public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

linux: fix fallout from conflicting kernel configs

Browse Source 
The parent commit forbids conflicting kernel config options.

Fix the hardened kernels by allowing options in common-config.nix to
be overridden by conflicting ones in hardened/config.nix.

I'm explicitly avoiding using a higher priority (e.g. using mkForce)
in hardened/config.nix so that the user can easily override the
options in that file.
This commit is contained in:
Ricardo M. Correia 2020-06-10 16:29:14 +02:00 committed by Linus Heckemann
parent 6feb61233b
commit d81067f3f3
2 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
pkgs/os-specific/linux/kernel/common-config.nix
View File

@ -193,16 +193,17 @@ let
NET_DROP_MONITOR = yes; NET_DROP_MONITOR = yes;
# needed for ss # needed for ss
INET_DIAG = module; # Use a lower priority to allow these options to be overridden in hardened/config.nix
INET_TCP_DIAG = module; INET_DIAG = mkDefault module;
INET_UDP_DIAG = module; INET_TCP_DIAG = mkDefault module;
INET_RAW_DIAG = whenAtLeast "4.14" module; INET_UDP_DIAG = mkDefault module;
INET_DIAG_DESTROY = whenAtLeast "4.9" yes; INET_RAW_DIAG = whenAtLeast "4.14" (mkDefault module);
INET_DIAG_DESTROY = whenAtLeast "4.9" (mkDefault yes);
# enable multipath-tcp # enable multipath-tcp
MPTCP = whenAtLeast "5.6" yes; MPTCP = whenAtLeast "5.6" yes;
MPTCP_IPV6 = whenAtLeast "5.6" yes; MPTCP_IPV6 = whenAtLeast "5.6" yes;
INET_MPTCP_DIAG = whenAtLeast "5.9" module; INET_MPTCP_DIAG = whenAtLeast "5.9" (mkDefault module);
}; };
wireless = { wireless = {

10
pkgs/os-specific/linux/kernel/hardened/config.nix
View File

@ -65,7 +65,7 @@ assert (versionAtLeast version "4.9");
PANIC_TIMEOUT = freeform "-1"; PANIC_TIMEOUT = freeform "-1";
GCC_PLUGINS = yes; # Enable gcc plugin options GCC_PLUGINS = yes; # Enable gcc plugin options
# Gather additional entropy at boot time for systems that may = no;ot have appropriate entropy sources. # Gather additional entropy at boot time for systems that may not have appropriate entropy sources.
GCC_PLUGIN_LATENT_ENTROPY = yes; GCC_PLUGIN_LATENT_ENTROPY = yes;
GCC_PLUGIN_STRUCTLEAK = whenAtLeast "4.11" yes; # A port of the PaX structleak plugin GCC_PLUGIN_STRUCTLEAK = whenAtLeast "4.11" yes; # A port of the PaX structleak plugin
@ -79,6 +79,14 @@ assert (versionAtLeast version "4.9");
PROC_KCORE = no; # Exposes kernel text image layout PROC_KCORE = no; # Exposes kernel text image layout
INET_DIAG = no; # Has been used for heap based attacks in the past INET_DIAG = no; # Has been used for heap based attacks in the past
# INET_DIAG=n causes the following options to not exist anymore, but since they are defined in common-config.nix,
# make them optional
INET_DIAG_DESTROY = option no;
INET_RAW_DIAG = option no;
INET_TCP_DIAG = option no;
INET_UDP_DIAG = option no;
INET_MPTCP_DIAG = option no;
# Use -fstack-protector-strong (gcc 4.9+) for best stack canary coverage. # Use -fstack-protector-strong (gcc 4.9+) for best stack canary coverage.
CC_STACKPROTECTOR_REGULAR = whenOlder "4.18" no; CC_STACKPROTECTOR_REGULAR = whenOlder "4.18" no;
CC_STACKPROTECTOR_STRONG = whenOlder "4.18" yes; CC_STACKPROTECTOR_STRONG = whenOlder "4.18" yes;