nixos/hardened profile: disable hibernation

Recommended by KSPP
2017-04-30 11:57:12 +02:00 · 2017-04-30 11:57:12 +02:00 · 1dd3ba924b
commit 1dd3ba924b
parent ffa83edf4a
1 changed files with 3 additions and 0 deletions
--- a/nixos/modules/profiles/hardened.nix
+++ b/nixos/modules/profiles/hardened.nix
@ -20,6 +20,9 @@ with lib;

    # Disable legacy virtual syscalls
    "vsyscall=none"
+
+    # Disable hibernation (allows replacing the running kernel)
+    "nohibernate"
  ];

  # Restrict ptrace() usage to processes with a pre-defined relationship