···

       
17
       
17
       
 
       
  };

     

       
18
       
18
       
 
       


     

       
19
       
19
       
 
       
  config = mkIf config.security.lockKernelModules {

     

       
20
       
20
       
+
       
    boot.kernelModules = concatMap (x:

     

       
21
       
21
       
+
       
      if x.device != null

     

       
22
       
22
       
+
       
        then

     

       
23
       
23
       
+
       
          if x.fsType == "vfat"

     

       
24
       
24
       
+
       
            then [ "vfat" "nls-cp437" "nls-iso8859-1" ]

     

       
25
       
25
       
+
       
            else [ x.fsType ]

     

       
26
       
26
       
+
       
        else []) config.system.build.fileSystems;

     

       
27
       
27
       
+
       


     

       
20
       
28
       
 
       
    systemd.services.disable-kernel-module-loading = rec {

     

       
21
       
29
       
 
       
      description = "Disable kernel module loading";

     

       
22
       
30