# Security warning when installing NixOS 23.11

**URL:** https://discourse.nixos.org/t/security-warning-when-installing-nixos-23-11/37636
**Category:** Help
**Created:** [January 2, 2024, 3:32pm UTC](https://discourse.nixos.org/t/security-warning-when-installing-nixos-23-11/37636 "2024-01-02T15:32:13Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![ElvishJerricco](https://discourse.nixos.org/user_avatar/discourse.nixos.org/elvishjerricco/32/984_2.png) [@ElvishJerricco](https://discourse.nixos.org/u/ElvishJerricco)
#### Post date: [January 2, 2024, 4:17pm UTC](https://discourse.nixos.org/t/security-warning-when-installing-nixos-23-11/37636/2 "2024-01-02T16:17:16Z")

</div>

See more here: [Nixos-install with custom flake results in /boot being world accessible - #14 by ElvishJerricco](https://discourse.nixos.org/t/nixos-install-with-custom-flake-results-in-boot-being-world-accessible/34555/14)

Basically, you should add `options = ["umask=0077"];` to the `/boot` file system stanza. You can avoid the warning during installation too by mounting `/mnt/boot` with `-o umask=0077` in the first place.

We should add this information to the nixos manual, but unfortunately `nixos-generate-config` currently wouldn’t include that option in the generated `hardware-configuration.nix`.

Overall, the warning is fairly harmless. This _wasn’t_ warned about for many years, and so it’s very common for systems not to have this configured (which is why the manual hasn’t had this information before). But it is technically best practice to make sure that only root can read `/boot` using `umask=0077`, so systemd v254 included the new warning

---

_[View the full topic](https://discourse.nixos.org/t/security-warning-when-installing-nixos-23-11/37636)._