···

       
223
       
223
       
 
       
  krb5 = discoverTests (import ./krb5 {});

     

       
224
       
224
       
 
       
  ksm = handleTest ./ksm.nix {};

     

       
225
       
225
       
 
       
  kubernetes = handleTestOn ["x86_64-linux"] ./kubernetes {};

     

       
226
       
226
       
-
       
  latestKernel.hardened = handleTest ./hardened.nix { latestKernel = true; };

     

       
227
       
226
       
 
       
  latestKernel.login = handleTest ./login.nix { latestKernel = true; };

     

       
228
       
227
       
 
       
  leaps = handleTest ./leaps.nix {};

     

       
229
       
228
       
 
       
  libreddit = handleTest ./libreddit.nix {};

     

···

       
1
       
1
       
-
       
import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... } : {

     

       
1
       
1
       
+
       
import ./make-test-python.nix ({ pkgs, ... } : {

     

       
2
       
2
       
 
       
  name = "hardened";

     

       
3
       
3
       
 
       
  meta = with pkgs.lib.maintainers; {

     

       
4
       
4
       
 
       
    maintainers = [ joachifm ];

     
···

       
10
       
10
       
 
       
    { users.users.alice = { isNormalUser = true; extraGroups = [ "proc" ]; };

     

       
11
       
11
       
 
       
      users.users.sybil = { isNormalUser = true; group = "wheel"; };

     

       
12
       
12
       
 
       
      imports = [ ../modules/profiles/hardened.nix ];

     

       
13
       
13
       
-
       
      boot.kernelPackages =

     

       
14
       
14
       
-
       
        lib.mkIf latestKernel pkgs.linuxPackages_latest_hardened;

     

       
15
       
13
       
 
       
      environment.memoryAllocator.provider = "graphene-hardened";

     

       
16
       
14
       
 
       
      nix.useSandbox = false;

     

       
17
       
15
       
 
       
      virtualisation.emptyDiskImages = [ 4096 ];