···9495 system.build.netbootIpxeScript = pkgs.writeTextDir "netboot.ipxe" ''
96 #!ipxe
97+ # Use the cmdline variable to allow the user to specify custom kernel params
98+ # when chainloading this script from other iPXE scripts like netboot.xyz
99+ kernel ${pkgs.stdenv.hostPlatform.linux-kernel.target} init=${config.system.build.toplevel}/init initrd=initrd ${toString config.boot.kernelParams} ''${cmdline}
100 initrd initrd
101 boot
102 '';
···462 SECURITY_SELINUX_BOOTPARAM_VALUE = whenOlder "5.1" (freeform "0"); # Disable SELinux by default
463 # Prevent processes from ptracing non-children processes
464 SECURITY_YAMA = option yes;
000465 DEVKMEM = whenOlder "5.13" no; # Disable /dev/kmem
466467 USER_NS = yes; # Support for user namespaces
···462 SECURITY_SELINUX_BOOTPARAM_VALUE = whenOlder "5.1" (freeform "0"); # Disable SELinux by default
463 # Prevent processes from ptracing non-children processes
464 SECURITY_YAMA = option yes;
465+ # The goal of Landlock is to enable to restrict ambient rights (e.g. global filesystem access) for a set of processes.
466+ # This does not have any effect if a program does not support it
467+ SECURITY_LANDLOCK = whenAtLeast "5.13" yes;
468 DEVKMEM = whenOlder "5.13" no; # Disable /dev/kmem
469470 USER_NS = yes; # Support for user namespaces