nixos/lock-kernel-modules: use udevadm settle

[rnhmjoj]

Motivation for this change

Fix for #73095

Instead of relying on systemd-udev-settle, which is deprecated,
directly call udevamd settle to wait for hardware to settle.

Things done

• Tested via hardened
• 21.11 Release Notes (or backporting 21.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

[rnhmjoj]

@GrahamcOfBorg test hardened

[peterhoeg]

Only seeing this after it was merged - I definitely think we should add a few lines of documentation next to the udevadm settle call to explain why we are doing this.

[Izorkin]

WARNING: This update breaks IPv4 protokol in use hardening mode mode on linux kernels 5.13 and above.

Temporary fix:

diff --git a/nixos/modules/profiles/hardened.nix b/nixos/modules/profiles/hardened.nix
index a4a2e8b1ff8..b0626bc890d 100644
--- a/nixos/modules/profiles/hardened.nix
+++ b/nixos/modules/profiles/hardened.nix
@@ -38,6 +38,11 @@ with lib;
   security.apparmor.enable = mkDefault true;
   security.apparmor.killUnconfinedConfinables = mkDefault true;

+  boot.kernelModules = [
+    # In kernel version 5.13 and higher, the af_packet module is trying to loading after modules are locked.
+    "af_packet"
+  ];
+
   boot.kernelParams = [
     # Slab/slub sanity checks, redzoning, and poisoning
     "slub_debug=FZP"

[Izorkin]

cc @joachifm @peterhoeg @rnhmjoj

[rnhmjoj]

I must have messed up the ordering: I tried to combine the dependencies of systemd-udev-settle with this service, but it obviously didn't work right. I'll open a PR to revert this.