systemd automatically mounts securityfs (if it's enabled)

modules/system/boot/stage-1-init.sh

@@ -65,7 +65,6 @@ mount -t sysfs none /sys
 mount -t devtmpfs -o "size=@devSize@" none /dev
 mkdir -p /run
 mount -t tmpfs -o "mode=0755,size=@runSize@" none /run
-mount -t securityfs none /sys/kernel/security
 
 # Process the kernel command line.
 export stage2Init=/init

modules/system/boot/stage-1.nix

@@ -361,6 +361,5 @@ in {
   system.requiredKernelConfig = with config.lib.kernelConfig; [
     (isYes "TMPFS")
     (isYes "BLK_DEV_INITRD")
-    (isYes "SECURITYFS")
   ];
 }