public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Docs: init section Hardened in chapter Profiles

Browse Source
This commit is contained in:
David Izquierdo 2018-10-25 10:20:34 +02:00
parent b10d669919
commit 614ea40443
2 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
nixos/doc/manual/configuration/profiles.xml
View File

@ -31,4 +31,5 @@
<xi:include href="profiles/demo.xml" /> <xi:include href="profiles/demo.xml" />
<xi:include href="profiles/docker-container.xml" /> <xi:include href="profiles/docker-container.xml" />
<xi:include href="profiles/graphical.xml" /> <xi:include href="profiles/graphical.xml" />
<xi:include href="profiles/hardened.xml" />
</chapter> </chapter>

22
nixos/doc/manual/configuration/profiles/hardened.xml Normal file
View File

@ -0,0 +1,22 @@
<section xmlns="http://docbook.org/ns/docbook"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xi="http://www.w3.org/2001/XInclude"
version="5.0"
xml:id="sec-profile-hardened">
<title>Hardened</title>
<para>
A profile with most (vanilla) hardening options enabled by default,
potentially at the cost of features and performance.
</para>
<para>
This includes a hardened kernel, and limiting the system information
available to procesess via de <filename>/sys</filename> and
<filename>/proc</filename> filesystems. It also disables the User Namespaces
feature of the kernel, which stops Nix from being able to build anything
(this particular setting can be overriden via
<xref linkend="opt-security.allowUserNamespaces"/>). See the <literal
xlink:href="https://github.com/nixos/nixpkgs/tree/master/nixos/modules/profiles/hardened.nix">
profile source</literal> for further detail on which settings are altered.
</para>
</section>