44b6999614
This is more robust than setting via environment variable, though it does come later in the load sequence. An added benefit is affecting the current session.
92 lines
2.6 KiB
Nix
92 lines
2.6 KiB
Nix
{ config, lib, pkgs, ... }:
|
||
with lib;
|
||
|
||
let
|
||
cfg = config.environment.memoryAllocator;
|
||
|
||
# The set of alternative malloc(3) providers.
|
||
providers = {
|
||
"graphene-hardened" = rec {
|
||
libPath = "${pkgs.graphene-hardened-malloc}/lib/libhardened_malloc.so";
|
||
description = ''
|
||
An allocator designed to mitigate memory corruption attacks, such as
|
||
those caused by use-after-free bugs.
|
||
'';
|
||
};
|
||
|
||
"jemalloc" = {
|
||
libPath = "${pkgs.jemalloc}/lib/libjemalloc.so";
|
||
description = ''
|
||
A general purpose allocator that emphasizes fragmentation avoidance
|
||
and scalable concurrency support.
|
||
'';
|
||
};
|
||
|
||
"scudo" = {
|
||
libPath = "${pkgs.llvmPackages.compiler-rt}/lib/linux/libclang_rt.scudo-x86_64.so";
|
||
description = ''
|
||
A user-mode allocator based on LLVM Sanitizer’s CombinedAllocator,
|
||
which aims at providing additional mitigations against heap based
|
||
vulnerabilities, while maintaining good performance.
|
||
'';
|
||
};
|
||
};
|
||
|
||
providerConf = providers."${cfg.provider}";
|
||
|
||
# An output that contains only the shared library, to avoid
|
||
# needlessly bloating the system closure
|
||
mallocLib = pkgs.runCommand "malloc-provider-${cfg.provider}"
|
||
rec {
|
||
preferLocalBuild = true;
|
||
allowSubstitutes = false;
|
||
origLibPath = providerConf.libPath;
|
||
libName = baseNameOf origLibPath;
|
||
}
|
||
''
|
||
mkdir -p $out/lib
|
||
cp -L $origLibPath $out/lib/$libName
|
||
'';
|
||
|
||
# The full path to the selected provider shlib.
|
||
providerLibPath = "${mallocLib}/lib/${mallocLib.libName}";
|
||
in
|
||
|
||
{
|
||
meta = {
|
||
maintainers = [ maintainers.joachifm ];
|
||
};
|
||
|
||
options = {
|
||
environment.memoryAllocator.provider = mkOption {
|
||
type = types.enum ([ "libc" ] ++ attrNames providers);
|
||
default = "libc";
|
||
description = ''
|
||
The system-wide memory allocator.
|
||
|
||
Briefly, the system-wide memory allocator providers are:
|
||
<itemizedlist>
|
||
<listitem><para><literal>libc</literal>: the standard allocator provided by libc</para></listitem>
|
||
${toString (mapAttrsToList
|
||
(name: value: "<listitem><para><literal>${name}</literal>: ${value.description}</para></listitem>")
|
||
providers)}
|
||
</itemizedlist>
|
||
|
||
<warning>
|
||
<para>
|
||
Selecting an alternative allocator (i.e., anything other than
|
||
<literal>libc</literal>) may result in instability, data loss,
|
||
and/or service failure.
|
||
</para>
|
||
</warning>
|
||
'';
|
||
};
|
||
};
|
||
|
||
config = mkIf (cfg.provider != "libc") {
|
||
environment.etc."ld-nix.so.preload".text = ''
|
||
${providerLibPath}
|
||
'';
|
||
};
|
||
}
|