public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

grsecurity module: smarter container support

Browse Source 
Only set tunables required for container support if there are any containers.
This commit is contained in:
Joachim Fasting 2016-07-14 16:00:17 +02:00
parent c606b9876f
commit 94824303be
No known key found for this signature in database
GPG Key ID: 4330820E1E04DCF4
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
nixos/modules/security/grsecurity.nix
View File

@ -13,6 +13,10 @@ let
|| elem fs.mountPoint [ "/" "/nix" "/nix/store" "/var" "/var/log" "/var/lib" "/etc" ]) || elem fs.mountPoint [ "/" "/nix" "/nix/store" "/var" "/var/log" "/var/lib" "/etc" ])
&& fs.fsType == "zfs") && fs.fsType == "zfs")
(attrValues config.fileSystems) != []; (attrValues config.fileSystems) != [];
# Ascertain whether NixOS container support is required
containerSupportRequired =
config.boot.enableContainers && config.containers != {};
in in
{ {
@ -101,7 +105,7 @@ in
"kernel.grsecurity.chroot_deny_chroot" = mkForce 0; "kernel.grsecurity.chroot_deny_chroot" = mkForce 0;
"kernel.grsecurity.chroot_deny_mount" = mkForce 0; "kernel.grsecurity.chroot_deny_mount" = mkForce 0;
"kernel.grsecurity.chroot_deny_pivot" = mkForce 0; "kernel.grsecurity.chroot_deny_pivot" = mkForce 0;
} // optionalAttrs config.boot.enableContainers { } // optionalAttrs containerSupportRequired {
# chroot(2) restrictions that conflict with NixOS lightweight containers # chroot(2) restrictions that conflict with NixOS lightweight containers
"kernel.grsecurity.chroot_deny_chmod" = mkForce 0; "kernel.grsecurity.chroot_deny_chmod" = mkForce 0;
"kernel.grsecurity.chroot_deny_mount" = mkForce 0; "kernel.grsecurity.chroot_deny_mount" = mkForce 0;