.aspects.core.harden = {
+  den.aspects.core.includes = [den.aspects.core.security];
+  den.aspects.core.security = {
     nixos = {pkgs, ...}: {
       security.apparmor = {
         enable = true;
modules/core/security/kernel.nix
@@ -0,0 +1,36 @@
+{den, ...}: {
+  den.aspects.core.security.includes = [den.aspects.core.security.kernel];
+  den.aspects.core.security.kernel = {
+    nixos = {lib, ...}: {
+      boot.kernel.sysctl = {
+        "dev.tty.legacy_tiocsti" = lib.mkDefault "0";
+        "fs.protected_hardlinks" = lib.mkDefault "1";
+        "fs.protected_symlinks" = lib.mkDefault "1";
+        "kernel.core_uses_pid" = lib.mkDefault "1";
+        "kernel.dmesg_restrict" = lib.mkDefault "1";
+        "kernel.io_uring_disabled" = lib.mkDefault "1";
+        "kernel.kexec_load_disabled" = lib.mkDefault "1";
+        "kernel.perf_event_paranoid" = lib.mkDefault "2";
+        "kernel.randomize_va_space" = lib.mkDefault "2";
+        "vm.mmap_min_addr" = lib.mkDefault "65536";
+        "vm.unprivileged_userfaultfd" = lib.mkDefault "0";
+      };
+
+      boot.kernelParams = [
+        "mitigations=auto"
+        "pti=on"
+        "slab_nomerge"
+        "init_on_alloc=1"
+        "page_alloc.shuffle=1"
+        "randomize_kstack_offset=on"
+        "hardened_usercopy=1"
+        "debugfs=off"
+        "efi_pstore.pstore_disable=1"
+        "erst_disable"
+        "kfence.sample_interval=100"
+        "bdev_allow_write_mounted=0"
+        "proc_mem.force_override=ptrace"
+      ];
+    };
+  };
+}
modules/core/security/network.nix
@@ -0,0 +1,25 @@
+{den, ...}: {
+  den.aspects.core.security.includes = [den.aspects.core.security.network];
+  den.aspects.core.security.network = {
+    nixos = {lib, ...}: {
+      boot.kernel.sysctl = {
+        "net.ipv4.conf.all.accept_source_route" = lib.mkDefault "0";
+        "net.ipv4.conf.all.arp_announce" = lib.mkDefault "2";
+        "net.ipv4.conf.all.arp_ignore" = lib.mkDefault "2";
+        "net.ipv4.conf.all.drop_gratuitous_arp" = lib.mkDefault "1";
+        "net.ipv4.conf.all.log_martians" = lib.mkDefault "1";
+        "net.ipv4.conf.all.shared_media" = lib.mkDefault "0";
+        "net.ipv4.conf.default.accept_source_route" = lib.mkDefault "0";
+        "net.ipv4.conf.default.arp_announce" = lib.mkDefault "2";
+        "net.ipv4.conf.default.arp_ignore" = lib.mkDefault "2";
+        "net.ipv4.conf.default.drop_gratuitous_arp" = lib.mkDefault "1";
+        "net.ipv4.conf.default.log_martians" = lib.mkDefault "1";
+        "net.ipv4.conf.default.shared_media" = lib.mkDefault "0";
+        "net.ipv4.tcp_rfc1337" = lib.mkDefault "1";
+        "net.ipv4.tcp_syncookies" = lib.mkDefault "1";
+        "net.ipv6.conf.all.accept_source_route" = lib.mkDefault "0";
+        "net.ipv6.conf.default.accept_source_route" = lib.mkDefault "0";
+      };
+    };
+  };
+}
modules/core/security/storage.nix
@@ -0,0 +1,11 @@
+{den, ...}: {
+  den.aspects.core.security.includes = [den.aspects.core.security.storage];
+  den.aspects.core.security.storage = {
+    nixos = {
+      environment.etc."udisks2/mount_options.conf".text = ''
+        [defaults]
+        defaults=nodev,nosuid,noexec
+      '';
+    };
+  };
+}
README.md
@@ -47,6 +47,7 @@ Copyright (c) 2026 HPCesia.
 ## Credits
 
 - [chlorine/shosai](https://src.chlo.is/chlorine/shosai)
+- [cynicsketch/nix-mineral](https://github.com/cynicsketch/nix-mineral)
 - [drupol/infra](https://github.com/drupol/infra)
 - [hlissner/dotfiles](https://github.com/hlissner/dotfiles)
 - [MidAutumnMoon/TaysiTsuki](https://github.com/MidAutumnMoon/TaysiTsuki)