diff options
| author | Emily <vcs@emily.moe> | 2020-04-04 23:13:27 +0100 |
|---|---|---|
| committer | Emily <vcs@emily.moe> | 2020-04-17 16:13:39 +0100 |
| commit | ad9bfe2254e6205f94baa9c988063b0737911a23 (patch) | |
| tree | 745d6b5a45d031cc15fc8d562784ee5e26920f4a /nixos/modules/profiles | |
| parent | 84f258bf096275fffbc95328e33ed981a677db68 (diff) | |
| download | nixpkgs-ad9bfe2254e6205f94baa9c988063b0737911a23.tar nixpkgs-ad9bfe2254e6205f94baa9c988063b0737911a23.tar.gz nixpkgs-ad9bfe2254e6205f94baa9c988063b0737911a23.tar.bz2 nixpkgs-ad9bfe2254e6205f94baa9c988063b0737911a23.tar.lz nixpkgs-ad9bfe2254e6205f94baa9c988063b0737911a23.tar.xz nixpkgs-ad9bfe2254e6205f94baa9c988063b0737911a23.tar.zst nixpkgs-ad9bfe2254e6205f94baa9c988063b0737911a23.zip | |
nixos/hardened: enable user namespaces for root
linux-hardened sets kernel.unprivileged_userns_clone=0 by default; see
anthraxx/linux-hardened@104f44058f058a395502192c4939645df6f52ecb.
This allows the Nix sandbox to function while reducing the attack
surface posed by user namespaces, which allow unprivileged code to
exercise lots of root-only code paths and have lead to privilege
escalation vulnerabilities in the past.
We can safely leave user namespaces on for privileged users, as root
already has root privileges, but if you're not running builds on your
machine and really want to minimize the kernel attack surface then you
can set security.allowUserNamespaces to false.
Note that Chrome's sandbox requires either unprivileged CLONE_NEWUSER or
setuid, and Firefox's silently reduces the security level if it isn't
allowed (see about:support), so desktop users may want to set:
boot.kernel.sysctl."kernel.unprivileged_userns_clone" = true;
Diffstat (limited to 'nixos/modules/profiles')
| -rw-r--r-- | nixos/modules/profiles/hardened.nix | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/nixos/modules/profiles/hardened.nix b/nixos/modules/profiles/hardened.nix index 09a1dd54333..c771a4ed328 100644 --- a/nixos/modules/profiles/hardened.nix +++ b/nixos/modules/profiles/hardened.nix @@ -21,8 +21,6 @@ with lib; security.lockKernelModules = mkDefault true; - security.allowUserNamespaces = mkDefault false; - security.protectKernelImage = mkDefault true; security.allowSimultaneousMultithreading = mkDefault false; |