<![CDATA[While #NixOS should not be affected by #CopyFail as it uses recent kernels, here are additional fixes you can apply:]]>While should not be affected by as it uses recent kernels, here are additional fixes you can apply:

Disabling setuid does not mitigate it, but reduces the attack surfaces overall significantly.

Instead of , , and other binaries you can use or a dedicated root account.

I have disabled setuid for a bunch of binaries I don't need, they still work when ran as root, with run0 or -rs.

```nix
boot.blacklistedKernelModules = [
"algif_aead"
];

security.sudo.enable = false;

security.wrappers = {
su.enable = false;
pkexec.enable = false;

# example setuid binary
chsh = {
source = "${pkgs.shadow}/bin/chsh";
setuid = lib.mkForce false;
owner = "root";
group = "root";
};
};
```

]]>https://board.circlewithadot.net/topic/30b8b80a-4e6d-48a7-8b1b-cc0645f067ab/while-nixos-should-not-be-affected-by-copyfail-as-it-uses-recent-kernels-here-are-additional-fixes-you-can-applyRSS for NodeThu, 14 May 2026 22:32:44 GMTFri, 01 May 2026 13:15:21 GMT60<![CDATA[Reply to While #NixOS should not be affected by #CopyFail as it uses recent kernels, here are additional fixes you can apply: on Fri, 01 May 2026 14:22:41 GMT]]>@marie @Rhababerbarbar Also, almost no one is going to be running the vulnerable kernel module anyways unless they compiled a monolithic kernel so..., yeah, feels pretty overblown to me.

]]>https://board.circlewithadot.net/post/https://social.zerojay.com/users/jay/statuses/116499766419396690https://board.circlewithadot.net/post/https://social.zerojay.com/users/jay/statuses/116499766419396690Fri, 01 May 2026 14:22:41 GMT<![CDATA[Reply to While #NixOS should not be affected by #CopyFail as it uses recent kernels, here are additional fixes you can apply: on Fri, 01 May 2026 13:27:20 GMT]]>@Rhababerbarbar setuid binaries have nothing to do with the vulnerability, they are just an easy way of exploiting it. Avoiding them does not make you less vulnerable to copyfail. (blacklisting the kernel module is good)

]]>https://board.circlewithadot.net/post/https://chaos.social/users/marie/statuses/116499548771780034https://board.circlewithadot.net/post/https://chaos.social/users/marie/statuses/116499548771780034Fri, 01 May 2026 13:27:20 GMT