From e21e5a94839383e542f2e4b5629e9087658e0984 Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Sun, 23 Aug 2020 13:17:53 +0300
Subject: nixos/security/misc: add option unprivilegedUsernsClone

---
 nixos/modules/security/misc.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

(limited to 'nixos/modules/security/misc.nix')

diff --git a/nixos/modules/security/misc.nix b/nixos/modules/security/misc.nix
index 16e3bfb1419..d51dbbb77f7 100644
--- a/nixos/modules/security/misc.nix
+++ b/nixos/modules/security/misc.nix
@@ -27,6 +27,16 @@ with lib;
       '';
     };
 
+    security.unprivilegedUsernsClone = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        When disabled, unprivileged users will not be able to create new namespaces.
+        By default unprivileged user namespaces are disabled.
+        This option only works in a hardened profile.
+      '';
+    };
+
     security.protectKernelImage = mkOption {
       type = types.bool;
       default = false;
@@ -115,6 +125,10 @@ with lib;
       ];
     })
 
+    (mkIf config.security.unprivilegedUsernsClone {
+      boot.kernel.sysctl."kernel.unprivileged_userns_clone" = mkDefault true;
+    })
+
     (mkIf config.security.protectKernelImage {
       # Disable hibernation (allows replacing the running kernel)
       boot.kernelParams = [ "nohibernate" ];
-- 
cgit 1.4.1