change /boot permissions so random-seed won't be accessible

adomixaszvers · Dec 20, 2024 · 567c4da · 567c4da
1 parent 9ee64ab
commit 567c4da
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 2 deletions.
diff --git a/nixos/m75s/hardware-configuration.nix b/nixos/m75s/hardware-configuration.nix
@@ -55,8 +55,7 @@
     device = "/dev/disk/by-uuid/9D0A-EF86";
     fsType = "vfat";
     options = [
-      "fmask=0022"
-      "dmask=0022"
+      "umask=077"
     ];
   };
 

diff --git a/nixos/pc/hardware-configuration.nix b/nixos/pc/hardware-configuration.nix
@@ -31,6 +31,9 @@
   fileSystems."/boot" = {
     device = "/dev/disk/by-uuid/2EF0-B6A1";
     fsType = "vfat";
+    options = [
+      "umask=077"
+    ];
   };
 
   fileSystems."/nix" = {

diff --git a/nixos/t14/hardware-configuration.nix b/nixos/t14/hardware-configuration.nix
@@ -35,6 +35,9 @@
   fileSystems."/boot" = {
     device = "/dev/disk/by-label/NIXOS-BOOT";
     fsType = "vfat";
+    options = [
+      "umask=077"
+    ];
   };
 
   fileSystems."/var/lib/libvirt" = {

diff --git a/nixos/work/hardware-configuration.nix b/nixos/work/hardware-configuration.nix
@@ -31,6 +31,9 @@
   fileSystems."/boot" = {
     device = "/dev/disk/by-uuid/2641-D99C";
     fsType = "vfat";
+    options = [
+      "umask=077"
+    ];
   };
 
   fileSystems."/home" = {