nixos/hardened: set mmap_min_addr

This is set in the hardened linux config as well but sysctl is more
flexible & works with any boot.kernelPackages

Changed files
+10
nixos
modules
profiles
+10
nixos/modules/profiles/hardened.nix
···
# Note: mmap_rnd_compat_bits may not exist on 64bit.
boot.kernel.sysctl."vm.mmap_rnd_bits" = mkDefault 32;
boot.kernel.sysctl."vm.mmap_rnd_compat_bits" = mkDefault 16;
+
+
# Allowing users to mmap() memory starting at virtual address 0 can turn a
+
# NULL dereference bug in the kernel into code execution with elevated
+
# privilege. Mitigate by enforcing a minimum base addr beyond the NULL memory
+
# space. This breaks applications that require mapping the 0 page, such as
+
# dosemu or running 16bit applications under wine. It also breaks older
+
# versions of qemu.
+
#
+
# The value is taken from the KSPP recommendations (Debian uses 4096).
+
boot.kernel.sysctl."vm.mmap_min_addr" = mkDefault 65536;
}