mirror of
https://github.com/NixOS/nixpkgs.git
synced 2024-12-23 22:23:15 +00:00
17 lines
984 B
XML
17 lines
984 B
XML
<section xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
version="5.0"
|
|
xml:id="sec-profile-hardened">
|
|
<title>Hardened</title>
|
|
|
|
<para>
|
|
A profile with most (vanilla) hardening options enabled by default, potentially at the cost of features and performance.
|
|
</para>
|
|
|
|
<para>
|
|
This includes a hardened kernel, and limiting the system information available to processes through the <filename>/sys</filename> and <filename>/proc</filename> filesystems. It also disables the User Namespaces feature of the kernel, which stops Nix from being able to build anything (this particular setting can be overriden via <xref linkend="opt-security.allowUserNamespaces"/>). See the <literal
|
|
xlink:href="https://github.com/nixos/nixpkgs/tree/master/nixos/modules/profiles/hardened.nix"> profile source</literal> for further detail on which settings are altered.
|
|
</para>
|
|
</section>
|