<commit_before># A profile with most (vanilla) hardening options enabled by default,
# potentially at the cost of features and performance.

{ config, lib, pkgs, ... }:

with lib;

{
  security.hideProcessInformation = mkDefault true;

  security.apparmor.enable = mkDefault true;

  boot.kernelParams = [
    # Disable legacy virtual syscalls
    "vsyscall=none"
  ];

  # Restrict ptrace() usage to processes with a pre-defined relationship
  # (e.g., parent/child)
  boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkOverride 500 1;

  # Prevent replacing the running kernel image w/o reboot
  boot.kernel.sysctl."kernel.kexec_load_disabled" = mkDefault true;<commit_msg>nixos/hardened profile: lock kernel modules<commit_after># A profile with most (vanilla) hardening options enabled by default,
# potentially at the cost of features and performance.

{ config, lib, pkgs, ... }:

with lib;

{
  security.hideProcessInformation = mkDefault true;

  security.lockKernelModules = mkDefault true;

  security.apparmor.enable = mkDefault true;

  boot.kernelParams = [
    # Disable legacy virtual syscalls
    "vsyscall=none"
  ];

  # Restrict ptrace() usage to processes with a pre-defined relationship
  # (e.g., parent/child)
  boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkOverride 500 1;

  # Prevent replacing the running kernel image w/o reboot
  boot.kernel.sysctl."kernel.kexec_load_disabled" = mkDefault true;
{'fraction_non_alphanumeric': 0.09607293127629733, 'fraction_numerical': 0.005610098176718092, 'mean_word_length': 4.133093525179856, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1347878', 'n_tokens_mistral': 454, 'n_tokens_neox': 423, 'n_words': 130}