diff options
| author | sommerfeld <sommerfeld@sommerfeld.dev> | 2026-09-17 15:05:37 +0100 |
|---|---|---|
| committer | sommerfeld <sommerfeld@sommerfeld.dev> | 2026-09-17 15:05:37 +0100 |
| commit | 2f97417d16224ca1f79b2fe41e70b8d7ddc0ab7d (patch) | |
| tree | 95cbecc698a82ef8b9d9d31cbff75be91f7d9005 /etc | |
| parent | dd45f3ad88b544f065f27143801306a7d6dffd02 (diff) | |
| download | dotfiles-2f97417d16224ca1f79b2fe41e70b8d7ddc0ab7d.tar.gz dotfiles-2f97417d16224ca1f79b2fe41e70b8d7ddc0ab7d.tar.bz2 dotfiles-2f97417d16224ca1f79b2fe41e70b8d7ddc0ab7d.zip | |
Configure LXD and AppArmor on the Arch host
Diffstat (limited to 'etc')
| -rw-r--r-- | etc/kernel/cmdline-linux-hardened.tmpl | 2 | ||||
| -rw-r--r-- | etc/kernel/cmdline.tmpl | 2 | ||||
| -rw-r--r-- | etc/nftables.conf | 8 |
3 files changed, 10 insertions, 2 deletions
diff --git a/etc/kernel/cmdline-linux-hardened.tmpl b/etc/kernel/cmdline-linux-hardened.tmpl index be99a9c..674904f 100644 --- a/etc/kernel/cmdline-linux-hardened.tmpl +++ b/etc/kernel/cmdline-linux-hardened.tmpl @@ -1 +1 @@ -rd.luks.name={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=root root=/dev/mapper/root rw quiet mem_sleep_default=s2idle +rd.luks.name={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=root root=/dev/mapper/root rw quiet mem_sleep_default=s2idle apparmor=1 lsm=landlock,lockdown,yama,integrity,apparmor,bpf diff --git a/etc/kernel/cmdline.tmpl b/etc/kernel/cmdline.tmpl index d7512dd..555083a 100644 --- a/etc/kernel/cmdline.tmpl +++ b/etc/kernel/cmdline.tmpl @@ -1 +1 @@ -rd.luks.name={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=root root=/dev/mapper/root rw quiet +rd.luks.name={{ output "lsblk" "-dno" "UUID" (printf "/dev/%s" .luksRootPartition) | trim }}=root root=/dev/mapper/root rw quiet apparmor=1 lsm=landlock,lockdown,yama,integrity,apparmor,bpf diff --git a/etc/nftables.conf b/etc/nftables.conf index fc2d1e7..465c9f7 100644 --- a/etc/nftables.conf +++ b/etc/nftables.conf @@ -15,6 +15,11 @@ table inet filter { meta l4proto { icmp, icmpv6 } accept comment "allow icmp" meta pkttype multicast udp dport 5353 accept comment "allow mDNS discovery" + iifname "lxdbr0" udp dport 53 accept comment "LXD DNS" + iifname "lxdbr0" tcp dport 53 accept comment "LXD DNS" + iifname "lxdbr0" meta nfproto ipv4 udp dport 67 accept comment "LXD DHCPv4" + iifname "lxdbr0" meta nfproto ipv6 udp dport 547 accept comment "LXD DHCPv6" + pkttype host limit rate 5/second counter reject with icmpx type admin-prohibited counter } @@ -22,5 +27,8 @@ table inet filter { type filter hook forward priority filter policy drop + ct state invalid drop + iifname "lxdbr0" accept comment "allow connections from LXD instances" + oifname "lxdbr0" ct state {established, related} accept comment "allow replies to LXD instances" } } |