plumjam/nixos - Change WKMSFF6S6DFDOLSY4CJAQH3XI6C6J7O2DFLASRUIZILA2XMGPEDAC

dendritic: Add Linux kernel config.

Created by PlumJam on January 10, 2026

WKMSFF6S6DFDOLSY4CJAQH3XI6C6J7O2DFLASRUIZILA2XMGPEDAC

Dependencies

In channels

main

Change contents

Replacement in modules/linux-kernel.nix at line 1 [3.74635]

B:BD[3.74635] → [3.74636:74940]

{ pkgs, config, lib, ... }:
{
  options.linux-kernel = {
    enableZen = lib.mkEnableOption "linux_zen kernel";
  };
  config =
    {
      boot.kernelPackages =
        if config.linux-kernel.enableZen then
          pkgs.linuxKernel.packages.linux_zen
        else
          pkgs.linuxPackages_latest;

[3.74635]

[3.74940]

let
  commonModule = {
    # Credits from me:
    # - https://github.com/RGBCube/ncc/blob/c5714110d951f57e66d5ee47a244c0a93f3406a1/modules/linux/kernel.nix
    # From RGBCube:
    # - https://github.com/NotAShelf/nyx/blob/main/modules/core/common/system/security/kernel.nix
    # - "hsslister" user - raf (NotAShelf) - "I actually forgot the dudes GitHub"
    boot.kernel.sysctl = {
      # The Magic SysRq key is a key combo that allows users connected to the
      # system console of a Linux kernel to perform some low-level commands.
      # Disable it, since we don't need it, and is a potential security concern.
      "kernel.sysrq" = 0;

Replacement in modules/linux-kernel.nix at line 14 [3.74635]

B:BD[3.74941] → [3.74941:75583]

      # Credits from me:
      # - https://github.com/RGBCube/ncc/blob/c5714110d951f57e66d5ee47a244c0a93f3406a1/modules/linux/kernel.nix
      # From RGBCube:
      # - https://github.com/NotAShelf/nyx/blob/main/modules/core/common/system/security/kernel.nix
      # - "hsslister" user - raf (NotAShelf) - "I actually forgot the dudes GitHub"
      boot.kernel.sysctl = {
        # The Magic SysRq key is a key combo that allows users connected to the
        # system console of a Linux kernel to perform some low-level commands.
        # Disable it, since we don't need it, and is a potential security concern.
        "kernel.sysrq" = 0;

[3.74941]

[3.75583]

      # Hide kptrs even for processes with CAP_SYSLOG.
      # Also prevents printing kernel pointers.
      "kernel.kptr_restrict" = 2;

Replacement in modules/linux-kernel.nix at line 18 [3.74635]

B:BD[3.75584] → [3.75584:75727]

        # Hide kptrs even for processes with CAP_SYSLOG.
        # Also prevents printing kernel pointers.
        "kernel.kptr_restrict" = 2;

[3.75584]

[3.75727]

      # Disable bpf() JIT (to eliminate spray attacks).
      "net.core.bpf_jit_enable" = false;

Replacement in modules/linux-kernel.nix at line 21 [3.74635]

B:BD[3.75728] → [3.75728:75829]

        # Disable bpf() JIT (to eliminate spray attacks).
        "net.core.bpf_jit_enable" = false;

[3.75728]

[3.75829]

      # Disable ftrace debugging.
      "kernel.ftrace_enabled" = false;

Replacement in modules/linux-kernel.nix at line 24 [3.74635]

B:BD[3.75830] → [3.75830:75907]

        # Disable ftrace debugging.
        "kernel.ftrace_enabled" = false;

[3.75830]

[3.75907]

      # Avoid kernel memory address exposures via dmesg (this value can also be set by CONFIG_SECURITY_DMESG_RESTRICT).
      "kernel.dmesg_restrict" = 1;

Replacement in modules/linux-kernel.nix at line 27 [3.74635]

B:BD[3.75908] → [3.75908:76067]

        # Avoid kernel memory address exposures via dmesg (this value can also be set by CONFIG_SECURITY_DMESG_RESTRICT).
        "kernel.dmesg_restrict" = 1;

[3.75908]

[3.76067]

      # Prevent unintentional fifo writes.
      "fs.protected_fifos" = 2;

Replacement in modules/linux-kernel.nix at line 30 [3.74635]

B:BD[3.76068] → [3.76068:76147]

        # Prevent unintentional fifo writes.
        "fs.protected_fifos" = 2;

[3.76068]

[3.76147]

      # Prevent unintended writes to already-created files.
      "fs.protected_regular" = 2;

Replacement in modules/linux-kernel.nix at line 33 [3.74635]

B:BD[3.76148] → [3.76148:76246]

        # Prevent unintended writes to already-created files.
        "fs.protected_regular" = 2;

[3.76148]

[3.76246]

      # Disable SUID binary dump.
      "fs.suid_dumpable" = 0;

Replacement in modules/linux-kernel.nix at line 36 [3.74635]

B:BD[3.76247] → [3.76247:76315]

        # Disable SUID binary dump.
        "fs.suid_dumpable" = 0;

[3.76247]

[3.76315]

      # Disallow profiling at all levels without CAP_SYS_ADMIN.
      "kernel.perf_event_paranoid" = 3;

Replacement in modules/linux-kernel.nix at line 39 [3.74635]

B:BD[3.76316] → [3.76316:76424]

        # Disallow profiling at all levels without CAP_SYS_ADMIN.
        "kernel.perf_event_paranoid" = 3;

[3.76316]

[3.76424]

      # Require CAP_BPF to use bpf.
      "kernel.unprvileged_bpf_disabled" = 1;
    };

Replacement in modules/linux-kernel.nix at line 43 [3.74635]

B:BD[3.76425] → [3.76425:76519]

        # Require CAP_BPF to use bpf.
        "kernel.unprvileged_bpf_disabled" = 1;
      };

[3.76425]

[3.76519]

    # https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html
    boot.kernelParams = [
      # Make stack-based attacks on the kernel harder.
      "randomize_kstack_offset=on"

Replacement in modules/linux-kernel.nix at line 48 [3.74635]

B:BD[3.76520] → [3.76520:76724]

      # https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html
      boot.kernelParams = [
        # Make stack-based attacks on the kernel harder.
        "randomize_kstack_offset=on"

[3.76520]

[3.76724]

      # Controls the behavior of vsyscalls. This has been defaulted to none back in 2016 - break really old binaries for security.
      "vsyscall=none"

Replacement in modules/linux-kernel.nix at line 51 [3.74635]

B:BD[3.76725] → [3.76725:76882]

        # Controls the behavior of vsyscalls. This has been defaulted to none back in 2016 - break really old binaries for security.
        "vsyscall=none"

[3.76725]

[3.76882]

      # Reduce most of the exposure of a heap attack to a single cache.
      "slab_nomerge"

Replacement in modules/linux-kernel.nix at line 54 [3.74635]

B:BD[3.76883] → [3.76883:76980]

        # Reduce most of the exposure of a heap attack to a single cache.
        "slab_nomerge"

[3.76883]

[3.76980]

      # Only allow signed modules.
      "module.sig_enforce=1"

Replacement in modules/linux-kernel.nix at line 57 [3.74635]

B:BD[3.76981] → [3.76981:77049]

        # Only allow signed modules.
        "module.sig_enforce=1"

[3.76981]

[3.77049]

      # Blocks access to all kernel memory, even preventing administrators from being able to inspect and probe the kernel.
      "lockdown=confidentiality"

Replacement in modules/linux-kernel.nix at line 60 [3.74635]

B:BD[3.77050] → [3.77050:77211]

        # Blocks access to all kernel memory, even preventing administrators from being able to inspect and probe the kernel.
        "lockdown=confidentiality"

[3.77050]

[3.77211]

      # Enable buddy allocator free poisoning.
      "page_poison=1"

Replacement in modules/linux-kernel.nix at line 63 [3.74635]

B:BD[3.77212] → [3.77212:77285]

        # Enable buddy allocator free poisoning.
        "page_poison=1"

[3.77212]

[3.77285]

      # Performance improvement for direct-mapped memory-side-cache utilization, reduces the predictability of page allocations.
      "page_alloc.shuffle=1"

Replacement in modules/linux-kernel.nix at line 66 [3.74635]

B:BD[3.77286] → [3.77286:77448]

        # Performance improvement for direct-mapped memory-side-cache utilization, reduces the predictability of page allocations.
        "page_alloc.shuffle=1"

[3.77286]

[3.77448]

      # Disable sysrq keys. sysrq is seful for debugging, but also insecure.
      "sysrq_always_enabled=0"

Replacement in modules/linux-kernel.nix at line 69 [3.74635]

B:BD[3.77449] → [3.77449:77561]

        # Disable sysrq keys. sysrq is seful for debugging, but also insecure.
        "sysrq_always_enabled=0"

[3.77449]

[3.77561]

      # Ignore access time (atime) updates on files, except when they coincide with updates to the ctime or mtime.
      "rootflags=noatime"

Replacement in modules/linux-kernel.nix at line 72 [3.74635]

B:BD[3.77562] → [3.77562:77707]

        # Ignore access time (atime) updates on files, except when they coincide with updates to the ctime or mtime.
        "rootflags=noatime"

[3.77562]

[3.77707]

      # Linux security modules.
      "lsm=landlock,lockdown,yama,integrity,apparmor,bpf,tomoyo,selinux"

Replacement in modules/linux-kernel.nix at line 75 [3.74635]

B:BD[3.77708] → [3.77708:77817]

        # Linux security modules.
        "lsm=landlock,lockdown,yama,integrity,apparmor,bpf,tomoyo,selinux"

[3.77708]

[3.77817]

      # Prevent the kernel from blanking plymouth out of the fb.
      "fbcon=nodefer"
    ];

Replacement in modules/linux-kernel.nix at line 79 [3.74635]

B:BD[3.77818] → [3.77818:77918]

        # Prevent the kernel from blanking plymouth out of the fb.
        "fbcon=nodefer"
      ];

[3.77818]

[3.77918]

    boot.blacklistedKernelModules = [
      # Obscure network protocols.
      "af_802154" # IEEE 802.15.4
      "appletalk" # Appletalk
      "atm" # ATM
      "ax25" # Amatuer X.25
      "can" # Controller Area Network
      "dccp" # Datagram Congestion Control Protocol
      "decnet" # DECnet
      "econet" # Econet
      "ipx" # Internetwork Packet Exchange
      "n-hdlc" # High-level Data Link Control
      "netrom" # NetRom
      "p8022" # IEEE 802.3
      "p8023" # Novell raw IEEE 802.3
      "psnap" # SubnetworkAccess Protocol
      "rds" # Reliable Datagram Sockets
      "rose" # ROSE
      "sctp" # Stream Control Transmission Protocol
      "tipc" # Transparent Inter-Process Communication
      "x25" # X.25

Replacement in modules/linux-kernel.nix at line 101 [3.74635]

B:BD[3.77919] → [3.77919:78688]

      boot.blacklistedKernelModules = [
        # Obscure network protocols.
        "af_802154" # IEEE 802.15.4
        "appletalk" # Appletalk
        "atm" # ATM
        "ax25" # Amatuer X.25
        "can" # Controller Area Network
        "dccp" # Datagram Congestion Control Protocol
        "decnet" # DECnet
        "econet" # Econet
        "ipx" # Internetwork Packet Exchange
        "n-hdlc" # High-level Data Link Control
        "netrom" # NetRom
        "p8022" # IEEE 802.3
        "p8023" # Novell raw IEEE 802.3
        "psnap" # SubnetworkAccess Protocol
        "rds" # Reliable Datagram Sockets
        "rose" # ROSE
        "sctp" # Stream Control Transmission Protocol
        "tipc" # Transparent Inter-Process Communication
        "x25" # X.25

[3.77919]

[3.78688]

      # Old or rare or insufficiently audited filesystems.
      "adfs" # Active Directory Federation Services
      "affs" # Amiga Fast File System
      "befs" # "Be File System"
      "bfs" # BFS, used by SCO UnixWare OS for the /stand slice
      "cifs" # Common Internet File System
      "cramfs" # compressed ROM/RAM file system
      "efs" # Extent File System
      "erofs" # Enhanced Read-Only File System
      "exofs" # EXtended Object File System
      "f2fs" # Flash-Friendly File System
      "freevxfs" # Veritas filesystem driver
      "gfs2" # Global File System 2
      "hfs" # Hierarchical File System (Macintosh)
      "hfsplus" # Same as above, but with extended attributes.
      "hpfs" # High Performance File System (used by OS/2)
      "jffs2" # Journalling Flash File System (v2)
      "jfs" # Journaled File System - only useful for VMWare sessions
      "ksmbd" # SMB3 Kernel Server
      "minix" # minix fs - used by the minix OS
      "nfs" # Network File System
      "nfsv3" # Network File System (v3)
      "nfsv4" # Network File System (v4)
      "nilfs2" # New Implementation of a Log-structured File System
      "omfs" # Optimized MPEG Filesystem
      "qnx4" # Extent-based file system used by the QNX4 OS.
      "qnx6" # Extent-based file system used by the QNX6 OS.
      "squashfs" # compressed read-only file system (used by live CDs)
      "sysv" # implements all of Xenix FS, SystemV/386 FS and Coherent FS.
      "udf" # https://docs.kernel.org/5.15/filesystems/udf.html
      "vivid" # Virtual Video Test Driver (unnecessary)
      # Disable Thunderbolt and FireWire to prevent DMA attacks
      "firewire-core"
      "thunderbolt"
    ];
  };
in
{

Replacement in modules/linux-kernel.nix at line 142 [3.74635]

B:BD[3.78689] → [3.78689:80324]

        # Old or rare or insufficiently audited filesystems.
        "adfs" # Active Directory Federation Services
        "affs" # Amiga Fast File System
        "befs" # "Be File System"
        "bfs" # BFS, used by SCO UnixWare OS for the /stand slice
        "cifs" # Common Internet File System
        "cramfs" # compressed ROM/RAM file system
        "efs" # Extent File System
        "erofs" # Enhanced Read-Only File System
        "exofs" # EXtended Object File System
        "f2fs" # Flash-Friendly File System
        "freevxfs" # Veritas filesystem driver
        "gfs2" # Global File System 2
        "hfs" # Hierarchical File System (Macintosh)
        "hfsplus" # Same as above, but with extended attributes.
        "hpfs" # High Performance File System (used by OS/2)
        "jffs2" # Journalling Flash File System (v2)
        "jfs" # Journaled File System - only useful for VMWare sessions
        "ksmbd" # SMB3 Kernel Server
        "minix" # minix fs - used by the minix OS
        "nfs" # Network File System
        "nfsv3" # Network File System (v3)
        "nfsv4" # Network File System (v4)
        "nilfs2" # New Implementation of a Log-structured File System
        "omfs" # Optimized MPEG Filesystem
        "qnx4" # Extent-based file system used by the QNX4 OS.
        "qnx6" # Extent-based file system used by the QNX6 OS.
        "squashfs" # compressed read-only file system (used by live CDs)
        "sysv" # implements all of Xenix FS, SystemV/386 FS and Coherent FS.
        "udf" # https://docs.kernel.org/5.15/filesystems/udf.html
        "vivid" # Virtual Video Test Driver (unnecessary)

[3.78689]

[3.80324]

  config.flake.modules.nixos.linux-kernel =
    { pkgs, ... }:
    commonModule // {
      boot.kernelPackages = pkgs.linuxPackages_latest;
    };

Replacement in modules/linux-kernel.nix at line 148 [3.74635]

B:BD[3.80325] → [3.80325:80446]

        # Disable Thunderbolt and FireWire to prevent DMA attacks
        "firewire-core"
        "thunderbolt"
      ];

[3.80325]

[3.80446]

  config.flake.modules.nixos.linux-kernel-desktop =
    { pkgs, ... }:
    commonModule // {
      boot.kernelPackages = pkgs.linuxKernel.packages.linux_zen;

File deletion: kernel.nix

BF:BFD[4.77] → [2.5548:5582]

BF:BFD[2.5582] → [2.32:32]

B:BD[2.32] → [2.33:5547]

{ config, pkgs, ... }: {
  boot.kernelPackages = if config.isDesktopNotWsl then
    pkgs.linuxKernel.packages.linux_zen
  else
    pkgs.linuxPackages_latest;
  # Credits from me:
  # - https://github.com/RGBCube/ncc/blob/c5714110d951f57e66d5ee47a244c0a93f3406a1/modules/linux/kernel.nix
  # From RGBCube:
  # - https://github.com/NotAShelf/nyx/blob/main/modules/core/common/system/security/kernel.nix
  # - "hsslister" user - raf (NotAShelf) - "I actually forgot the dudes GitHub"
  boot.kernel.sysctl = {
    # The Magic SysRq key is a key combo that allows users connected to the
    # system console of a Linux kernel to perform some low-level commands.
    # Disable it, since we don't need it, and is a potential security concern.
    "kernel.sysrq" = 0;
    # Hide kptrs even for processes with CAP_SYSLOG.
    # Also prevents printing kernel pointers.
    "kernel.kptr_restrict" = 2;
    # Disable bpf() JIT (to eliminate spray attacks).
    "net.core.bpf_jit_enable" = false;
    # Disable ftrace debugging.
    "kernel.ftrace_enabled" = false;
    # Avoid kernel memory address exposures via dmesg (this value can also be set by CONFIG_SECURITY_DMESG_RESTRICT).
    "kernel.dmesg_restrict" = 1;
    # Prevent unintentional fifo writes.
    "fs.protected_fifos" = 2;
    # Prevent unintended writes to already-created files.
    "fs.protected_regular" = 2;
    # Disable SUID binary dump.
    "fs.suid_dumpable" = 0;
    # Disallow profiling at all levels without CAP_SYS_ADMIN.
    "kernel.perf_event_paranoid" = 3;
    # Require CAP_BPF to use bpf.
    "kernel.unprvileged_bpf_disabled" = 1;
  };
  # https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html
  boot.kernelParams = [
    # Make stack-based attacks on the kernel harder.
    "randomize_kstack_offset=on"
    # Controls the behavior of vsyscalls. This has been defaulted to none back in 2016 - break really old binaries for security.
    "vsyscall=none"
    # Reduce most of the exposure of a heap attack to a single cache.
    "slab_nomerge"
    # Only allow signed modules.
    "module.sig_enforce=1"
    # Blocks access to all kernel memory, even preventing administrators from being able to inspect and probe the kernel.
    "lockdown=confidentiality"
    # Enable buddy allocator free poisoning.
    "page_poison=1"
    # Performance improvement for direct-mapped memory-side-cache utilization, reduces the predictability of page allocations.
    "page_alloc.shuffle=1"
    # Disable sysrq keys. sysrq is seful for debugging, but also insecure.
    "sysrq_always_enabled=0"
    # Ignore access time (atime) updates on files, except when they coincide with updates to the ctime or mtime.
    "rootflags=noatime"
    # Linux security modules.
    "lsm=landlock,lockdown,yama,integrity,apparmor,bpf,tomoyo,selinux"
    # Prevent the kernel from blanking plymouth out of the fb.
    "fbcon=nodefer"
  ];
  boot.blacklistedKernelModules = [
      # Obscure network protocols.
      "af_802154" # IEEE 802.15.4
      "appletalk" # Appletalk
      "atm"       # ATM
      "ax25"      # Amatuer X.25
      "can"       # Controller Area Network
      "dccp"      # Datagram Congestion Control Protocol
      "decnet"    # DECnet
      "econet"    # Econet
      "ipx"       # Internetwork Packet Exchange
      "n-hdlc"    # High-level Data Link Control
      "netrom"    # NetRom
      "p8022"     # IEEE 802.3
      "p8023"     # Novell raw IEEE 802.3
      "psnap"     # SubnetworkAccess Protocol
      "rds"       # Reliable Datagram Sockets
      "rose"      # ROSE
      "sctp"      # Stream Control Transmission Protocol
      "tipc"      # Transparent Inter-Process Communication
      "x25"       # X.25
      # Old or rare or insufficiently audited filesystems.
      "adfs"     # Active Directory Federation Services
      "affs"     # Amiga Fast File System
      "befs"     # "Be File System"
      "bfs"      # BFS, used by SCO UnixWare OS for the /stand slice
      "cifs"     # Common Internet File System
      "cramfs"   # compressed ROM/RAM file system
      "efs"      # Extent File System
      "erofs"    # Enhanced Read-Only File System
      "exofs"    # EXtended Object File System
      "f2fs"     # Flash-Friendly File System
      "freevxfs" # Veritas filesystem driver
      "gfs2"     # Global File System 2
      "hfs"      # Hierarchical File System (Macintosh)
      "hfsplus"  # Same as above, but with extended attributes.
      "hpfs"     # High Performance File System (used by OS/2)
      "jffs2"    # Journalling Flash File System (v2)
      "jfs"      # Journaled File System - only useful for VMWare sessions
      "ksmbd"    # SMB3 Kernel Server
      "minix"    # minix fs - used by the minix OS
      "nfs"      # Network File System
      "nfsv3"    # Network File System (v3)
      "nfsv4"    # Network File System (v4)
      "nilfs2"   # New Implementation of a Log-structured File System
      "omfs"     # Optimized MPEG Filesystem
      "qnx4"     # Extent-based file system used by the QNX4 OS.
      "qnx6"     # Extent-based file system used by the QNX6 OS.
      "squashfs" # compressed read-only file system (used by live CDs)
      "sysv"     # implements all of Xenix FS, SystemV/386 FS and Coherent FS.
      "udf"      # https://docs.kernel.org/5.15/filesystems/udf.html
      "vivid"    # Virtual Video Test Driver (unnecessary)
      # Disable Thunderbolt and FireWire to prevent DMA attacks
      "firewire-core"
      "thunderbolt"
    ];
}