diff options
author | Alyssa Ross <hi@alyssa.is> | 2022-05-31 09:59:33 +0000 |
---|---|---|
committer | Alyssa Ross <hi@alyssa.is> | 2022-05-31 09:59:57 +0000 |
commit | 9ff36293d1e428cd7bf03e8d4b03611b6d361c28 (patch) | |
tree | 1ab51a42b868c55b83f6ccdb80371b9888739dd9 /nixos/modules/services/security/haveged.nix | |
parent | 1c4fcd0d4b0541e674ee56ace1053e23e562cc80 (diff) | |
parent | ddc3c396a51918043bb0faa6f676abd9562be62c (diff) | |
download | nixpkgs-archive.tar nixpkgs-archive.tar.gz nixpkgs-archive.tar.bz2 nixpkgs-archive.tar.lz nixpkgs-archive.tar.xz nixpkgs-archive.tar.zst nixpkgs-archive.zip |
Last good Nixpkgs for Weston+nouveau? archive
I came this commit hash to terwiz[m] on IRC, who is trying to figure out what the last version of Spectrum that worked on their NUC with Nvidia graphics is.
Diffstat (limited to 'nixos/modules/services/security/haveged.nix')
-rw-r--r-- | nixos/modules/services/security/haveged.nix | 77 |
1 files changed, 77 insertions, 0 deletions
diff --git a/nixos/modules/services/security/haveged.nix b/nixos/modules/services/security/haveged.nix new file mode 100644 index 00000000000..57cef7e44d5 --- /dev/null +++ b/nixos/modules/services/security/haveged.nix @@ -0,0 +1,77 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.haveged; + +in + +{ + + ###### interface + + options = { + + services.haveged = { + + enable = mkEnableOption '' + haveged entropy daemon, which refills /dev/random when low. + NOTE: does nothing on kernels newer than 5.6. + ''; + # source for the note https://github.com/jirka-h/haveged/issues/57 + + refill_threshold = mkOption { + type = types.int; + default = 1024; + description = '' + The number of bits of available entropy beneath which + haveged should refill the entropy pool. + ''; + }; + + }; + + }; + + config = mkIf cfg.enable { + + # https://github.com/jirka-h/haveged/blob/a4b69d65a8dfc5a9f52ff8505c7f58dcf8b9234f/contrib/Fedora/haveged.service + systemd.services.haveged = { + description = "Entropy Daemon based on the HAVEGE algorithm"; + unitConfig = { + Documentation = "man:haveged(8)"; + DefaultDependencies = false; + ConditionKernelVersion = "<5.6"; + }; + wantedBy = [ "sysinit.target" ]; + after = [ "systemd-tmpfiles-setup-dev.service" ]; + before = [ "sysinit.target" "shutdown.target" "systemd-journald.service" ]; + + serviceConfig = { + ExecStart = "${pkgs.haveged}/bin/haveged -w ${toString cfg.refill_threshold} --Foreground -v 1"; + Restart = "always"; + SuccessExitStatus = "137 143"; + SecureBits = "noroot-locked"; + CapabilityBoundingSet = [ "CAP_SYS_ADMIN" "CAP_SYS_CHROOT" ]; + # We can *not* set PrivateTmp=true as it can cause an ordering cycle. + PrivateTmp = false; + PrivateDevices = true; + ProtectSystem = "full"; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + RestrictNamespaces = true; + RestrictRealtime = true; + LockPersonality = true; + MemoryDenyWriteExecute = true; + SystemCallArchitectures = "native"; + SystemCallFilter = [ "@system-service" "newuname" "~@mount" ]; + SystemCallErrorNumber = "EPERM"; + }; + + }; + }; + +} |