Add noexec & size=25% to tmpfs on /tmp
Also auto-enable boot.cleanTmpDir if boot.tmpOnTmpfs is off. /tmp shouldn't be treated as persistent storage!
This commit is contained in:
		
							parent
							
								
									3f72e498d6
								
							
						
					
					
						commit
						0f0f314643
					
				|  | @ -28,7 +28,6 @@ with lib.my; | |||
|     theme.active = "alucard"; | ||||
|   }; | ||||
| 
 | ||||
| 
 | ||||
|   ## Local config | ||||
|   networking.networkmanager.enable = true; | ||||
| 
 | ||||
|  |  | |||
|  | @ -1,8 +1,21 @@ | |||
| { ... }: | ||||
| { lib, config, ... }: | ||||
| 
 | ||||
| { | ||||
|   ## System security tweaks | ||||
|   boot.tmpOnTmpfs = true; | ||||
|   # tmpfs = /tmp is mounted in ram. Doing so makes temp file management speedy | ||||
|   # on ssd systems, and volatile! Because it's wiped on reboot. | ||||
|   boot.tmpOnTmpfs = lib.mkDefault true; | ||||
|   systemd.mounts = lib.mkIf config.boot.tmpOnTmpfs [{ | ||||
|     what = "tmpfs"; | ||||
|     where = "/tmp"; | ||||
|     type = "tmpfs"; | ||||
|     # Added noexec (for added security), and reduced size from 50% to 25% | ||||
|     options = "mode=1777,strictatime,rw,nosuid,nodev,noexec,size=25%"; | ||||
|   }]; | ||||
|   # If not using tmpfs, which is naturally purged on reboot, we must clean it | ||||
|   # /tmp ourselves. /tmp should be volatile storage! | ||||
|   boot.cleanTmpDir = lib.mkDefault (!config.boot.tmpOnTmpfs); | ||||
| 
 | ||||
|   security.hideProcessInformation = true; | ||||
|   security.protectKernelImage = true; | ||||
| 
 | ||||
|  |  | |||
		Loading…
	
		Reference in a new issue