b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

GCE image: Remove some unnecessary lib prefixes.

Browse source
This commit is contained in:
Rob Vermaas 2015-03-26 09:15:09 +00:00
parent 80202fbd25
commit cbb14299c9
1 changed files with 25 additions and 25 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

50
nixos/modules/virtualisation/google-compute-image.nix
View file

@ -8,7 +8,7 @@ in
imports = [ ../profiles/headless.nix ../profiles/qemu-guest.nix ];
# https://cloud.google.com/compute/docs/tutorials/building-images
networking.firewall.enable = lib.mkDefault false;
networking.firewall.enable = mkDefault false;
system.build.googleComputeImage =
pkgs.vmTools.runInLinuxVM (
@ -112,7 +112,7 @@ in
# at instance creation time.
services.openssh.enable = true;
services.openssh.permitRootLogin = "without-password";
services.openssh.passwordAuthentication = false;
services.openssh.passwordAuthentication = mkDefault false;
# Force getting the hostname from Google Compute.
networking.hostName = mkDefault "";
@ -188,73 +188,73 @@ in
# Setings taken from https://cloud.google.com/compute/docs/tutorials/building-images#providedkernel
boot.kernel.sysctl = {
# enables syn flood protection
"net.ipv4.tcp_syncookies" = lib.mkDefault "1";
"net.ipv4.tcp_syncookies" = mkDefault "1";
# ignores source-routed packets
"net.ipv4.conf.all.accept_source_route" = lib.mkDefault "0";
"net.ipv4.conf.all.accept_source_route" = mkDefault "0";
# ignores source-routed packets
"net.ipv4.conf.default.accept_source_route" = lib.mkDefault "0";
"net.ipv4.conf.default.accept_source_route" = mkDefault "0";
# ignores ICMP redirects
"net.ipv4.conf.all.accept_redirects" = lib.mkDefault "0";
"net.ipv4.conf.all.accept_redirects" = mkDefault "0";
# ignores ICMP redirects
"net.ipv4.conf.default.accept_redirects" = lib.mkDefault "0";
"net.ipv4.conf.default.accept_redirects" = mkDefault "0";
# ignores ICMP redirects from non-GW hosts
"net.ipv4.conf.all.secure_redirects" = lib.mkDefault "1";
"net.ipv4.conf.all.secure_redirects" = mkDefault "1";
# ignores ICMP redirects from non-GW hosts
"net.ipv4.conf.default.secure_redirects" = lib.mkDefault "1";
"net.ipv4.conf.default.secure_redirects" = mkDefault "1";
# don't allow traffic between networks or act as a router
"net.ipv4.ip_forward" = lib.mkDefault "0";
"net.ipv4.ip_forward" = mkDefault "0";
# don't allow traffic between networks or act as a router
"net.ipv4.conf.all.send_redirects" = lib.mkDefault "0";
"net.ipv4.conf.all.send_redirects" = mkDefault "0";
# don't allow traffic between networks or act as a router
"net.ipv4.conf.default.send_redirects" = lib.mkDefault "0";
"net.ipv4.conf.default.send_redirects" = mkDefault "0";
# reverse path filtering - IP spoofing protection
"net.ipv4.conf.all.rp_filter" = lib.mkDefault "1";
"net.ipv4.conf.all.rp_filter" = mkDefault "1";
# reverse path filtering - IP spoofing protection
"net.ipv4.conf.default.rp_filter" = lib.mkDefault "1";
"net.ipv4.conf.default.rp_filter" = mkDefault "1";
# ignores ICMP broadcasts to avoid participating in Smurf attacks
"net.ipv4.icmp_echo_ignore_broadcasts" = lib.mkDefault "1";
"net.ipv4.icmp_echo_ignore_broadcasts" = mkDefault "1";
# ignores bad ICMP errors
"net.ipv4.icmp_ignore_bogus_error_responses" = lib.mkDefault "1";
"net.ipv4.icmp_ignore_bogus_error_responses" = mkDefault "1";
# logs spoofed, source-routed, and redirect packets
"net.ipv4.conf.all.log_martians" = lib.mkDefault "1";
"net.ipv4.conf.all.log_martians" = mkDefault "1";
# log spoofed, source-routed, and redirect packets
"net.ipv4.conf.default.log_martians" = lib.mkDefault "1";
"net.ipv4.conf.default.log_martians" = mkDefault "1";
# implements RFC 1337 fix
"net.ipv4.tcp_rfc1337" = lib.mkDefault "1";
"net.ipv4.tcp_rfc1337" = mkDefault "1";
# randomizes addresses of mmap base, heap, stack and VDSO page
"kernel.randomize_va_space" = lib.mkDefault "2";
"kernel.randomize_va_space" = mkDefault "2";
# provides protection from ToCToU races
"fs.protected_hardlinks" = lib.mkDefault "1";
"fs.protected_hardlinks" = mkDefault "1";
# provides protection from ToCToU races
"fs.protected_symlinks" = lib.mkDefault "1";
"fs.protected_symlinks" = mkDefault "1";
# makes locating kernel addresses more difficult
"kernel.kptr_restrict" = lib.mkDefault "1";
"kernel.kptr_restrict" = mkDefault "1";
# set ptrace protections
"kernel.yama.ptrace_scope" = lib.mkDefault "1";
"kernel.yama.ptrace_scope" = mkDefault "1";
# set perf only available to root
"kernel.perf_event_paranoid" = lib.mkDefault "2";
"kernel.perf_event_paranoid" = mkDefault "2";
};