add grymforge

2024-02-01 00:03:16 -05:00 · 2024-02-01 00:03:16 -05:00 · 980f180b88
commit 980f180b88
parent c5d2fbe031
9 changed files with 423 additions and 1 deletions
--- a/hosts/grymforge/kernel.nix
+++ b/hosts/grymforge/kernel.nix
@ -0,0 +1,26 @@
+{
+  config,
+  pkgs,
+  stdenv,
+  ...
+}: {
+  boot.kernelPackages = pkgs.linuxPackages_hardened;
+  boot.kernelParams = [
+    # Disable slab merging to prevent heap exploitation
+    "slab_nomerge"
+    # Enable zeroing memory during allocation and free time
+    "init_on_alloc=1"
+    "init_on_free=1"
+    # Randomize page allocator freelists
+    "page_alloc.shuffle=1"
+    # Mitigations
+    "pti=on"
+
+    "vsyscall=none"
+    "debugfs=off"
+    "oops=panic"
+
+    # Enable lockdown LSM
+    "lockdown=confidentiality"
+  ];
+}