public
/
nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #17425 from joachifm/grsec-efi 

grsecurity module: disable EFI runtime services by default
This commit is contained in:
Joachim F 2016-08-03 10:48:25 +02:00 committed by GitHub
parent 4ba0912a92 43fc394a5c
commit 772a7bb49b
2 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
nixos/doc/manual/configuration/grsecurity.xml
View File

@ -265,6 +265,11 @@
<sect1 xml:id="sec-grsec-issues"><title>Issues and work-arounds</title> <sect1 xml:id="sec-grsec-issues"><title>Issues and work-arounds</title>
<itemizedlist> <itemizedlist>
<listitem><para>Access to EFI runtime services is disabled by default:
this plugs a potential code injection attack vector; use
<option>security.grsecurity.disableEfiRuntimeServices</option> to override
this behavior.</para></listitem>
<listitem><para>Virtualization: KVM is the preferred virtualization <listitem><para>Virtualization: KVM is the preferred virtualization
solution. Xen, Virtualbox, and VMWare are solution. Xen, Virtualbox, and VMWare are
<emphasis>unsupported</emphasis> and most likely require a custom kernel. <emphasis>unsupported</emphasis> and most likely require a custom kernel.

14
nixos/modules/security/grsecurity.nix
View File

@ -37,6 +37,18 @@ in
''; '';
}; };
disableEfiRuntimeServices = mkOption {
type = types.bool;
example = false;
default = true;
description = ''
Whether to disable access to EFI runtime services. Enabling EFI runtime
services creates a venue for code injection attacks on the kernel and
should be disabled if at all possible. Changing this option enters into
effect upon reboot.
'';
};
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
@ -45,6 +57,8 @@ in
# required kernel config # required kernel config
boot.kernelPackages = mkDefault pkgs.linuxPackages_grsec_nixos; boot.kernelPackages = mkDefault pkgs.linuxPackages_grsec_nixos;
boot.kernelParams = optional cfg.disableEfiRuntimeServices "noefi";
system.requiredKernelConfig = with config.lib.kernelConfig; system.requiredKernelConfig = with config.lib.kernelConfig;
[ (isEnabled "GRKERNSEC") [ (isEnabled "GRKERNSEC")
(isEnabled "PAX") (isEnabled "PAX")