From fecb56fc3febd6e2bab58f6701f044296cf4835e Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Mon, 2 May 2016 07:06:36 +0200 Subject: [PATCH 1/5] linuxPackages_grsec_4_5: init at 3.1-4.5.2-201604290633 --- .../linux/kernel/grsecurity-path-4.5.patch | 14 ++++++++++++++ .../linux/kernel/linux-grsecurity-4.5.nix | 19 +++++++++++++++++++ pkgs/os-specific/linux/kernel/patches.nix | 15 ++++++++++++++- pkgs/top-level/all-packages.nix | 17 +++++++++++++++++ 4 files changed, 64 insertions(+), 1 deletion(-) create mode 100644 pkgs/os-specific/linux/kernel/grsecurity-path-4.5.patch create mode 100644 pkgs/os-specific/linux/kernel/linux-grsecurity-4.5.nix diff --git a/pkgs/os-specific/linux/kernel/grsecurity-path-4.5.patch b/pkgs/os-specific/linux/kernel/grsecurity-path-4.5.patch new file mode 100644 index 00000000000..e0430a69c95 --- /dev/null +++ b/pkgs/os-specific/linux/kernel/grsecurity-path-4.5.patch @@ -0,0 +1,14 @@ +diff -ru a/kernel/kmod.c b/kernel/kmod.c +--- a/kernel/kmod.c 2016-04-21 17:06:09.882281660 +0200 ++++ b/kernel/kmod.c 2016-04-21 17:08:17.458949309 +0200 +@@ -294,7 +294,9 @@ + strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7) && + strncmp(sub_info->path, "/usr/libexec/", 13) && strncmp(sub_info->path, "/usr/bin/", 9) && + strncmp(sub_info->path, "/usr/sbin/", 10) && strcmp(sub_info->path, "/bin/false") && +- strcmp(sub_info->path, "/usr/share/apport/apport")) || strstr(sub_info->path, "..")) { ++ strcmp(sub_info->path, "/usr/share/apport/apport") && ++ strncmp(sub_info->path, "/nix/store/", 11) && ++ strncmp(sub_info->path, "/run/current-system/systemd/lib/", 32)) || strstr(sub_info->path, "..")) { + printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of permitted system paths\n", sub_info->path); + retval = -EPERM; + goto out; diff --git a/pkgs/os-specific/linux/kernel/linux-grsecurity-4.5.nix b/pkgs/os-specific/linux/kernel/linux-grsecurity-4.5.nix new file mode 100644 index 00000000000..267d0d58de4 --- /dev/null +++ b/pkgs/os-specific/linux/kernel/linux-grsecurity-4.5.nix @@ -0,0 +1,19 @@ +{ stdenv, fetchurl, perl, buildLinux, ... } @ args: + +import ./generic.nix (args // rec { + version = "4.5.2"; + extraMeta.branch = "4.5"; + + src = fetchurl { + url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; + sha256 = "17r063zx880ka3ayv9cf1yjfilvxlifhja1rhw5z3w35hgdkj8z3"; + }; + + kernelPatches = args.kernelPatches; + + features.iwlwifi = true; + features.efiBootStub = true; + features.needsCifsUtils = true; + features.canDisableNetfilterConntrackHelpers = true; + features.netfilterRPFilter = true; +} // (args.argsOverride or {})) diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix index 707ebb544bf..e84941091cd 100644 --- a/pkgs/os-specific/linux/kernel/patches.nix +++ b/pkgs/os-specific/linux/kernel/patches.nix @@ -112,7 +112,15 @@ rec { sha256 = "04k4nhshl6r5n41ha5620s7cd70dmmmvyf9mnn5359jr1720kxpf"; }; - grsecurity_latest = grsecurity_4_4; + grsecurity_4_5 = grsecPatch + { kernel = pkgs.grsecurity_base_linux_4_5; + patches = [ grsecurity_fix_path_4_5 ]; + kversion = "4.5.2"; + revision = "201604290633"; + sha256 = "0qrs4fk6lyqngq3fnsmrv0y3yp1lrbiwadfc6v7hy4lyv77wz107"; + }; + + grsecurity_latest = grsecurity_4_5; grsecurity_fix_path_3_14 = { name = "grsecurity-fix-path-3.14"; @@ -124,6 +132,11 @@ rec { patch = ./grsecurity-path-4.4.patch; }; + grsecurity_fix_path_4_5 = + { name = "grsecurity-fix-path-4.5"; + patch = ./grsecurity-path-4.5.patch; + }; + crc_regression = { name = "crc-backport-regression"; patch = ./crc-regression.patch; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index cea479e2adf..5d93c4fa2a4 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -10655,6 +10655,15 @@ in ]; }; + grsecurity_base_linux_4_5 = callPackage ../os-specific/linux/kernel/linux-grsecurity-4.5.nix { + kernelPatches = [ kernelPatches.bridge_stp_helper ] + ++ lib.optionals ((platform.kernelArch or null) == "mips") + [ kernelPatches.mips_fpureg_emu + kernelPatches.mips_fpu_sigill + kernelPatches.mips_ext3_n32 + ]; + }; + grFlavors = import ../build-support/grsecurity/flavors.nix; mkGrsecurity = patch: opts: @@ -10679,6 +10688,10 @@ in linux_grsec_server_4_4 = self.grKernel kernelPatches.grsecurity_4_4 self.grFlavors.server; linux_grsec_server_xen_4_4 = self.grKernel kernelPatches.grsecurity_4_4 self.grFlavors.server_xen; + linux_grsec_desktop_4_5 = self.grKernel kernelPatches.grsecurity_4_5 self.grFlavors.desktop; + linux_grsec_server_4_5 = self.grKernel kernelPatches.grsecurity_4_5 self.grFlavors.server; + linux_grsec_server_xen_4_5 = self.grKernel kernelPatches.grsecurity_4_5 self.grFlavors.server_xen; + linux_grsec_desktop_latest = self.grKernel kernelPatches.grsecurity_latest self.grFlavors.desktop; linux_grsec_server_latest = self.grKernel kernelPatches.grsecurity_latest self.grFlavors.server; linux_grsec_server_xen_latest = self.grKernel kernelPatches.grsecurity_latest self.grFlavors.server_xen; @@ -10850,6 +10863,10 @@ in linuxPackages_grsec_server_4_4 = self.grPackage kernelPatches.grsecurity_4_4 self.grFlavors.server; linuxPackages_grsec_server_xen_4_4 = self.grPackage kernelPatches.grsecurity_4_4 self.grFlavors.server_xen; + linuxPackages_grsec_desktop_4_5 = self.grPackage kernelPatches.grsecurity_4_5 self.grFlavors.desktop; + linuxPackages_grsec_server_4_5 = self.grPackage kernelPatches.grsecurity_4_5 self.grFlavors.server; + linuxPackages_grsec_server_xen_4_5 = self.grPackage kernelPatches.grsecurity_4_5 self.grFlavors.server_xen; + linuxPackages_grsec_desktop_latest = self.grPackage kernelPatches.grsecurity_latest self.grFlavors.desktop; linuxPackages_grsec_server_latest = self.grPackage kernelPatches.grsecurity_latest self.grFlavors.server; linuxPackages_grsec_server_xen_latest = self.grPackage kernelPatches.grsecurity_latest self.grFlavors.server_xen; From 7893cb1aeaa1f561d32b2bb16f0ee025a50ad484 Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Mon, 2 May 2016 07:13:50 +0200 Subject: [PATCH 2/5] linuxPackages_grsec_4_1: delete Upstream supports 3.14, 4.4, and 4.5 --- .../linux/kernel/linux-grsecurity-4.1.nix | 19 ------------------- pkgs/os-specific/linux/kernel/patches.nix | 8 -------- pkgs/top-level/all-packages.nix | 17 ----------------- 3 files changed, 44 deletions(-) delete mode 100644 pkgs/os-specific/linux/kernel/linux-grsecurity-4.1.nix diff --git a/pkgs/os-specific/linux/kernel/linux-grsecurity-4.1.nix b/pkgs/os-specific/linux/kernel/linux-grsecurity-4.1.nix deleted file mode 100644 index 4359f4586c5..00000000000 --- a/pkgs/os-specific/linux/kernel/linux-grsecurity-4.1.nix +++ /dev/null @@ -1,19 +0,0 @@ -{ stdenv, fetchurl, perl, buildLinux, ... } @ args: - -import ./generic.nix (args // rec { - version = "4.1.7"; - extraMeta.branch = "4.1"; - - src = fetchurl { - url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz"; - sha256 = "0g1dnvak0pd03d4miy1025bw64wq71w29a058dzspdr6jcf9qwbn"; - }; - - kernelPatches = args.kernelPatches; - - features.iwlwifi = true; - features.efiBootStub = true; - features.needsCifsUtils = true; - features.canDisableNetfilterConntrackHelpers = true; - features.netfilterRPFilter = true; -} // (args.argsOverride or {})) diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix index e84941091cd..14b0692dbad 100644 --- a/pkgs/os-specific/linux/kernel/patches.nix +++ b/pkgs/os-specific/linux/kernel/patches.nix @@ -96,14 +96,6 @@ rec { sha256 = "1sp1gwa7ahzflq7ayb51bg52abrn5zx1hb3pff3axpjqq7vfai6f"; }; - grsecurity_4_1 = grsecPatch - { kernel = pkgs.grsecurity_base_linux_4_1; - patches = [ grsecurity_fix_path_3_14 ]; - kversion = "4.1.7"; - revision = "201509201149"; - sha256 = "1agv8c3c4vmh5algbzmrq2f6vwk72rikrlcbm4h7jbrb9js6fxk4"; - }; - grsecurity_4_4 = grsecPatch { kernel = pkgs.grsecurity_base_linux_4_4; patches = [ grsecurity_fix_path_4_4 ]; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 5d93c4fa2a4..51ff7bcc935 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -10637,15 +10637,6 @@ in ]; }; - grsecurity_base_linux_4_1 = callPackage ../os-specific/linux/kernel/linux-grsecurity-4.1.nix { - kernelPatches = [ kernelPatches.bridge_stp_helper ] - ++ lib.optionals ((platform.kernelArch or null) == "mips") - [ kernelPatches.mips_fpureg_emu - kernelPatches.mips_fpu_sigill - kernelPatches.mips_ext3_n32 - ]; - }; - grsecurity_base_linux_4_4 = callPackage ../os-specific/linux/kernel/linux-grsecurity-4.4.nix { kernelPatches = [ kernelPatches.bridge_stp_helper ] ++ lib.optionals ((platform.kernelArch or null) == "mips") @@ -10680,10 +10671,6 @@ in linux_grsec_server_3_14 = self.grKernel kernelPatches.grsecurity_3_14 self.grFlavors.server; linux_grsec_server_xen_3_14 = self.grKernel kernelPatches.grsecurity_3_14 self.grFlavors.server_xen; - linux_grsec_desktop_4_1 = self.grKernel kernelPatches.grsecurity_4_1 self.grFlavors.desktop; - linux_grsec_server_4_1 = self.grKernel kernelPatches.grsecurity_4_1 self.grFlavors.server; - linux_grsec_server_xen_4_1 = self.grKernel kernelPatches.grsecurity_4_1 self.grFlavors.server_xen; - linux_grsec_desktop_4_4 = self.grKernel kernelPatches.grsecurity_4_4 self.grFlavors.desktop; linux_grsec_server_4_4 = self.grKernel kernelPatches.grsecurity_4_4 self.grFlavors.server; linux_grsec_server_xen_4_4 = self.grKernel kernelPatches.grsecurity_4_4 self.grFlavors.server_xen; @@ -10855,10 +10842,6 @@ in linuxPackages_grsec_server_3_14 = self.grPackage kernelPatches.grsecurity_3_14 self.grFlavors.server; linuxPackages_grsec_server_xen_3_14 = self.grPackage kernelPatches.grsecurity_3_14 self.grFlavors.server_xen; - linuxPackages_grsec_desktop_4_1 = self.grPackage kernelPatches.grsecurity_4_1 self.grFlavors.desktop; - linuxPackages_grsec_server_4_1 = self.grPackage kernelPatches.grsecurity_4_1 self.grFlavors.server; - linuxPackages_grsec_server_xen_4_1 = self.grPackage kernelPatches.grsecurity_4_1 self.grFlavors.server_xen; - linuxPackages_grsec_desktop_4_4 = self.grPackage kernelPatches.grsecurity_4_4 self.grFlavors.desktop; linuxPackages_grsec_server_4_4 = self.grPackage kernelPatches.grsecurity_4_4 self.grFlavors.server; linuxPackages_grsec_server_xen_4_4 = self.grPackage kernelPatches.grsecurity_4_4 self.grFlavors.server_xen; From a69501a936a6434fbe88fb6a0423dd425563c163 Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Mon, 2 May 2016 07:27:29 +0200 Subject: [PATCH 3/5] grsecurity: ensure that PaX ELF markings are enabled The upstream default is to enable only xattr markings, breaking the paxmarks facility. --- pkgs/build-support/grsecurity/default.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/build-support/grsecurity/default.nix b/pkgs/build-support/grsecurity/default.nix index 6c2e98b9cc1..0addb1d3d45 100644 --- a/pkgs/build-support/grsecurity/default.nix +++ b/pkgs/build-support/grsecurity/default.nix @@ -90,6 +90,10 @@ let GRKERNSEC y ${grsecMainConfig} + # The paxmarks mechanism relies on ELF header markings, but the default + # grsecurity configuration only enables xattr markings + PAX_PT_PAX_FLAGS y + ${if cfg.config.restrictProc then "GRKERNSEC_PROC_USER y" else From 39db90eaf60999db2ffd13668b4619a2d57f76ad Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Mon, 2 May 2016 07:35:19 +0200 Subject: [PATCH 4/5] grsecurity: simplify preConfigure --- pkgs/build-support/grsecurity/default.nix | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/pkgs/build-support/grsecurity/default.nix b/pkgs/build-support/grsecurity/default.nix index 0addb1d3d45..0ba27036667 100644 --- a/pkgs/build-support/grsecurity/default.nix +++ b/pkgs/build-support/grsecurity/default.nix @@ -121,8 +121,7 @@ let # additional build inputs for gcc plugins, required by some PaX/grsec features nativeBuildInputs = args.nativeBuildInputs ++ (with pkgs; [ gmp libmpc mpfr ]); - preConfigure = args.preConfigure or "" + '' - rm localversion-grsec + preConfigure = (args.preConfigure or "") + '' echo ${localver grkern} > localversion-grsec ''; }; From 60a27781d6d358e0c5cd144c7c90642761c1a31f Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Mon, 2 May 2016 07:30:44 +0200 Subject: [PATCH 5/5] grsecurity module: fix grsec-lock unit ordering Requirement without ordering implies parallel execution; it is crucial that sysctl tunables are finalized before the lock is engaged, however. --- nixos/modules/security/grsecurity.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/nixos/modules/security/grsecurity.nix b/nixos/modules/security/grsecurity.nix index 236206026c3..11668162808 100644 --- a/nixos/modules/security/grsecurity.nix +++ b/nixos/modules/security/grsecurity.nix @@ -234,7 +234,8 @@ in systemd.services.grsec-lock = mkIf cfg.config.sysctl { description = "grsecurity sysctl-lock Service"; - requires = [ "systemd-sysctl.service" ]; + wants = [ "systemd-sysctl.service" ]; + after = [ "systemd-sysctl.service" ]; wantedBy = [ "multi-user.target" ]; serviceConfig.Type = "oneshot"; serviceConfig.RemainAfterExit = "yes";