base/mitigations: blacklist modules for copyfail and pintheft

base/mitigations.nix

@@ -1,17 +1,24 @@
-{ ... }:
+{ pkgs, lib, ... }:
+let
+  modulesToBan = [
+    # copy.fail
+    "af_alg"
+    "algif_aead"
+    "algif_hash"
+    "algif_rng"
+    "algif_skcipher"
 
-{
+    # dirtyfrag / Fragnesia
-  boot.blacklistedKernelModules = [
+    "esp4"
-  "rxrpc" # dirtyfrag
+    "esp6"
-  "esp6" # dirtyfrag
+    "rxrpc"
-  "esp4" # dirtyfrag
+
+    # PinTheft
+    "rds"
   ];
-boot.extraModprobeConfig = ''
+in
-  # dirtyfrag
+{
-  install esp4 /bin/false
+  boot.blacklistedKernelModules = modulesToBan;
-  # dirtyfrag
+
-  install esp6 /bin/false
+  boot.extraModprobeConfig = lib.concatMapStringsSep "\n" (mod: "install ${mod} ${lib.getExe' pkgs.coreutils "false"}") modulesToBan;
-  # dirtyfrag
-  install rxrpc /bin/false
-'';
 }