h/dotfiles
1
Fork 0
Code Actions Activity

harden: no extraneous permissions on /root, /var and /etc

Browse Source
This commit is contained in:
Himadri Bhattacharjee
2024-10-02 08:04:33 +05:30
parent f4304f8571
commit ccc54c0263
2 changed files with 33 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
hosts/default/configuration.nix
View File

@@ -5,6 +5,7 @@
[
./hardware-configuration.nix
./disable-broken-wifi-card.nix
./filesystem-hardening.nix
];
boot = {

32
hosts/default/filesystem-hardening.nix Normal file
View File

@@ -0,0 +1,32 @@
{
fileSystems = {
"/root" = {
device = "/root";
options = [
"bind"
"nosuid"
"noexec"
"nodev"
];
};
"/var" = {
device = "/var";
options = [
"bind"
"nosuid"
"noexec"
"nodev"
];
};
"/etc" = {
device = "/etc";
options = [
"bind"
"nosuid"
"nodev"
];
};
};
}