simon
/
nixos-config
1
1
Fork 0
Code Issues 8 Pull Requests Projects Releases Activity

initrd-ssh: Make /boot only accessible for root

yuzuru2
Simon Bruder 2023-12-31 13:23:20 +01:00
parent c5f5f6a5ca
commit abccb6f9e0
Signed by: simon
GPG Key ID: 8D3C82F9F309F8EC
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
modules/initrd-ssh.nix
View File

@ -32,4 +32,10 @@
];
};
};
# This only works for vfat (EFI),
# for ext2 (MBR) it needs to be changed manually with chmod.
fileSystems."/boot".options = lib.mkIf
(config.boot.initrd.network.ssh.enable && config.fileSystems."/boot".fsType == "vfat")
(lib.mkDefault [ "umask=0077" ]);
}