From 0f0f314643eb1c4ff43d62d604e9569c48a3f81b Mon Sep 17 00:00:00 2001
From: Henrik Lissner <henrik@lissner.net>
Date: Sat, 20 Feb 2021 17:55:20 -0500
Subject: [PATCH] Add noexec & size=25% to tmpfs on /tmp

Also auto-enable boot.cleanTmpDir if boot.tmpOnTmpfs is off. /tmp
shouldn't be treated as persistent storage!
---
 hosts/ao/default.nix |  1 -
 modules/security.nix | 17 +++++++++++++++--
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/hosts/ao/default.nix b/hosts/ao/default.nix
index 5767162c..b26f13ad 100644
--- a/hosts/ao/default.nix
+++ b/hosts/ao/default.nix
@@ -28,7 +28,6 @@ with lib.my;
     theme.active = "alucard";
   };
 
-
   ## Local config
   networking.networkmanager.enable = true;
 
diff --git a/modules/security.nix b/modules/security.nix
index 07ed4a72..90384df1 100644
--- a/modules/security.nix
+++ b/modules/security.nix
@@ -1,8 +1,21 @@
-{ ... }:
+{ lib, config, ... }:
 
 {
   ## System security tweaks
-  boot.tmpOnTmpfs = true;
+  # tmpfs = /tmp is mounted in ram. Doing so makes temp file management speedy
+  # on ssd systems, and volatile! Because it's wiped on reboot.
+  boot.tmpOnTmpfs = lib.mkDefault true;
+  systemd.mounts = lib.mkIf config.boot.tmpOnTmpfs [{
+    what = "tmpfs";
+    where = "/tmp";
+    type = "tmpfs";
+    # Added noexec (for added security), and reduced size from 50% to 25%
+    options = "mode=1777,strictatime,rw,nosuid,nodev,noexec,size=25%";
+  }];
+  # If not using tmpfs, which is naturally purged on reboot, we must clean it
+  # /tmp ourselves. /tmp should be volatile storage!
+  boot.cleanTmpDir = lib.mkDefault (!config.boot.tmpOnTmpfs);
+
   security.hideProcessInformation = true;
   security.protectKernelImage = true;