security hole /boot and /boot/loader/random-seed

[i-am-logger]

I'm using disko to setup the partitions of my system via flake.

started to get these warnings recently:

the proposed solution without disko is

  fileSystems."/boot" = {
    options = [ "umask=0077" ];
  };

though not sure how to set it with disko

[phaer]

though not sure how to set it with disko

Exactly the same (if your disko config contains a /boot). Disko does configure the filesystems attribute, but those settings get merged with your own ones via the nixos module system

[Lassulus]

...
partitions = {
  boot = {
    type = "EF00";
    size = "500M";
	content = {
      type = "filesystem";
      format = "vfat";
      mountOptions = [ "umask=0077" ];
      mountpoint = "/boot";
    };
  };
};

[nixos-discourse]

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/nixos-install-with-custom-flake-results-in-boot-being-world-accessible/34555/23

[iFreilicht]

Thank you for pointing this out! All the examples and documentation reflect this now.