kenji
a4f5cddcb2
Moves all kernel parameters to modules/nixos/kernel.nix to avoid duplication and conflicts. Prioritizes quiet boot settings.
29 lines
681 B
Nix
29 lines
681 B
Nix
{pkgs, ...}: {
|
|
boot = {
|
|
kernelPackages = pkgs.linuxPackages_cachyos; # from chaotic input
|
|
kernelParams = [
|
|
"quiet"
|
|
"splash"
|
|
"boot.shell_on_fail"
|
|
"loglevel=3"
|
|
"rd.systemd.show_status=false"
|
|
"rd.udev.log_level=3"
|
|
"udev.log_priority=3"
|
|
"intremap=on"
|
|
# Security hardening
|
|
"slab_nomerge"
|
|
"init_on_alloc=1"
|
|
"init_on_free=1"
|
|
"page_alloc.shuffle=1"
|
|
"randomize_kstack_offset=on"
|
|
"vsyscall=none"
|
|
];
|
|
kernel.sysctl = {
|
|
"kernel.dmesg_restrict" = 1;
|
|
"kernel.kptr_restrict" = 2;
|
|
"kernel.unprivileged_bpf_disabled" = 1;
|
|
"net.core.bpf_jit_harden" = 2;
|
|
};
|
|
};
|
|
}
|