mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-05-17 12:06:52 +02:00
Ryan Yin
21 lines
394 B
Nix
21 lines
394 B
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
{
|
|
# Kernel module blacklisting to mitigate Dirty Frag LPE (Local Privilege Escalation) vulnerabilities.
|
|
boot.blacklistedKernelModules = [
|
|
"esp4"
|
|
"esp6"
|
|
"rxrpc"
|
|
];
|
|
|
|
boot.extraModprobeConfig = ''
|
|
install esp4 ${pkgs.coreutils}/bin/false
|
|
install esp6 ${pkgs.coreutils}/bin/false
|
|
install rxrpc ${pkgs.coreutils}/bin/false
|
|
'';
|
|
}
|