From cc396697a6078d4137e1e1996989408d666fb3d8 Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Mon, 5 Dec 2016 23:55:40 +0100 Subject: [PATCH] grsecurity: enable ability to lock in readonly mounts --- pkgs/os-specific/linux/kernel/grsecurity-nixos-config.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/os-specific/linux/kernel/grsecurity-nixos-config.nix b/pkgs/os-specific/linux/kernel/grsecurity-nixos-config.nix index c426799f59d..64722635f41 100644 --- a/pkgs/os-specific/linux/kernel/grsecurity-nixos-config.nix +++ b/pkgs/os-specific/linux/kernel/grsecurity-nixos-config.nix @@ -30,6 +30,7 @@ PAX_KERNEXEC_PLUGIN_METHOD_BTS y # Additional grsec hardening not implied by auto constraints GRKERNSEC_IO y GRKERNSEC_SYSFS_RESTRICT y +GRKERNSEC_ROFS y GRKERNSEC_MODHARDEN y