feat: disable /dev/mem kernel strictness

[RiSKeD]

No description provided.

[Copilot]

Pull request overview

This PR disables kernel-level /dev/mem restrictions to enable low-level hardware access required for firmware testing. While the change aligns with the repository's purpose as a firmware testing base image, it introduces security considerations that should be carefully documented.

• Disables STRICT_DEVMEM and IO_STRICT_DEVMEM kernel config options to allow unrestricted /dev/mem access
• Adds ignoreConfigErrors = true to suppress kernel configuration validation errors

Comments suppressed due to low confidence (1)

modules/kernel.nix:60

• Disabling STRICT_DEVMEM and IO_STRICT_DEVMEM removes important security protections by allowing unrestricted access to physical memory via /dev/mem. While this may be necessary for firmware testing tools, this security-sensitive change should be documented in the README.md.

Consider adding a security notice in the README similar to the existing SSH access warning, explaining:

• What /dev/mem restrictions are being disabled
• Why this is needed for firmware testing
• The security implications
• That images should only be used in isolated/controlled environments

This helps users understand the security posture of the images they're building.

        structuredExtraConfig = with lib.kernel; {
          # Disable /dev/mem restrictions for firmware testing
          STRICT_DEVMEM = no;
          IO_STRICT_DEVMEM = no;
        };

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.