blob: 05f99aff70f41e564e5c7a3e32168f2a33d91010 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
|
{
config,
lib,
pkgs,
...
}:
let
sysctlOption = lib.mkOptionType {
name = "sysctl option value";
check =
val:
let
checkType = x: lib.isBool x || lib.isString x || lib.isInt x || x == null;
in
checkType val || (val._type or "" == "override" && checkType val.content);
merge = loc: defs: lib.mergeOneOption loc defs;
};
in
{
options = {
boot.kernel.sysctl = lib.mkOption {
type =
let
highestValueType = lib.types.ints.unsigned // {
merge = loc: defs: lib.foldl (a: b: if b.value == null then null else lib.max a b.value) 0 defs;
};
in
lib.types.submodule {
freeformType = lib.types.attrsOf sysctlOption;
options = {
"net.core.rmem_max" = lib.mkOption {
type = lib.types.nullOr highestValueType;
default = null;
description = "The maximum receive socket buffer size in bytes. In case of conflicting values, the highest will be used.";
};
"net.core.wmem_max" = lib.mkOption {
type = lib.types.nullOr highestValueType;
default = null;
description = "The maximum send socket buffer size in bytes. In case of conflicting values, the highest will be used.";
};
};
};
default = { };
example = lib.literalExpression ''
{ "net.ipv4.tcp_syncookies" = false; "vm.swappiness" = 60; }
'';
description = ''
Runtime parameters of the Linux kernel, as set by
{manpage}`sysctl(8)`. Note that sysctl
parameters names must be enclosed in quotes
(e.g. `"vm.swappiness"` instead of
`vm.swappiness`). The value of each
parameter may be a string, integer, boolean, or null
(signifying the option will not appear at all).
'';
};
};
config = {
environment.etc = {
"sysctl.d/55-nixos-aslr-entropy.conf".source =
pkgs.runCommand "55-nixos-aslr-entropy.conf"
{
inherit (config.boot.kernelPackages.kernel) configfile;
}
(
''
set +e
mmap_rnd_bits_max=$(grep "^CONFIG_ARCH_MMAP_RND_BITS_MAX=" $configfile | grep --only-matching "[0-9]*$")
set -e
if [[ -z "$mmap_rnd_bits_max" ]]; then
echo "Unable to determine mmap_rnd_bits_max. Check your kernel configfile is valid."
exit 1
fi
echo "vm.mmap_rnd_bits=$mmap_rnd_bits_max" >> $out
''
# HAVE_ARCH_MMAP_RND_COMPAT_BITS is not defined on 32-bit architectures or LoongArch64
+ lib.optionalString (with pkgs.stdenv.hostPlatform; (!is32bit && !isLoongArch64)) ''
set +e
mmap_rnd_compat_bits_max=$(grep "^CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=" $configfile | grep --only-matching "[0-9]*$")
set -e
if [[ -z "$mmap_rnd_compat_bits_max" ]]; then
echo "Unable to determine mmap_rnd_compat_bits_max. Check your kernel configfile is valid."
exit 1
fi
echo "vm.mmap_rnd_compat_bits=$mmap_rnd_compat_bits_max" >> $out
''
);
"sysctl.d/60-nixos.conf".text = lib.concatStrings (
lib.mapAttrsToList (
n: v: lib.optionalString (v != null) "${n}=${if v == false then "0" else toString v}\n"
) config.boot.kernel.sysctl
);
};
systemd.services.systemd-sysctl = {
wantedBy = [ "multi-user.target" ];
restartTriggers = [ config.environment.etc."sysctl.d/60-nixos.conf".source ];
};
# NixOS wide defaults
boot.kernel.sysctl = {
# Hide kernel pointers (e.g. in /proc/modules) for unprivileged
# users as these make it easier to exploit kernel vulnerabilities.
"kernel.kptr_restrict" = lib.mkDefault 1;
# Improve compatibility with applications that allocate
# a lot of memory, like modern games
"vm.max_map_count" = lib.mkDefault 1048576;
# The default max inotify watches is 8192.
# Nowadays most apps require a good number of inotify watches,
# the value below is used by default on several other distros.
"fs.inotify.max_user_instances" = lib.mkDefault 524288;
"fs.inotify.max_user_watches" = lib.mkDefault 524288;
};
};
}
|
