feature(boot): restrict access for /boot to root

2026-10-03 10:55:05 +02:00
parent b42b873eb1
commit 4251ae2da5
4 changed files with 7 additions and 7 deletions
@@ -75,7 +75,7 @@ fileSystems."/" =
 fileSystems."/boot" =
  { device = "/dev/disk/by-label/nixboot";
    fsType = "vfat";
-    options = [ "fmask=0022" "dmask=0022" ];
+    options = [ "fmask=0077" "dmask=0077" ];  # only root may read /boot
  };
 fileSystems."/home" =
  { device = "/dev/disk/by-label/nixhome";
@@ -39,8 +39,8 @@
    device = "/dev/disk/by-label/nixboot";
    fsType = "vfat";
    options = [
-      "fmask=0022"
-      "dmask=0022"
+      "fmask=0077"
+      "dmask=0077"
    ];
  };

@@ -40,8 +40,8 @@
    device = "/dev/disk/by-label/nixboot";
    fsType = "vfat";
    options = [
-      "fmask=0022"
-      "dmask=0022"
+      "fmask=0077"
+      "dmask=0077"
    ];
  };

@@ -43,8 +43,8 @@
    device = "/dev/disk/by-label/nixboot";
    fsType = "vfat";
    options = [
-      "fmask=0022"
-      "dmask=0022"
+      "fmask=0077"
+      "dmask=0077"
    ];
  };