public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

grsecurity: discontinue support

Browse Source 
Upstream has decided to make -testing patches private, effectively ceasing
free support for grsecurity/PaX [1].  Consequently, we can no longer
responsibly support grsecurity on NixOS.

This patch turns the kernel and patch expressions into build errors and
adds a warning to the manual, but retains most of the infrastructure, in
an effort to make the transition smoother.  For 17.09 all of it should
probably be pruned.

[1]: https://grsecurity.net/passing_the_baton.php
This commit is contained in:
Joachim Fasting 2017-04-27 20:42:23 +02:00
parent a012b15f87
commit 32b8512e54
No known key found for this signature in database
GPG Key ID: 7544761007FE4E08
5 changed files with 14 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
nixos/modules/security/grsecurity.nix
View File

@ -13,7 +13,7 @@ in
{ {
meta = { meta = {
maintainers = with maintainers; [ joachifm ]; maintainers = with maintainers; [ ];
doc = ./grsecurity.xml; doc = ./grsecurity.xml;
}; };

8
nixos/modules/security/grsecurity.xml
View File

@ -26,9 +26,11 @@
<link xlink:href="https://wiki.archlinux.org/index.php/Grsecurity">Arch <link xlink:href="https://wiki.archlinux.org/index.php/Grsecurity">Arch
Linux wiki page on grsecurity</link>. Linux wiki page on grsecurity</link>.
<note><para>grsecurity/PaX is only available for the latest linux -stable <warning><para>Upstream has ceased free support for grsecurity/PaX. See
kernel; patches against older kernels are available from upstream only for <link xlink:href="https://grsecurity.net/passing_the_baton.php">
a fee.</para></note> the announcement</link> for more information. Consequently, NixOS
support for grsecurity/PaX also must cease. Enabling this module will
result in a build error.</para></warning>
<note><para>We standardise on a desktop oriented configuration primarily due <note><para>We standardise on a desktop oriented configuration primarily due
to lack of resources. The grsecurity/PaX configuration state space is huge to lack of resources. The grsecurity/PaX configuration state space is huge
and each configuration requires quite a bit of testing to ensure that the and each configuration requires quite a bit of testing to ensure that the

1
nixos/release.nix
View File

@ -248,7 +248,6 @@ in rec {
tests.gocd-server = callTest tests/gocd-server.nix {}; tests.gocd-server = callTest tests/gocd-server.nix {};
tests.gnome3 = callTest tests/gnome3.nix {}; tests.gnome3 = callTest tests/gnome3.nix {};
tests.gnome3-gdm = callTest tests/gnome3-gdm.nix {}; tests.gnome3-gdm = callTest tests/gnome3-gdm.nix {};
tests.grsecurity = callTest tests/grsecurity.nix {};
tests.hibernate = callTest tests/hibernate.nix {}; tests.hibernate = callTest tests/hibernate.nix {};
tests.hound = callTest tests/hound.nix {}; tests.hound = callTest tests/hound.nix {};
tests.i3wm = callTest tests/i3wm.nix {}; tests.i3wm = callTest tests/i3wm.nix {};

12
pkgs/os-specific/linux/kernel/patches.nix
View File

@ -99,11 +99,13 @@ rec {
sha256 = "00b1rqgd4yr206dxp4mcymr56ymbjcjfa4m82pxw73khj032qw3j"; sha256 = "00b1rqgd4yr206dxp4mcymr56ymbjcjfa4m82pxw73khj032qw3j";
}; };
grsecurity_testing = grsecPatch grsecurity_testing = throw ''
{ kver = "4.9.24"; Upstream has ceased free support for grsecurity/PaX.
grrev = "201704220732";
sha512 = "0n9v066z3qh296fyvsg1gnygy7jd0cy0pnywxzglh58dnibl28q2ywjnp4ff30andzzq7rvjkk4n151xvs1n04pf2azkgz6igwfisg7"; See https://grsecurity.net/passing_the_baton.php
}; and https://grsecurity.net/passing_the_baton_faq.php
for more information.
'';
# This patch relaxes grsec constraints on the location of usermode helpers, # This patch relaxes grsec constraints on the location of usermode helpers,
# e.g., modprobe, to allow calling into the Nix store. # e.g., modprobe, to allow calling into the Nix store.

17
pkgs/top-level/all-packages.nix
View File

@ -11893,22 +11893,7 @@ with pkgs;
# Grsecurity packages # Grsecurity packages
linux_grsec_nixos = callPackage ../build-support/grsecurity { linux_grsec_nixos = kernelPatches.grsecurity_testing;
inherit (lib) overrideDerivation;
kernel = callPackage ../os-specific/linux/kernel/linux-grsecurity.nix {
kernelPatches = with self.kernelPatches; [
bridge_stp_helper
modinst_arg_list_too_long
] ++ lib.optionals ((platform.kernelArch or null) == "mips")
[ kernelPatches.mips_fpureg_emu
kernelPatches.mips_fpu_sigill
kernelPatches.mips_ext3_n32
];
};
grsecPatch = self.kernelPatches.grsecurity_testing;
kernelPatches = [ self.kernelPatches.grsecurity_nixos_kmod ];
extraConfig = callPackage ../os-specific/linux/kernel/grsecurity-nixos-config.nix { };
};
linuxPackages_grsec_nixos = linuxPackages_grsec_nixos =
recurseIntoAttrs (linuxPackagesFor linux_grsec_nixos); recurseIntoAttrs (linuxPackagesFor linux_grsec_nixos);