Mitigate recent kernel exploits with kernel upgrade and blacklisting

Signed-off-by: Mel <mel@rnrd.eu>

1 files changed, 93 insertions, 30 deletions

diff --git a/modules/common.nix b/modules/common.nix
index 5766037..153b290 100644
--- a/modules/common.nix
+++ b/modules/common.nix
@@ -1,4 +1,11 @@
-{ me, util, config, lib, pkgs, ... }:
+{
+  me,
+  util,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 {
   imports = [
@@ -12,17 +19,15 @@
     ./vim.nix
   ];
 
-  boot.kernelPackages = pkgs.linuxPackages_latest;
-
   # fish enables this by default,
   # it makes every nixos rebuild very slow.
   documentation.man.generateCaches = false;
 
   users.motd = ''
 
-/^  /^
-\ ' ' 7   < Hi, I'm ${util.titleCase me.name}
-/    \
+    /^  /^
+    \ ' ' 7   < Hi, I'm ${util.titleCase me.name}
+    /    \
 
   '';
 
@@ -30,7 +35,10 @@
     hostName = me.name;
     useDHCP = false;
     dhcpcd.enable = false;
-    nameservers = [ "1.1.1.1" "1.0.0.1" ];
+    nameservers = [
+      "1.1.1.1"
+      "1.0.0.1"
+    ];
 
     nftables = {
       enable = true;
@@ -39,7 +47,10 @@
 
     firewall = {
       enable = true;
-      allowedTCPPorts = [ 80 443 ];
+      allowedTCPPorts = [
+        80
+        443
+      ];
     };
   };
 
@@ -48,11 +59,27 @@
     wait-online.anyInterface = true;
   };
 
-  boot.kernel.sysctl = {
-    # turn all of the ip forwarding on
-    "net.ipv4.ip_forward" = lib.mkDefault 1;
-    "net.ipv6.conf.all.forwarding" = lib.mkDefault 1;
-    "net.ipv6.conf.default.forwarding" = lib.mkDefault 1;
+  boot = {
+    kernelPackages = pkgs.linuxPackages_latest;
+
+    kernel.sysctl = {
+      # turn all of the ip forwarding on
+      "net.ipv4.ip_forward" = lib.mkDefault 1;
+      "net.ipv6.conf.all.forwarding" = lib.mkDefault 1;
+      "net.ipv6.conf.default.forwarding" = lib.mkDefault 1;
+    };
+
+    # mitigations
+    blacklistedKernelModules = [
+      # copy fail (cve-2026-31431)
+      "algif_aead"
+
+      # dirty frag (cve-2026-43284)
+      "esp4" # ipv4 ipsec esp variant
+      "esp6" # ipv6 ipsec esp variant
+      "rxrpc" # rxrpc variant
+      # note: these mitigations kill ipsec, though we never use it.
+    ];
   };
 
   services.envfs.enable = true;
@@ -92,7 +119,12 @@
     openssh = {
       enable = true;
       openFirewall = false;
-      listenAddresses = [{ addr = me.tailscale.ip; port = 22; }];
+      listenAddresses = [
+        {
+          addr = me.tailscale.ip;
+          port = 22;
+        }
+      ];
       settings = {
         PasswordAuthentication = false;
         KbdInteractiveAuthentication = false;
@@ -120,20 +152,51 @@
     };
   };
 
-  environment.systemPackages = (with pkgs; [
-    file unzip jq dig htop glances wget
-    gnupg pinentry-curses age agenix
-    inetutils pciutils lshw inxi iw dmidecode
-    tcpdump
-    nftables wireguard-tools
-    ffmpeg_7-headless
-
-    ripgrep gnumake gdb gcc clang dtc
-    go gopls delve go-task
-    meson cmake
-    nil direnv nixfmt-rfc-style
-    dive compose2nix nix-prefetch-docker
-
-    borgbackup
-  ]);
+  environment.systemPackages = (
+    with pkgs;
+    [
+      file
+      unzip
+      jq
+      dig
+      htop
+      glances
+      wget
+      gnupg
+      pinentry-curses
+      age
+      agenix
+      inetutils
+      pciutils
+      lshw
+      inxi
+      iw
+      dmidecode
+      tcpdump
+      nftables
+      wireguard-tools
+      ffmpeg_7-headless
+
+      ripgrep
+      gnumake
+      gdb
+      gcc
+      clang
+      dtc
+      go
+      gopls
+      delve
+      go-task
+      meson
+      cmake
+      nil
+      direnv
+      nixfmt-rfc-style
+      dive
+      compose2nix
+      nix-prefetch-docker
+
+      borgbackup
+    ]
+  );
 }