public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

linux: fix features system

Browse Source
This commit is contained in:
Matthieu Coudron 2018-06-25 09:12:17 +09:00 committed by Tuomas Tynkkynen
parent dcea150a89
commit e4fe7b31be
2 changed files with 9 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
pkgs/os-specific/linux/kernel/common-config.nix
View File

@ -21,7 +21,7 @@
# legacy extraConfig as string # legacy extraConfig as string
, extraConfig ? "" , extraConfig ? ""
, features ? {} , features ? { grsecurity = false; xen_dom0 = false; }
}: }:
assert (mkValueOverride == null) || (builtins.isFunction mkValueOverride); assert (mkValueOverride == null) || (builtins.isFunction mkValueOverride);
@ -31,12 +31,8 @@ with stdenv.lib;
with import ../../../../lib/kernel.nix { inherit (stdenv) lib; inherit version; }; with import ../../../../lib/kernel.nix { inherit (stdenv) lib; inherit version; };
let let
# temporary hack
grsecurity = false;
xen_dom0 = false;
# configuration items have to be part of a subattrs
# TODO configuration items have to be part of subattrs. Remove this constraint
flattenKConf = nested: mapAttrs (_: head) (zipAttrs (attrValues nested)); flattenKConf = nested: mapAttrs (_: head) (zipAttrs (attrValues nested));
options = { options = {
@ -50,7 +46,7 @@ let
DEBUG_NX_TEST = whenOlder "4.11" no; DEBUG_NX_TEST = whenOlder "4.11" no;
CPU_NOTIFIER_ERROR_INJECT = whenOlder "4.4" (option no); CPU_NOTIFIER_ERROR_INJECT = whenOlder "4.4" (option no);
DEBUG_STACK_USAGE = no; DEBUG_STACK_USAGE = no;
DEBUG_STACKOVERFLOW = when (!grsecurity) no; DEBUG_STACKOVERFLOW = when (!features.grsecurity) no;
RCU_TORTURE_TEST = no; RCU_TORTURE_TEST = no;
SCHEDSTATS = no; SCHEDSTATS = no;
DETECT_HUNG_TASK = yes; DETECT_HUNG_TASK = yes;
@ -333,7 +329,7 @@ let
SECURITY_SELINUX_BOOTPARAM_VALUE = "0"; # Disable SELinux by default SECURITY_SELINUX_BOOTPARAM_VALUE = "0"; # Disable SELinux by default
# Prevent processes from ptracing non-children processes # Prevent processes from ptracing non-children processes
SECURITY_YAMA = option yes; SECURITY_YAMA = option yes;
DEVKMEM = when (!grsecurity) no; # Disable /dev/kmem DEVKMEM = when (!features.grsecurity) no; # Disable /dev/kmem
USER_NS = yes; # Support for user namespaces USER_NS = yes; # Support for user namespaces
@ -408,7 +404,7 @@ let
virtualisation = { virtualisation = {
PARAVIRT = option yes; PARAVIRT = option yes;
HYPERVISOR_GUEST = when (!grsecurity) yes; HYPERVISOR_GUEST = when (!features.grsecurity) yes;
PARAVIRT_SPINLOCKS = option yes; PARAVIRT_SPINLOCKS = option yes;
KVM_APIC_ARCHITECTURE = whenOlder "4.8" yes; KVM_APIC_ARCHITECTURE = whenOlder "4.8" yes;
@ -416,7 +412,7 @@ let
KVM_COMPAT = option (whenBetween "4.0" "4.12" yes); KVM_COMPAT = option (whenBetween "4.0" "4.12" yes);
KVM_DEVICE_ASSIGNMENT = option (whenBetween "3.10" "4.12" yes); KVM_DEVICE_ASSIGNMENT = option (whenBetween "3.10" "4.12" yes);
KVM_GENERIC_DIRTYLOG_READ_PROTECT = whenAtLeast "4.0" yes; KVM_GENERIC_DIRTYLOG_READ_PROTECT = whenAtLeast "4.0" yes;
KVM_GUEST = when (!grsecurity) yes; KVM_GUEST = when (!features.grsecurity) yes;
KVM_MMIO = yes; KVM_MMIO = yes;
KVM_VFIO = yes; KVM_VFIO = yes;
KSM = yes; KSM = yes;
@ -432,7 +428,7 @@ let
# XXX: why isn't this in the xen-dom0 conditional section below? # XXX: why isn't this in the xen-dom0 conditional section below?
XEN_DOM0 = option yes; XEN_DOM0 = option yes;
} // optionalAttrs xen_dom0 { } // optionalAttrs features.xen_dom0 {
PCI_XEN = option yes; PCI_XEN = option yes;
HVC_XEN = option yes; HVC_XEN = option yes;
HVC_XEN_FRONTEND = option yes; HVC_XEN_FRONTEND = option yes;

2
pkgs/os-specific/linux/kernel/generic.nix
View File

@ -61,6 +61,8 @@ let
efiBootStub = true; efiBootStub = true;
needsCifsUtils = true; needsCifsUtils = true;
netfilterRPFilter = true; netfilterRPFilter = true;
grsecurity = false;
xen_dom0 = false;
} // features) kernelPatches; } // features) kernelPatches;
intermediateNixConfig = import ./common-config.nix { intermediateNixConfig = import ./common-config.nix {