aaron/nixconfig
1
1
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feature(boot): restrict access for /boot to root

Browse Source
This commit is contained in:
aaron
2026-10-03 10:55:05 +02:00
parent b42b873eb1
commit 4251ae2da5
4 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
INSTALLATION.md
+1 -1
View File
@@ -75,7 +75,7 @@ fileSystems."/" =
fileSystems."/boot" = fileSystems."/boot" =
{ device = "/dev/disk/by-label/nixboot"; { device = "/dev/disk/by-label/nixboot";
fsType = "vfat"; fsType = "vfat";
options = [ "fmask=0022" "dmask=0022" ]; options = [ "fmask=0077" "dmask=0077" ]; # only root may read /boot
}; };
fileSystems."/home" = fileSystems."/home" =
{ device = "/dev/disk/by-label/nixhome"; { device = "/dev/disk/by-label/nixhome";
hosts/argon/hardware-configuration.nix
+2 -2
View File
@@ -39,8 +39,8 @@
device = "/dev/disk/by-label/nixboot"; device = "/dev/disk/by-label/nixboot";
fsType = "vfat"; fsType = "vfat";
options = [ options = [
"fmask=0022" "fmask=0077"
"dmask=0022" "dmask=0077"
]; ];
}; };
hosts/krypton/hardware-configuration.nix
+2 -2
View File
@@ -40,8 +40,8 @@
device = "/dev/disk/by-label/nixboot"; device = "/dev/disk/by-label/nixboot";
fsType = "vfat"; fsType = "vfat";
options = [ options = [
"fmask=0022" "fmask=0077"
"dmask=0022" "dmask=0077"
]; ];
}; };
hosts/neon/hardware-configuration.nix
+2 -2
View File
@@ -43,8 +43,8 @@
device = "/dev/disk/by-label/nixboot"; device = "/dev/disk/by-label/nixboot";
fsType = "vfat"; fsType = "vfat";
options = [ options = [
"fmask=0022" "fmask=0077"
"dmask=0022" "dmask=0077"
]; ];
}; };