public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #65585 from delroth/hardened-pti

Browse Source 
nixos/hardened: make pti=on overridable
This commit is contained in:
Joachim F 2019-07-30 10:35:31 +00:00 committed by GitHub
commit a7d71da84d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 18 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
nixos/modules/profiles/hardened.nix
View File

@ -26,6 +26,8 @@ with lib;
security.allowSimultaneousMultithreading = mkDefault false; security.allowSimultaneousMultithreading = mkDefault false;
security.forcePageTableIsolation = mkDefault true;
security.virtualisation.flushL1DataCache = mkDefault "always"; security.virtualisation.flushL1DataCache = mkDefault "always";
security.apparmor.enable = mkDefault true; security.apparmor.enable = mkDefault true;
@ -42,9 +44,6 @@ with lib;
# Disable legacy virtual syscalls # Disable legacy virtual syscalls
"vsyscall=none" "vsyscall=none"
# Enable PTI even if CPU claims to be safe from meltdown
"pti=on"
]; ];
boot.blacklistedKernelModules = [ boot.blacklistedKernelModules = [

16
nixos/modules/security/misc.nix
View File

@ -54,6 +54,18 @@ with lib;
''; '';
}; };
security.forcePageTableIsolation = mkOption {
type = types.bool;
default = false;
description = ''
Whether to force-enable the Page Table Isolation (PTI) Linux kernel
feature even on CPU models that claim to be safe from Meltdown.
This hardening feature is most beneficial to systems that run untrusted
workloads that rely on address space isolation for security.
'';
};
security.virtualisation.flushL1DataCache = mkOption { security.virtualisation.flushL1DataCache = mkOption {
type = types.nullOr (types.enum [ "never" "cond" "always" ]); type = types.nullOr (types.enum [ "never" "cond" "always" ]);
default = null; default = null;
@ -114,6 +126,10 @@ with lib;
boot.kernelParams = [ "nosmt" ]; boot.kernelParams = [ "nosmt" ];
}) })
(mkIf config.security.forcePageTableIsolation {
boot.kernelParams = [ "pti=on" ];
})
(mkIf (config.security.virtualisation.flushL1DataCache != null) { (mkIf (config.security.virtualisation.flushL1DataCache != null) {
boot.kernelParams = [ "kvm-intel.vmentry_l1d_flush=${config.security.virtualisation.flushL1DataCache}" ]; boot.kernelParams = [ "kvm-intel.vmentry_l1d_flush=${config.security.virtualisation.flushL1DataCache}" ];
}) })