diff options
Diffstat (limited to 'nixos/doc/manual/from_md/configuration/profiles/hardened.section.xml')
-rw-r--r-- | nixos/doc/manual/from_md/configuration/profiles/hardened.section.xml | 25 |
1 files changed, 25 insertions, 0 deletions
diff --git a/nixos/doc/manual/from_md/configuration/profiles/hardened.section.xml b/nixos/doc/manual/from_md/configuration/profiles/hardened.section.xml new file mode 100644 index 00000000000..44c11786d94 --- /dev/null +++ b/nixos/doc/manual/from_md/configuration/profiles/hardened.section.xml @@ -0,0 +1,25 @@ +<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-profile-hardened"> + <title>Hardened</title> + <para> + A profile with most (vanilla) hardening options enabled by default, + potentially at the cost of stability, features and performance. + </para> + <para> + This includes a hardened kernel, and limiting the system information + available to processes through the <literal>/sys</literal> and + <literal>/proc</literal> filesystems. It also disables the User + Namespaces feature of the kernel, which stops Nix from being able to + build anything (this particular setting can be overriden via + <xref linkend="opt-security.allowUserNamespaces" />). See the + <link xlink:href="https://github.com/nixos/nixpkgs/tree/master/nixos/modules/profiles/hardened.nix">profile + source</link> for further detail on which settings are altered. + </para> + <warning> + <para> + This profile enables options that are known to affect system + stability. If you experience any stability issues when using the + profile, try disabling it. If you report an issue and use this + profile, always mention that you do. + </para> + </warning> +</section> |