diff options
Diffstat (limited to 'nixos/modules/security/lock-kernel-modules.nix')
-rw-r--r-- | nixos/modules/security/lock-kernel-modules.nix | 36 |
1 files changed, 36 insertions, 0 deletions
diff --git a/nixos/modules/security/lock-kernel-modules.nix b/nixos/modules/security/lock-kernel-modules.nix new file mode 100644 index 00000000000..51994ee76c1 --- /dev/null +++ b/nixos/modules/security/lock-kernel-modules.nix @@ -0,0 +1,36 @@ +{ config, lib, ... }: + +with lib; + +{ + options = { + security.lockKernelModules = mkOption { + type = types.bool; + default = false; + description = '' + Disable kernel module loading once the system is fully initialised. + Module loading is disabled until the next reboot. Problems caused + by delayed module loading can be fixed by adding the module(s) in + question to <option>boot.kernelModules</option>. + ''; + }; + }; + + config = mkIf config.security.lockKernelModules { + systemd.services.disable-kernel-module-loading = rec { + description = "Disable kernel module loading"; + + wantedBy = [ config.systemd.defaultUnit ]; + after = [ "systemd-udev-settle.service" "firewall.service" "systemd-modules-load.service" ] ++ wantedBy; + + script = "echo -n 1 > /proc/sys/kernel/modules_disabled"; + + unitConfig.ConditionPathIsWritable = "/proc/sys/kernel"; + + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + }; + }; + }; +} |