From 63433537ce3f52f9bc460961b2b73e40db027447 Mon Sep 17 00:00:00 2001 From: Joachim Fasting Date: Sat, 29 Apr 2017 17:27:08 +0200 Subject: [PATCH] nixos/hardened profile: disable legacy virtual syscalls This eliminates a theoretical risk of ASLR bypass due to the fixed address mapping used by the legacy vsyscall mechanism. Modern glibc use vdso(7) instead so there is no loss of functionality, but some programs may fail to run in this configuration. Programs that fail to run because vsyscall has been disabled will be logged to dmesg. For background on virtual syscalls see https://lwn.net/Articles/446528/ Closes https://github.com/NixOS/nixpkgs/pull/25289 --- nixos/modules/profiles/hardened.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/nixos/modules/profiles/hardened.nix b/nixos/modules/profiles/hardened.nix index 9933f8b25f5..a01d974446b 100644 --- a/nixos/modules/profiles/hardened.nix +++ b/nixos/modules/profiles/hardened.nix @@ -10,6 +10,11 @@ with lib; security.apparmor.enable = mkDefault true; + boot.kernelParams = [ + # Disable legacy virtual syscalls + "vsyscall=none" + ]; + # Restrict ptrace() usage to processes with a pre-defined relationship # (e.g., parent/child) boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkOverride 500 1;