ppetru/alo-cluster
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Restrict permissions on /boot to protect the random seed.

Browse Source
This commit is contained in:
Petru
2024-09-13 10:31:44 +01:00
parent 8588d7f09f
commit 4e24ac988f
5 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
common/encrypted-btrfs-layout.nix
View File

@@ -31,6 +31,9 @@ in
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
mountOptions = [
"umask=0077" # to avoid the random seed being world readable
];
};
};
luksroot = {

1
hosts/alo-cloud-1/hardware.nix
View File

@@ -36,6 +36,7 @@
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/FF9C-DC81";
fsType = "vfat";
options = [ "umask=0077" ]; # to avoid the random seed being world readable
};
swapDevices = [ {

1
hosts/c1/hardware.nix
View File

@@ -39,6 +39,7 @@
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/D8C2-9216";
fsType = "vfat";
options = [ "umask=0077" ]; # to avoid the random seed being world readable
};
swapDevices = [ {

1
hosts/c2/hardware.nix
View File

@@ -39,6 +39,7 @@
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/B543-374F";
fsType = "vfat";
options = [ "umask=0077" ]; # to avoid the random seed being world readable
};
swapDevices = pkgs.lib.mkForce [ {

2
hosts/zippy/hardware.nix
View File

@@ -39,7 +39,7 @@
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/F3C9-A38F";
fsType = "vfat";
options = [ "fmask=0022" "dmask=0022" ];
options = [ "umask=0077" ]; # to avoid the random seed being world readable
};
swapDevices = [ {