Security rule catalog

This page summarizes which ANSSI rules are activated, according to the level and category of a host. It is the reference to consult before hardening a machine.

Reminder: level and category

darkone.system.security = {
  enable   = true;
  level    = "intermediary";   # minimal | intermediary | reinforced | high
  category = "server";         # base | client | server
};

Levels are cumulative: intermediary adds its rules to those of minimal, and so on. The category adds the rules specific to a workstation (client) or a server (server).

Recommended category per profile

Profile	Recommended category	Why
`minimal`, `portable`	`base`	Universal base
`desktop`, `laptop`	`client`	Screen, USB, interactive session
`server`, `gateway`, `hcs`, `vm`	`server`	Exposed services, network

Comparison table by level

Each column shows the rule’s state at that level (levels being cumulative). Legend:

Icon	Meaning
✅	Active at this level
⚠️	Partial (see note)
❌	Not yet active at this level

Boot and hardware

Code	Rule	Min	Inter	Rein	High
`R3`	UEFI Secure Boot (if supported)	❌	⚠️	⚠️	⚠️
`R5`	Bootloader password	❌	⚠️	⚠️	⚠️
`C6`	LUKS2 disk encryption	❌	⚠️	⚠️	⚠️
`R7`	IOMMU enabled	❌	❌	✅	✅
`R29`	`/boot` restricted	❌	❌	✅	✅
`R6`	cmdline and initramfs protection	❌	❌	❌	✅

Kernel

Code	Rule	Min	Inter	Reinforced	Elevated
`R8`	Memory options on the command line	❌	✅	✅	✅
`R9`	Hardening sysctls	❌	✅	✅	✅
`R11`	Yama: restricted `ptrace`	❌	✅	✅	✅
`R10`	Module loading disabled	❌	❌	✅	✅
`R60`	`linux_hardened` kernel	❌	❌	✅	✅
`C1`	linux-hardened patches	❌	❌	❌	✅
`C2`	LSM Lockdown	❌	❌	❌	✅
`R15`–`R27`	Compile-time hardening	❌	❌	❌	✅

Accounts and Authentication

Code	Rule	Min	Inter	Reinforced	Elevated
`R30`	Unused accounts disabled	✅	✅	✅	✅
`R31`	Strong passwords	✅	✅	✅	✅
`R68`	Password storage in `yescrypt`	✅	✅	✅	✅
`R32`	Idle session lockout	❌	✅	✅	✅
`R33`	Admin action audit trail	❌	✅	✅	✅
`R34`	Service accounts without shell	❌	✅	✅	✅
`R35`	Unique service accounts	❌	✅	✅	✅
`R67`	Secure remote PAM	❌	⚠️	⚠️	⚠️
`R69`	User databases over TLS	❌	⚠️	⚠️	⚠️
`R70`	System accounts ≠ directory	❌	⚠️	⚠️	⚠️
`C10`	Session limits (`nproc`, `nofile`)	❌	✅	✅	✅

R67: pam_faillock truly locks accounts

Three incorrect passwords lock the account for 15 minutes on login, su, sudo, and through the login stack, the GNOME lock screen. The stack is complete: preauth rejects, authfail counts, the account rule blocks an already locked account. The two auth rules bracket the pam_unix for each service; their rank is calculated as it differs from one stack to another (11700 on su/sudo, 13100 on login).

sshd is intentionally excluded: DNF prohibits password authentication, so faillock would never count anything there. Its account rule could only reject a backup key session for a lock acquired at the console. Maintenance access therefore remains open under all circumstances, and nix (without password credentials) cannot be locked.

Keep a root session open during the initial deployment and know the recovery command: faillock --user <login> --reset. Settings: darkone.security.pam.faillock.deny and .unlockTime. root is never locked.

Admin Privileges (sudo)

Code	Rule	Min	Inter	Reinforced	Elevated
`R39`	Hardened `sudo` directives	❌	✅	✅	✅
`R40`	Non-root `sudo` targets	❌	✅	✅	✅
`R42`	Deny list prohibition	❌	✅	✅	✅
`R44`	`sudoedit` for editing	❌	✅	✅	✅
`R38`	Dedicated `sudo` group	❌	❌	✅	✅
`R41`	`NOEXEC` override restrictions	❌	❌	✅	✅

Files and Permissions

Code	Rule	Min	Inter	Reinforced	Elevated
`R53`	Detection of unowned files	✅	✅	✅	✅
`R54`	Sticky bit on `/tmp` and `/var/tmp`	✅	✅	✅	✅
`R56`	Detection of `setuid` outside allowlist	✅	✅	✅	✅
`R14`	Filesystem sysctls	❌	✅	✅	✅
`R28`	Partitioning and mount options	❌	✅	✅	✅
`R50`	Sensitive file restrictions	❌	✅	✅	✅
`R52`	Socket and named pipe permissions	❌	⚠️	⚠️	⚠️
`R55`	Per-user temporary directories	❌	⚠️	⚠️	⚠️
`R36`	`UMASK` 0077	❌	❌	✅	✅
`R57`	Minimal root `setuid` (capabilities)	❌	❌	✅	✅

R28: /tmp non-executable

/tmp is a tmpfs with nosuid,nodev,noexec, sized via boot.tmp.tmpfsSize (25% of RAM by default). R28 owns the mount: boot.tmp.useTmpfs is forced to false, otherwise the tmp.mount unit it generates — without noexec — would silently override /etc/fstab.

noexec forbids direct execution and dlopen. It therefore breaks any tool that executes what it just decompressed (pip, cargo, gcc) and any runtime that extracts its native libraries into /tmp (Bun, Electron, agent tools). Nix builds are covered, the daemon switching to /var/tmp, but an interactive tool may require export TMPDIR=$XDG_RUNTIME_DIR.

Two fallback options per host:

Option	Effect
`darkone.security.filesystem.tmpNoexec = false`	keeps the tmpfs with `nosuid,nodev`, removes `noexec`
`darkone.security.filesystem.tmpfs = false`	leaves `/tmp` on its original filesystem (persistent data, no RAM consumed)

Services and confinement

Code	Rule	Min	Inter	Rein	High
`R62`	Obsolete services disabled	✅	✅	✅	✅
`R63`	Reduced service capabilities	❌	⚠️	⚠️	⚠️
`R37`	Mandatory access control (MAC)	❌	❌	✅	✅
`R45`	AppArmor profiles	❌	❌	✅	✅
`R64`	Restricted service privileges	❌	❌	✅	✅
`R65`	Service isolation (namespaces)	❌	❌	✅	✅
`R66`	Container hardening	❌	❌	❌	✅

Network

Code	Rule	Min	Inter	Reinforced	High
`R80`	Listening ports monitoring	✅	✅	✅	✅
`C4`	Firewall default-deny	⚠️	⚠️	✅	✅
`R12`	IPv4 network sysctls	❌	✅	✅	✅
`R13`	Disabling IPv6 (on request)	❌	⚠️	⚠️	⚠️
`C5`	OpenSSH hardening	❌	✅	✅	✅
`C7`	NTS time synchronization	❌	✅	✅	✅
`C8`	Secure DNS resolver (DNSSEC, DoT)	❌	✅	✅	✅
`R79`	Hardened exposed services (server)	❌	✅	✅	✅
`R78`	Network service isolation (server)	❌	❌	✅	✅

Logs and integrity

Code	Rule	Min	Inter	Renf	High
`R71`	Persisting sealed logging	❌	❌	✅	✅
`R72`	Dedicated logs per service	❌	❌	✅	✅
`R73`	auditd with ANSSI rules	❌	❌	✅	✅
`C9`	Core dumps disabled	❌	❌	✅	✅
`R76`	Sealing and integrity verification	❌	❌	❌	✅
`R77`	Sealed base protection	❌	❌	❌	✅

System and miscellaneous

Code	Rule	Min	Inter	Hard	High
`C11`	Legal access banners	✅	✅	✅	✅
`C12`	`cron` / `at` restricted	✅	✅	✅	✅
`R61`	Regular updates	⚠️	⚠️	⚠️	⚠️
`R74`	Hardened local mail	❌	✅	✅	✅
`R75`	Mail alias (`root` → admin)	❌	✅	✅	✅
`R51`	Installation secret rotation	❌	❌	✅	✅
`C3`	USBGuard (workstation)	❌	❌	✅	✅

Adjusting Without Breaking Everything

Three levers allow fine-tuning a specific protection without lowering the global level.

Tags (excludes): disable a group of incompatible rules (e.g. needs-jit, needs-binfmt).
Exceptions (exceptions): bypass a single rule, with mandatory justification.
Activation options: enable a rule too destructive to be active by default (disableIpv6, restrictUserns).

The details of these levers are in Security Concepts.