linux-hardened/linux-hardened.nix

pkgs: { arch, config, firmware }:
let
  inherit (pkgs)
    lib
    buildEnv
    buildLinux
    fetchFromGitHub
    gccStdenv
    runCommand;

  kernel = let
    args = {
      inherit (pkgs) lib hostPlatform;
    };

    firmwareEnv = buildEnv {
      name = "linux-firmware";
      pathsToLink = [ "/lib/firmware" ];
      paths = with pkgs; [
        linux-firmware
        sof-firmware
        wireless-regdb
      ];
    };
  in buildLinux rec {
      pname = "linux-hardened";
      version = "6.10.4-hardened1";

      src = fetchFromGitHub {
        owner = "anthraxx";
        repo = pname;
        rev = "v${version}";
        hash = "sha256-qq2vmrUIYUuXEwuZoXrXbZY/li+ReFNuqhsy1R0yx0s=";
      };

      defconfig = "allnoconfig";
      extraMakeFlags = [ "KCFLAGS=-march=${arch}" ];
      enableCommonConfig = false;

      structuredExtraConfig =
        (import ./base.nix args) //
        (import config args) //
        lib.optionalAttrs (firmware != [ ]) {
          EXTRA_FIRMWARE = lib.kernel.freeform (toString firmware);
          EXTRA_FIRMWARE_DIR = lib.kernel.freeform "${firmwareEnv}/lib/firmware";
        };

      features = {
        efiBootStub = true;
      };

      isHardened = true;
      stdenv = gccStdenv;
    };
in kernel.overrideAttrs (base: {
  installFlags = base.installFlags or [ ] ++ [ "INSTALL_MOD_PATH=$(out)" ];

  postInstall = ''
    if [ -z "''${dontStrip-}" ]; then
      installFlagsArray+=( "INSTALL_MOD_STRIP=1" )
    fi

    make modules_install $makeFlags "''${makeFlagsArray[@]}" \
      $installFlags "''${installFlagsArray[@]}"

    depmod -b $out ${base.version}
    touch $out/lib/modules/${base.version}/modules.order
  '';
})