From cb74a5744fafa1d474f53e66e1a06681fafa7959 Mon Sep 17 00:00:00 2001 From: Hadi Date: Fri, 21 Aug 2026 14:38:47 +0200 Subject: [PATCH] Hardening: Vulnix + kernel hardening Signed-off-by: Hadi --- hosts/laptop/configuration.nix | 1 + hosts/laptop/persistence.nix | 1 + hosts/server/configuration.nix | 2 +- hosts/work/configuration.nix | 2 ++ hosts/work/persistence.nix | 1 + .../kernel-hardening.nix | 28 +++++++++++++++++-- nixos/vulnix.nix | 27 ++++++++++++++++++ 7 files changed, 58 insertions(+), 4 deletions(-) rename {server-modules => nixos}/kernel-hardening.nix (55%) create mode 100644 nixos/vulnix.nix diff --git a/hosts/laptop/configuration.nix b/hosts/laptop/configuration.nix index 3187a97c..fe587986 100644 --- a/hosts/laptop/configuration.nix +++ b/hosts/laptop/configuration.nix @@ -14,6 +14,7 @@ ../../nixos/utils.nix ../../nixos/hyprland.nix ../../nixos/steam.nix + ../../nixos/kernel-hardening.nix ../../home/programs/gui/helium/system.nix # I hate browser's configuration.. # CHANGEME: You should probably remove those things: diff --git a/hosts/laptop/persistence.nix b/hosts/laptop/persistence.nix index 784eea8b..3a0b648f 100644 --- a/hosts/laptop/persistence.nix +++ b/hosts/laptop/persistence.nix @@ -13,6 +13,7 @@ "/var/lib/systemd/timers" # last-run timestamps (e.g. nix gc weekly) "/var/log" "/var/cache/tuigreet" + "/var/cache/vulnix" "/var/db/sudo/lectured" # remembers that the sudo lecture was already shown ]; diff --git a/hosts/server/configuration.nix b/hosts/server/configuration.nix index 37d039b9..5f9aed74 100644 --- a/hosts/server/configuration.nix +++ b/hosts/server/configuration.nix @@ -19,7 +19,7 @@ ../../server-modules/bentopdf.nix ../../server-modules/cyberchef.nix ../../server-modules/mazanoke.nix - ../../server-modules/kernel-hardening.nix + ../../nixos/kernel-hardening.nix ../../server-modules/fail2ban.nix ../../server-modules/default-creds.nix ../../server-modules/gitea.nix diff --git a/hosts/work/configuration.nix b/hosts/work/configuration.nix index a686a686..5169e1cf 100644 --- a/hosts/work/configuration.nix +++ b/hosts/work/configuration.nix @@ -11,6 +11,8 @@ ../../nixos/users.nix ../../nixos/utils.nix ../../nixos/hyprland.nix + ../../nixos/kernel-hardening.nix + ../../nixos/vulnix.nix ../../home/programs/gui/helium/system.nix # I hate browser's configuration.. # CHANGEME: You should probably remove those things: diff --git a/hosts/work/persistence.nix b/hosts/work/persistence.nix index 784eea8b..3a0b648f 100644 --- a/hosts/work/persistence.nix +++ b/hosts/work/persistence.nix @@ -13,6 +13,7 @@ "/var/lib/systemd/timers" # last-run timestamps (e.g. nix gc weekly) "/var/log" "/var/cache/tuigreet" + "/var/cache/vulnix" "/var/db/sudo/lectured" # remembers that the sudo lecture was already shown ]; diff --git a/server-modules/kernel-hardening.nix b/nixos/kernel-hardening.nix similarity index 55% rename from server-modules/kernel-hardening.nix rename to nixos/kernel-hardening.nix index 34b8de58..67cf3b36 100644 --- a/server-modules/kernel-hardening.nix +++ b/nixos/kernel-hardening.nix @@ -1,4 +1,3 @@ -# Kernel hardening for the server { boot.kernel.sysctl = { # Restrict access to kernel logs and pointers @@ -9,6 +8,18 @@ "net.core.bpf_jit_harden" = 2; "kernel.unprivileged_bpf_disabled" = 1; + # Restrict ptrace to parent processes only + "kernel.yama.ptrace_scope" = 1; + + # Disable kexec (loading a new kernel at runtime) + "kernel.kexec_load_disabled" = 1; + + # Disable magic SysRq key + "kernel.sysrq" = 0; + + # Restrict access to /proc for non-root users + "kernel.perf_event_paranoid" = 3; + # Reverse path filtering (anti-spoofing) "net.ipv4.conf.all.rp_filter" = 1; "net.ipv4.conf.default.rp_filter" = 1; @@ -29,7 +40,18 @@ # Don't send ICMP redirects "net.ipv4.conf.all.send_redirects" = 0; - # Restrict ptrace to parent processes only - "kernel.yama.ptrace_scope" = 1; + # Ignore bogus ICMP error responses + "net.ipv4.icmp_ignore_bogus_error_responses" = 1; + + # Protect against time-wait assassination + "net.ipv4.tcp_rfc1337" = 1; }; + + boot.kernelParams = [ + "init_on_alloc=1" # zero freshly allocated kernel memory + "init_on_free=1" # zero freed kernel memory + "slab_nomerge" # don't merge slab caches of different sizes (harder heap grooming) + "page_alloc.shuffle=1" # randomize page allocator freelists + "randomize_kstack_offset=1" # randomize the kernel stack offset on syscall entry + ]; } diff --git a/nixos/vulnix.nix b/nixos/vulnix.nix new file mode 100644 index 00000000..9c2fd28e --- /dev/null +++ b/nixos/vulnix.nix @@ -0,0 +1,27 @@ +# Vulnix scans the Nix store against the NVD CVE feed to find packages with +# known vulnerabilities. +{pkgs, ...}: { + environment.systemPackages = [pkgs.vulnix]; + + systemd.services.vulnix-scan = { + description = "Scan the system closure for known vulnerabilities (vulnix)"; + serviceConfig = { + Type = "oneshot"; + ExecStart = "${pkgs.vulnix}/bin/vulnix --system --cache-dir /var/cache/vulnix"; + CacheDirectory = "vulnix"; + # vulnix exits non-zero when it finds vulnerabilities; that's expected, + # don't let systemd treat the scan itself as a failure. + SuccessExitStatus = "1 2"; + }; + }; + + systemd.timers.vulnix-scan = { + description = "Daily vulnix scan"; + wantedBy = ["timers.target"]; + timerConfig = { + OnCalendar = "daily"; + Persistent = true; + RandomizedDelaySec = "1h"; + }; + }; +}