Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: NixOS/nixpkgs
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: b37de8b67b4c
Choose a base ref
...
head repository: NixOS/nixpkgs
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: 586d04c5886f
Choose a head ref
  • 4 commits
  • 2 files changed
  • 2 contributors

Commits on Sep 16, 2017

  1. linuxPackages: hardened-config: disable BUG_ON_DATA_CORRUPTION for … 

    …older kernels

They don't support it.
    @oxij @joachifm
    oxij authored and joachifm committed Sep 16, 2017
    Copy the full SHA
    616a7fe View commit details

  2. linuxPackages: hardened-config: check kernelArch, not system

    @oxij @joachifm
    oxij authored and joachifm committed Sep 16, 2017
    Copy the full SHA
    c345761 View commit details

  3. linuxPackages: hardened-config: enable DEBUG_PI_LIST

    @oxij @joachifm
    oxij authored and joachifm committed Sep 16, 2017
    Copy the full SHA
    62fa45e View commit details

  4. nixos/tests: expand hardened tests

    @joachifm
    joachifm committed Sep 16, 2017
    Copy the full SHA
    586d04c View commit details
Showing with 16 additions and 2 deletions.
  1. +10 −0 nixos/tests/hardened.nix
  2. +6 −2 pkgs/os-specific/linux/kernel/hardened-config.nix
10 changes: 10 additions & 0 deletions nixos/tests/hardened.nix
View file
Original file line number Diff line number Diff line change
@@ -32,5 +32,15 @@ import ./make-test.nix ({ pkgs, ...} : {
subtest "userns", sub {
$machine->fail("unshare --user");
};
# Test dmesg restriction
subtest "dmesg", sub {
$machine->fail("su -l alice -c dmesg");
};
# Test access to kcore
subtest "kcore", sub {
$machine->fail("cat /proc/kcore");
};
'';
})
8 changes: 6 additions & 2 deletions pkgs/os-specific/linux/kernel/hardened-config.nix
View file
Original file line number Diff line number Diff line change
@@ -18,7 +18,11 @@ assert (versionAtLeast version "4.9");
# Report BUG() conditions and kill the offending process.
BUG y
${optionalString (stdenv.system == "x86_64-linux") ''
${optionalString (versionAtLeast version "4.10") ''
BUG_ON_DATA_CORRUPTION y
''}
${optionalString (stdenv.platform.kernelArch == "x86_64") ''
DEFAULT_MMAP_MIN_ADDR 65536 # Prevent allocation of first 64K of memory
# Reduce attack surface by disabling various emulations
@@ -64,9 +68,9 @@ IO_STRICT_DEVMEM y
DEBUG_CREDENTIALS y
DEBUG_NOTIFIERS y
DEBUG_LIST y
DEBUG_PI_LIST y # doesn't BUG()
DEBUG_SG y
SCHED_STACK_END_CHECK y
BUG_ON_DATA_CORRUPTION y
${optionalString (versionAtLeast version "4.13") ''
REFCOUNT_FULL y