Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: NixOS/nixpkgs
base: 2534dddaa96a
Choose a base ref
...
head repository: NixOS/nixpkgs
compare: ea4f37162767
Choose a head ref
  • 4 commits
  • 3 files changed
  • 1 contributor

Commits on Dec 27, 2018

  1. nixos/security/misc: use mkMerge for easier extension

    @joachifm
    joachifm committed Dec 27, 2018
    Copy the full SHA
    9db84f6 View commit details
    Browse the repository at this point in the history

  2. nixos/security/misc: factor out protectKernelImage 

    Introduces the option security.protectKernelImage that is intended to control
various mitigations to protect the integrity of the running kernel
image (i.e., prevent replacing it without rebooting).

This makes sense as a dedicated module as it is otherwise somewhat difficult
to override for hardened profile users who want e.g., hibernation to work.
    @joachifm
    joachifm committed Dec 27, 2018
    Copy the full SHA
    84fb882 View commit details
    Browse the repository at this point in the history

  3. nixos/security/misc: expose l1tf mitigation option 

    For the hardened profile enable flushing whenever the hypervisor enters the
guest, but otherwise leave at kernel default (conditional flushing as of
writing).
    @joachifm
    joachifm committed Dec 27, 2018
    Copy the full SHA
    e9761fa View commit details
    Browse the repository at this point in the history

  4. nixos/security/misc: expose SMT control option 

    For the hardened profile disable symmetric multi threading.  There seems to be
no *proven* method of exploiting cache sharing between threads on the same CPU
core, so this may be considered quite paranoid, considering the perf cost.
SMT can be controlled at runtime, however.  This is in keeping with OpenBSD
defaults.

TODO: since SMT is left to be controlled at runtime, changing the option
definition should take effect on system activation.  Write to
/sys/devices/system/cpu/smt/control
    @joachifm
    joachifm committed Dec 27, 2018
    Copy the full SHA
    ea4f371 View commit details
    Browse the repository at this point in the history