public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

grsecurity: enable optional sysfs restrictions

Browse Source 
Fairly severe, but can be disabled at bootup via
grsec_sysfs_restrict=0. For the NixOS module we ensure that it is
disabled, for systemd compatibility.
This commit is contained in:
Joachim Fasting 2016-12-05 19:04:49 +01:00
parent 8c1f5afdf3
commit 071fbcda24
No known key found for this signature in database
GPG Key ID: 7544761007FE4E08
3 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
nixos/modules/security/grsecurity.nix
View File

@ -59,7 +59,8 @@ in
boot.kernelPackages = mkForce pkgs.linuxPackages_grsec_nixos; boot.kernelPackages = mkForce pkgs.linuxPackages_grsec_nixos;
boot.kernelParams = optional cfg.disableEfiRuntimeServices "noefi"; boot.kernelParams = [ "grsec_sysfs_restrict=0" ]
++ optional cfg.disableEfiRuntimeServices "noefi";
nixpkgs.config.grsecurity = true; nixpkgs.config.grsecurity = true;

9
nixos/modules/security/grsecurity.xml
View File

@ -151,9 +151,6 @@
a TCP simultaneous OPEN on that port before the connection is actually a TCP simultaneous OPEN on that port before the connection is actually
established.</para></listitem> established.</para></listitem>
<listitem><para><filename class="directory">/sys</filename> hardening:
breaks systemd.</para></listitem>
<listitem><para>Trusted path execution: a desirable feature, but <listitem><para>Trusted path execution: a desirable feature, but
requires some more work to operate smoothly on NixOS.</para></listitem> requires some more work to operate smoothly on NixOS.</para></listitem>
@ -357,6 +354,12 @@
<literal>pax_size_overflow_report_only</literal>: log size overflow <literal>pax_size_overflow_report_only</literal>: log size overflow
violations but leave the violating task running violations but leave the violating task running
</para></listitem> </para></listitem>
<listitem><para>
<literal>grsec_sysfs_restrict=[0|1]</literal>: toggle sysfs
restrictions. The NixOS module sets this to <literal>0</literal>
for systemd compatibility
</para></listitem>
</itemizedlist> </itemizedlist>
</para> </para>

1
pkgs/os-specific/linux/kernel/grsecurity-nixos-config.nix
View File

@ -29,6 +29,7 @@ PAX_KERNEXEC_PLUGIN_METHOD_BTS y
# Additional grsec hardening not implied by auto constraints # Additional grsec hardening not implied by auto constraints
GRKERNSEC_IO y GRKERNSEC_IO y
GRKERNSEC_SYSFS_RESTRICT y
# Disable protections rendered useless by redistribution # Disable protections rendered useless by redistribution
GRKERNSEC_HIDESYM n GRKERNSEC_HIDESYM n