94ab6043e7
Add the files that land in the image, organised as layered rootfs trees (base first, then the edition layer wins on conflict). - base: hardened kernel cmdline + sysctl, default-deny nftables, key-only ssh, persistent journald, module blacklist, no core dumps, snapshot timer units, motd. - server: Prometheus + auto-provisioned Grafana + Loki + promtail. - workstation: dev profile and desktop sysctl relaxations (perf, rootless containers). - cloud: cloud-init provisioning config.
19 lines
565 B
Plaintext
19 lines
565 B
Plaintext
# Arcline OS — disabled kernel modules
|
|
# Modules that add attack surface without being needed on the base system.
|
|
# The workstation edition keeps most of these disabled too; hardware you
|
|
# actually use can be re-enabled per-module.
|
|
|
|
# exotic / historically-risky network protocols
|
|
blacklist sctp
|
|
blacklist dccp
|
|
blacklist rds
|
|
blacklist tipc
|
|
|
|
# unneeded legacy filesystems (mountable by a user with local access)
|
|
install cramfs /bin/false
|
|
install freevxfs /bin/false
|
|
install jffs2 /bin/false
|
|
install hfs /bin/false
|
|
install hfsplus /bin/false
|
|
install udf /bin/false
|