feat(lynis): declare 'lynis' module (with profile + skips)

modules/hardening/default.nix

@@ -6,6 +6,12 @@
 }:
 
 let
+  unusedProtocols = [
+    "dccp"
+    "sctp"
+    "rds"
+    "tipc"
+  ];
   wakeOnLan = lib.any (iface: iface.wakeOnLan.enable) (lib.attrValues config.networking.interfaces);
   randomMac = config.host.role == "laptop" && !wakeOnLan;
   desktop = {
@@ -79,12 +85,8 @@ in
         message = "no 'hardening.profile' for `${config.host.role}` host role";
       }
     ];
-    boot.blacklistedKernelModules = [
-      "dccp"
-      "sctp"
-      "rds"
-      "tipc"
-    ];
+    boot.blacklistedKernelModules = unusedProtocols;
+    boot.extraModprobeConfig = lib.concatMapStrings (m: "install ${m} /bin/false\n") unusedProtocols;
     hardware.bluetooth.settings.General = lib.mkIf config.hardware.bluetooth.enable {
       PairableTimeout = 30;
       DiscoverableTimeout = 30;

modules/lynis/default.nix

@@ -0,0 +1,63 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  serverRoles = [
+    "server"
+    "embedded"
+  ];
+  server = lib.elem config.host.role serverRoles;
+  role = if server then "server" else "personal";
+  forwarding = lib.elem (config.boot.kernel.sysctl."net.ipv4.conf.all.forwarding" or false) [
+    true
+    1
+    "1"
+  ];
+in
+{
+  options.lynis = {
+    enable = lib.mkOption {
+      default = false;
+      type = lib.types.bool;
+    };
+    skipTests = lib.mkOption {
+      default = [
+        "AUTH-9230"
+        "AUTH-9262"
+        "AUTH-9284"
+        "AUTH-9286"
+        "FILE-6310"
+        "FILE-6410"
+        "FINT-4350"
+        "KRNL-5830"
+        "NAME-4028"
+        "PKGS-7398"
+        "SSH-7408"
+        "TOOL-5002"
+      ]
+      ++ lib.optionals (!server) [
+        "ACCT-9622"
+        "ACCT-9626"
+        "ACCT-9628"
+        "HRDN-7222"
+        "HRDN-7230"
+        "KRNL-6000:kernel.modules_disabled"
+        "LOGG-2154"
+        "USB-1000"
+      ]
+      ++ lib.optional forwarding "KRNL-6000:net.ipv4.conf.all.forwarding";
+      type = lib.types.listOf lib.types.str;
+    };
+  };
+
+  config = lib.mkIf config.lynis.enable {
+    environment.systemPackages = [ pkgs.lynis ];
+    environment.etc."lynis/custom.prf".text = lib.concatLines (
+      [ "machine-role=${role}" ] ++ map (t: "skip-test=${t}") config.lynis.skipTests
+    );
+  };
+}