Security modules

Note

A security module hardens the system, its programs and functionalities.

🔑 darkone.security.complement

Cross-cutting complementary measures — Annex A (C1–C12). (wip)

These measures have no ANSSI number but are essential to the guide’s spirit. Covers linux-hardened patches (C1), Lockdown LSM (C2), USBGuard (C3), nftables deny-by-default (C4), hardened SSH (C5), LUKS2 (C6), NTP/NTS (C7), secure DNS (C8), disabled core dumps (C9), PAM anti brute-force (C10), legal banners (C11), and cron/at restriction (C12).

Activation

The enable option follows darkone.system.security.enable by default. Rules (Rxx/Cxx) are activated based on level, category, and excludes defined in darkone.system.security (via isActive).

Lockdown LSM level (C2)

• none: no Lockdown.
• integrity: forbids kernel modifications via userspace.
• confidentiality: same + forbids reading kernel secrets.

C2 — Lockdown LSM

lockdown=confidentiality forbids kexec, /dev/mem writes, MSR, hibernation. Breaks dmidecode on some zones, flashrom, i2c-tools.

C4 — Egress filtering

The egress deny-by-default policy breaks tools that reach CDNs (curl, kernel downloads). Required: a controlled outbound HTTP(S) proxy.

C5 — Hardened SSH

Tunnels, agent forwarding and X11 are off. ssh -J goes too: ProxyJump opens a direct-tcpip channel, which is exactly what AllowTcpForwarding refuses — admin access is direct over the tailnet, never bounced. This module overrides core.nix for SSH.

• enable bool Enable complementary ANSSI measures (C1–C12).
• lockdownLevel enum [ "none" "integrity" "confidentiality" ] Lockdown LSM level (C2)
• lsmStack listOf str LSM stack order (C2, R11, R20). Modifies boot.kernelParams lsm=…
• ntpServers listOf str NTP/NTS servers (C7).
• useNts bool Enable NTS (Network Time Security) for NTP authentication (C7).
• sshBanner str SSH banner displayed before authentication (C11).
• cronAllowedUsers listOf str Users allowed to schedule cron jobs (C12).
• atAllowedUsers listOf str Users allowed to schedule at jobs (C12). Mirrors cronAllowedUsers by default.
• egressAllowlist listOf str IPv4/IPv6 addresses or CIDRs allowed outbound under the C4 reinforced egress deny-by-default policy. Empty list keeps the policy but only loopback and established/related traffic pass (proxy required).

darkone.security.complement = {
  enable = false;
  lockdownLevel = "integrity";
  lsmStack = [ ];
  ntpServers = [ ];
  useNts = true;
  sshBanner = ''
        ╔═════════════════════════════════════════════════════════╗
        ║                    DNF NETWORK NODE                     ║
        ║             Restricted and monitored access.            ║
        ║ Unauthorized access may result in criminal prosecution  ║
        ║ under Articles 323-1 to 323-8 of the French Penal Code. ║
        ╚═════════════════════════════════════════════════════════╝
      '';
  cronAllowedUsers = [ ];
  atAllowedUsers = [ ];
  egressAllowlist = [ ];
};

---

🔑 darkone.security.filesystem

Partitioning, file tree, and file permissions (R28–R29, R50–R57). (wip)

Covers secure mount options (R28), restriction of /boot (R29), permissions of sensitive files (R50), passwords kept out of the store (R51), sockets (R52), orphan files (R53), sticky bit (R54), per-user temporary directories (R55), and setuid (R56, R57).

Activation

The enable option follows darkone.system.security.enable by default. Rules (Rxx/Cxx) are activated based on level, category, and excludes defined in darkone.system.security (via isActive).

R28 — noexec /tmp

noexec on /tmp blocks execution and dlopen: it breaks installers and compilers running what they unpack (pip, cargo, gcc) and any runtime extracting native libraries there (Bun, Electron, agent tooling). Nix builds are covered — the daemon’s TMPDIR moves to /var/tmp. Opt out per host with darkone.security.filesystem.tmpNoexec = false.

R28 — cross to the hardened /tmp at boot, not at switch

A host already on boot.tmp.useTmpfs carries a static tmp.mount, which this rule replaces with an fstab entry: the switch therefore stops it, and PrivateTmp=yes implies RequiresMountsFor=/tmp, so every such unit goes down with it — dbus-broker included. switch-to-configuration drives systemd over D-Bus, so it loses its own transport mid-run and aborts, every time. Use apply <host> boot and reboot; the tier needs a reboot for boot.kernelParams anyway. Hosts that never used useTmpfs only gain a mount, which is harmless.

R29 — /boot noauto

noauto on /boot requires a manual remount on every NixOS update. A nixos-rebuild wrapper must ensure automatic mount/unmount.

• enable bool Enable ANSSI filesystem hardening (R28–R29, R50–R57).
• allowedSetuid listOf str Allowlist of tolerated setuid/setgid binaries (R56, R57).
• tmpfs bool Whether R28 owns /tmp as a hardened tmpfs sized on boot.tmp.tmpfsSize. Set to false to leave /tmp on the filesystem it already lives on — a host keeping several GB of persistent scratch there loses both the data and the RAM otherwise.
• tmpNoexec bool Whether the R28 /tmp carries noexec. noexec blocks direct execution and dlopen, so it breaks any runtime unpacking native libraries there (Bun, Electron, agent tooling) and anything compiling then running in TMPDIR. Only meaningful when tmpfs is true.
• extraMountHardening listOf str Mount points to harden with nosuid,nodev,noexec (R28). Each listed path MUST be a separate partition declared elsewhere (hardware- configuration / disko); the options are merged into its existing fileSystems entry. An explicit list (rather than a global flag) avoids guessing the layout and never creates phantom mounts. Do not list /home if users run scripts there — noexec would break them.

darkone.security.filesystem = {
  enable = false;
  allowedSetuid = [ ];
  tmpfs = true;
  tmpNoexec = true;
  extraMountHardening = [ ];
};

---

🔑 darkone.security.integrity

Filesystem integrity — HIDS (R76–R77). (wip)

Covers sealing and integrity verification via AIDE (R76) and protection of the sealed database with GPG signature plus remote copy (R77).

Activation

The enable option follows darkone.system.security.enable by default. Rules (Rxx/Cxx) are activated based on level, category, and excludes defined in darkone.system.security (via isActive).

R76 — AIDE

A full scan can take 15–60 min depending on FS size and CPU. Schedule during off-peak hours. Frequent false positives on /etc/resolv.conf, /var/lib, /var/cache — add them to exclusions.

R77 — Signed database

The AIDE database must be re-signed at every major NixOS update (the store changes). Plan a baseline update procedure.

• enable bool Enable ANSSI HIDS integrity — AIDE (R76–R77).
• aideRemoteCopy nullOr submodule Remote copy of the GPG-signed AIDE database (R77). null = disabled.
  • host str Remote host for the AIDE database copy.
  • sshKeyFile path Path to the private SSH key for the remote copy.

darkone.security.integrity = {
  enable = false;
  aideRemoteCopy = null;
  aideRemoteCopy.host = null;
  aideRemoteCopy.sshKeyFile = null;
};

---

🔑 darkone.security.journaling

Logging and auditd (R71–R73). (wip)

Covers persistent logging with TLS forwarding (R71), per-service dedicated journals (R72), and auditd with ANSSI rules (R73).

Activation

The enable option follows darkone.system.security.enable by default. Rules (Rxx/Cxx) are activated based on level, category, and excludes defined in darkone.system.security (via isActive).

R71 — Seal=yes

Seal=yes requires journalctl --setup-keys (out-of-band audit key). Without this key, journal integrity cannot be verified.

R73 — immutable auditd

The configuration audit.rules = [ "-e 2" ] makes auditd immutable: any rule change requires a reboot. Test in staging before deployment.

• enable bool Enable ANSSI logging and auditd (R71–R73).

darkone.security.journaling.enable = false;

---

🔑 darkone.security.kernel-build

Static kernel configuration — requires recompilation (R15–R27). (wip)

These rules require a custom kernel via boot.kernelPackages. NixOS allows this through structuredExtraConfig. All these rules carry the kernel-recompile tag: they are skipped if that tag is in excludes.

Activation

The enable option follows darkone.system.security.enable by default. Rules (Rxx/Cxx) are activated based on level, category, and excludes defined in darkone.system.security (via isActive).

No NixOS binary cache

Enabling these rules implies a local kernel recompilation (~30–60 min per update depending on CPU). No public binary cache covers a custom kernel. Reserve for fleets with proper MCO tooling.

Out-of-tree modules

R18 (signed modules) makes signing any external module mandatory (NVIDIA, ZFS, VirtualBox, v4l2loopback…) via the Nix pipeline.

• enable bool Enable the ANSSI kernel recompilation module (R15–R27).

darkone.security.kernel-build.enable = false;

---

🔑 darkone.security.kernel-params

Dynamic kernel configuration: boot parameters and sysctls (R8–R14). (wip)

Rules applicable without recompiling the kernel. Covers memory options (R8), system sysctls (R9), disabling module loading (R10), Yama/ptrace (R11), IPv4 network sysctls (R12), IPv6 disabling (R13), and filesystem sysctls (R14).

Activation

The enable option follows darkone.system.security.enable by default. Rules (Rxx/Cxx) are activated based on level, category, and excludes defined in darkone.system.security (via isActive).

R8 — SMT disabled

l1tf=full,force, mds=full,nosmt and mitigations=auto,nosmt disable hyperthreading, worth around 30% of multi-threaded throughput — a price a build farm cannot always pay. disableSmt = false keeps the rest of R8.

R8 — the allocator extras replace the wipe ANSSI asks for

page_poison=on takes precedence over init_on_alloc/init_on_free — the kernel says as much at boot — so R8 ships a debug facility where ANSSI asks for a memory wipe, and slub_debug=FZP rides along on every slab cache. memoryDebug = false drops the three and gives init_on_* back; measured at 7% of a compile (95s to 88s, ms-a2, SMT on), so the reason is conformity rather than speed.

R9 — restricting user namespaces is opt-in

kernel.unprivileged_userns_clone is a Debian / linux-hardened key, absent from mainline: writing it fails systemd-sysctl. The mainline equivalent (user.max_user_namespaces = 0) breaks Flatpak, bubblewrap and rootless Podman, hence restrictUserns — off by default.

R12 — reverse path filtering

Strict mode (rp_filter = 1) drops any asymmetric return path. A tailscale subnet router advertising routes with --snat-subnet-routes=false is exactly that case, so routers fall back to loose mode (2). So does a gateway with backup links: probe replies arrive on a link that is not the preferred route.

R10 — Modules disabled

Any new device requiring a module not pre-loaded needs a reboot. Mutually exclusive with nixos-rebuild switch on the driver side.

• enable bool Enable ANSSI dynamic kernel parameters (R8–R14).
• restrictUserns bool R9: forbid unprivileged user namespaces (user.max_user_namespaces). Breaks Flatpak, bubblewrap and rootless Podman, so it stays opt-in and belongs on servers that run none of them.
• disableSmt bool R8: turn hyperthreading off. Three parameters carry it; false falls each back to its SMT-preserving form and leaves the other fourteen alone. Note l1tf=full drops SMT even without force — it only leaves the sysfs knob behind — so the fallback there is flush.
• memoryDebug bool R8: the allocator extras — slub_debug=FZP, page_poison=on and slab_nomerge=yes. None of the three is in the ANSSI R8 list, and page_poison displaces init_on_alloc/init_on_free, which are: the kernel says so at boot, and honours the debug facility instead. Turning it off restores the specified wipe and gives back 7% of a compile (95s to 88s, ms-a2, SMT on).
• disableIpv6 bool R13: disable IPv6 entirely. Off by default — ANSSI itself prefers hardening IPv6 over dropping it, and a public host generally needs it.

darkone.security.kernel-params = {
  enable = false;
  restrictUserns = false;
  disableSmt = true;
  memoryDebug = true;
  disableIpv6 = false;
};

---

🔑 darkone.security.mac

Mandatory Access Control — MAC (R37, R45–R49). (wip)

R37 is a meta rule: valid if at least R45 (AppArmor) or R46 (SELinux) is active. SELinux (R46–R49) is not supported on NixOS and is excluded by default via exceptions. AppArmor (R45) is partially supported.

Sandboxing

When MAC is unavailable, NixOS often relies on systemd options (systemd sandboxing) to isolate services.

NixOS and MAC

SELinux is structurally unsupported on NixOS (R46–R49 are exceptions by default). AppArmor is available but with few ready-to-use profiles. The absence of a profile for an exposed service is a false sense of security.

Activation

The enable option follows darkone.system.security.enable by default. Rules (Rxx/Cxx) are activated based on level, category, and excludes defined in darkone.system.security (via isActive).

Tag no-mac

Use the no-mac tag in excludes to disable R37 and R45 with an explicit justification in exceptions.R37.rationale.

• enable bool Enable ANSSI MAC module — AppArmor/SELinux (R37, R45–R49).

darkone.security.mac.enable = false;

---

🔑 darkone.security.mta

Local mail handling (R74–R75). (wip)

Covers the local MTA hardened to loopback-only (R74) and mail aliases routed to the administrator’s address (R75). These rules only apply if an MTA service is active (Postfix or OpenSMTPD).

Activation

The enable option follows darkone.system.security.enable by default. Rules (Rxx/Cxx) are activated based on level, category, and excludes defined in darkone.system.security (via isActive).

• enable bool Enable ANSSI MTA hardening (R74–R75).

darkone.security.mta.enable = false;

---

🔑 darkone.security.network

Network services — isolation and supervision (R78–R80). (wip)

Covers isolation of network services (R78: server category), hardening and monitoring of exposed services (R79: fail2ban, HTTP headers, ANSSI TLS) and reduction of the network surface (R80).

Activation

The enable option follows darkone.system.security.enable by default. Rules (Rxx/Cxx) are activated based on level, category, and excludes defined in darkone.system.security (via isActive).

R79 — Strict CSP

Content-Security-Policy: default-src 'self' breaks tools without nonces (dashboards with CDN, third-party widgets). HSTS preload is irreversible — only set on a fully controlled domain.

R79 — nginx headers are opt-in per vhost

add_header replaces the parent set instead of adding to it, so a global block is dropped by the first vhost or location declaring a header of its own — and gixy fails the build over the shadowing. The set therefore ships as /etc/nginx/dnf-security-headers.conf, to include from the vhost’s own extraConfig. Only the TLS directives stay global.

R79 — Every jail needs a filter

fail2ban runs on the systemd backend here: a jail needs both a filter.d definition and a journalmatch, or it aborts the whole daemon at startup — losing the working sshd jail. exposedServices is therefore asserted against filters; caddy, matrix and idm still need theirs written.

R80 — Listener filtering

Some services (KDE Connect, mDNS) listen by default on all interfaces. Declare them in network.publicListeners or reconfigure them.

• enable bool Enable ANSSI network hardening (R78–R80).
• exposedServices listOf str Public services to jail with fail2ban (R79). Each entry MUST resolve to a filter — one shipped by fail2ban, or one declared in filters — or the assertion refuses the build.
• filters attrs Filters usable in exposedServices, on top of those fail2ban ships. Caddy, Synapse and Kanidm need theirs written against real journal output — declare them here once the patterns are confirmed.
  • journalmatch str Journal match for the jail (fail2ban runs on the systemd backend).
  • failregex str Failure pattern, written to filter.d/<name>.conf. Empty when fail2ban already ships the filter and only the match is missing.
• publicListeners listOf str Services allowed to listen on 0.0.0.0 / :: (R80).
• httpsHeaders bool Adds ANSSI HTTP security headers in Nginx/Caddy (R79).
• tlsCiphers listOf str ANSSI TLS cipher suite for Nginx (R79).

darkone.security.network = {
  enable = false;
  exposedServices = [ ];
  filters.journalmatch = "_SYSTEMD_UNIT=forgejo.service";
  filters.failregex = "";
  publicListeners = [ ];
  httpsHeaders = true;
  tlsCiphers = [ ];
};

---

🔑 darkone.security.nss

NSS — Remote user databases (R69–R70). (wip)

Rules applicable only if an external NSS is active (SSSD, nslcd). Not currently relevant for DNF; see what can be done with Kanidm + PAM.

Covers hardening of remote databases (R69: TLS mandatory) and separation of system and directory accounts (R70).

Activation

The enable option follows darkone.system.security.enable by default. Rules (Rxx/Cxx) are activated based on level, category, and excludes defined in darkone.system.security (via isActive).

• enable bool Enable ANSSI NSS hardening (R69–R70).

darkone.security.nss.enable = false;

---

🔑 darkone.security.packages

Package management and updates (R58–R61). (wip)

Covers installing only what is strictly necessary (R58), trusted repositories (R59), hardened repositories (R60: linux_hardened), and regular updates (R61).

Activation

The enable option follows darkone.system.security.enable by default. Rules (Rxx/Cxx) are activated based on level, category, and excludes defined in darkone.system.security (via isActive).

R59 — allow-import-from-derivation=false

Breaks some complex flakes (Haskell, heavy Python with Nix generators). Document exceptions in nix.settings.

R60 — linux_hardened

The linux_hardened kernel may lag a minor version behind nixpkgs-unstable. Third-party modules (NVIDIA, ZFS) are not guaranteed compatible.

• enable bool Enable ANSSI package management (R58–R61).
• trustedSubstituters listOf str Allowlist of authorized Nix binary caches (R59).
• trustedPublicKeys listOf str Public keys for authorized binary caches (R59).
• allowedUris listOf str Prefix allowlist of URIs fetchable during evaluation (R59). Restricts builtins.fetch* / flake inputs to internal mirrors. Empty list disables the restriction.
• maxSystemPackages nullOr int Soft threshold on the number of system packages (R58). Emits an evaluation warning when exceeded; null disables the check.

darkone.security.packages = {
  enable = false;
  trustedSubstituters = [ ];
  trustedPublicKeys = [ ];
  allowedUris = [ ];
  maxSystemPackages = 200;
};

---

🔑 darkone.security.pam

PAM — Authentication and password storage (R67–R68). (wip)

Covers secure remote PAM authentication (R67: SSSD, Kerberos, pam_faillock) and encrypted password storage (R68: yescrypt).

Activation

The enable option follows darkone.system.security.enable by default. Rules (Rxx/Cxx) are activated based on level, category, and excludes defined in darkone.system.security (via isActive).

Complements

pam_faillock (anti brute-force) is configured here for R67; complement.nix (C10) only sets session limits. The complexity policy (R31) is in users.nix.

R67 — pam_faillock locks accounts for real

Three failed passwords lock the account for 15 minutes by default, on login, su, sudo and — through the login substack — the GNOME greeter. Keep a root session open when first deploying it, and know the way back: faillock --user <login> --reset. SSH is deliberately spared so that a key-based rescue session always stays open.

• enable bool Enable ANSSI PAM module — authentication and passwords (R67–R68).
• faillock.deny ints.positive Failed attempts before pam_faillock locks the account (R67).
• faillock.unlockTime ints.positive Seconds an account stays locked (R67). Unlock early with faillock --reset.

darkone.security.pam = {
  enable = false;
  faillock.deny = 3;
  faillock.unlockTime = 900;
};

---

🔑 darkone.security.preboot

Hardware configuration and secure boot (R1–R7). (wip)

Covers UEFI Secure Boot (R3), lanzaboote, bootloader password (R5), signed UKIs (R6), and IOMMU (R7). R1 and R2 (hardware/firmware) are out of NixOS scope and only produce a note in the report.

Activation

The enable option follows darkone.system.security.enable by default. Rules (Rxx/Cxx) are activated based on level, category, and excludes defined in darkone.system.security (via isActive).

R3/R4 — Secure Boot

The lanzaboote integration requires an initial physical key enrollment (sbctl enroll-keys). R4 (replacing Microsoft keys) carries a bricking risk if the machine does not allow restoration.

R7 — IOMMU

May cause crashes with some GPUs/Thunderbolt; I/O overhead ~5–15% on very high-throughput NVMe arrays.

• enable bool Enable ANSSI secure boot — Secure Boot, IOMMU (R1–R7).

darkone.security.preboot.enable = false;

---

🔑 darkone.security.services

Hardening of systemd services (R62–R66). (wip)

Covers disabling unnecessary services (R62), reducing functionality via systemd security options (R63), privilege restriction (R64), isolation (R65), and hardening of containerization components (R66).

Activation

The enable option follows darkone.system.security.enable by default. Rules (Rxx/Cxx) are activated based on level, category, and excludes defined in darkone.system.security (via isActive).

R63 — MemoryDenyWriteExecute

Breaks JIT runtimes (Java, V8, .NET, LuaJIT, Wasm). Use the needs-jit tag in excludes or exclude the service individually.

R66 — Docker userns-remap

Breaks host-to-container bind-mounts (UID shift). Migration of existing volumes required before enabling.

• enable bool Enable ANSSI hardening of systemd services (R62–R66).
• rootServicesAllowed listOf str systemd services allowed to run as root without CapabilityBoundingSet (R64).
• hardenedUnits listOf str systemd units to which the ANSSI hardening baseline is applied (R52 RuntimeDirectoryMode, R55 PrivateTmp, R63 full sandbox via dnfLib.mkHardenedServiceConfig). Empty by default: blanket sandboxing can break services that need write access or extra syscalls, so units are opt-in. List framework-owned units known to tolerate confinement; per-unit serviceConfig overrides still win.

darkone.security.services = {
  enable = false;
  rootServicesAllowed = [ ];
  hardenedUnits = [ ];
};

---

🔑 darkone.security.sudo

sudo hardening (R38–R44). (wip)

Covers the dedicated sudo group (R38), hardened sudo directives (R39), restriction of non-root targets (R40), NOEXEC limitation (R41), forbidding negations (R42), explicit argument specification (R43), and use of sudoedit (R44).

Activation

The enable option follows darkone.system.security.enable by default. Rules (Rxx/Cxx) are activated based on level, category, and excludes defined in darkone.system.security (via isActive).

R39 — noexec and requiretty dropped

Both are incompatible with an agent-driven deployment: colmena escalates with sudo -H -- over SSH (no PTY, so requiretty refuses), and switch-to-configuration spawns children (so noexec blocks it). Accountability rests on use_pty + log_input/log_output instead.

R39 — rootpw

rootpw forces a root password shared between admins. Prefer targetpw or runaspw based on team policy.

• enable bool Enable ANSSI sudo hardening (R38–R44).
• allowedRootRules listOf str sudo rules allowed to target root (R40). Others must target a service account.

darkone.security.sudo = {
  enable = false;
  allowedRootRules = [ ];
};

---

🔑 darkone.security.users

User accounts and authentication (R30–R36). (wip)

Covers unused accounts (R30), password policy (R31), inactivity locking (R32), admin accountability (R33), service accounts (R34), unique service accounts (R35), and umask (R36).

Activation

The enable option follows darkone.system.security.enable by default. Rules (Rxx/Cxx) activate according to level, category, and excludes defined in darkone.system.security (via isActive).

R30 — mutableUsers=false

NixOS no longer allows ad-hoc passwd/useradd. Any account change requires a full NixOS deployment (colmena apply).

R36 — umask 0077

Breaks group collaboration (/srv/share). Document that chmod g+rwx <file> is required for group sharing.

• enable bool Enable ANSSI account management (R30–R36).
• idleTimeout ints.unsigned Seconds before an idle login shell exits (R32, TMOUT). 0 drops the TTY timeout entirely; the GNOME idle lock is unaffected. Workstations holding long-lived terminals (build farm, agent tooling) set 0.

darkone.security.users = {
  enable = false;
  idleTimeout = 600;
};

---