commit 32b8512e54b864ecf8c2b1e115c1a3f18e90a8c3 · pyrox.dev/nixpkgs

+1 -1

nixos/modules/security/grsecurity.nix

···

       13
       13
        
       

     

       14
       14
        
       {

     

       15
       15
        
         meta = {

     

       16
       16
       -
           maintainers = with maintainers; [ joachifm ];

     

       16
       16
       +
           maintainers = with maintainers; [ ];

     

       17
       17
        
           doc = ./grsecurity.xml;

     

       18
       18
        
         };

     

       19
       19

+5 -3

nixos/modules/security/grsecurity.xml

···

       26
       26
        
           <link xlink:href="https://wiki.archlinux.org/index.php/Grsecurity">Arch

     

       27
       27
        
           Linux wiki page on grsecurity</link>.

     

       28
       28
        
       

     

       29
       29
       -
           <note><para>grsecurity/PaX is only available for the latest linux -stable

     

       30
       30
       -
           kernel; patches against older kernels are available from upstream only for

     

       31
       31
       -
           a fee.</para></note>

     

       29
       29
       +
           <warning><para>Upstream has ceased free support for grsecurity/PaX.  See

     

       30
       30
       +
           <link xlink:href="https://grsecurity.net/passing_the_baton.php">

     

       31
       31
       +
           the announcement</link> for more information.  Consequently, NixOS

     

       32
       32
       +
           support for grsecurity/PaX also must cease.  Enabling this module will

     

       33
       33
       +
           result in a build error.</para></warning>

     

       32
       34
        
           <note><para>We standardise on a desktop oriented configuration primarily due

     

       33
       35
        
           to lack of resources.  The grsecurity/PaX configuration state space is huge

     

       34
       36
        
           and each configuration requires quite a bit of testing to ensure that the

-1

nixos/release.nix

···

       248
       248
        
         tests.gocd-server = callTest tests/gocd-server.nix {};

     

       249
       249
        
         tests.gnome3 = callTest tests/gnome3.nix {};

     

       250
       250
        
         tests.gnome3-gdm = callTest tests/gnome3-gdm.nix {};

     

       251
       251
       -
         tests.grsecurity = callTest tests/grsecurity.nix {};

     

       252
       251
        
         tests.hibernate = callTest tests/hibernate.nix {};

     

       253
       252
        
         tests.hound = callTest tests/hound.nix {};

     

       254
       253
        
         tests.i3wm = callTest tests/i3wm.nix {};

+7 -5

pkgs/os-specific/linux/kernel/patches.nix

···

       99
       99
        
           sha256 = "00b1rqgd4yr206dxp4mcymr56ymbjcjfa4m82pxw73khj032qw3j";

     

       100
       100
        
         };

     

       101
       101
        
       

     

       102
       102
       -
         grsecurity_testing = grsecPatch

     

       103
       103
       -
           { kver   = "4.9.24";

     

       104
       104
       -
             grrev  = "201704220732";

     

       105
       105
       -
             sha512 = "0n9v066z3qh296fyvsg1gnygy7jd0cy0pnywxzglh58dnibl28q2ywjnp4ff30andzzq7rvjkk4n151xvs1n04pf2azkgz6igwfisg7";

     

       106
       106
       -
           };

     

       102
       102
       +
         grsecurity_testing = throw ''

     

       103
       103
       +
           Upstream has ceased free support for grsecurity/PaX.

     

       104
       104
       +
       

     

       105
       105
       +
           See https://grsecurity.net/passing_the_baton.php

     

       106
       106
       +
           and https://grsecurity.net/passing_the_baton_faq.php

     

       107
       107
       +
           for more information.

     

       108
       108
       +
         '';

     

       107
       109
        
       

     

       108
       110
        
         # This patch relaxes grsec constraints on the location of usermode helpers,

     

       109
       111
        
         # e.g., modprobe, to allow calling into the Nix store.

+1 -16

pkgs/top-level/all-packages.nix

···

       11893
       11893
        
       

     

       11894
       11894
        
         # Grsecurity packages

     

       11895
       11895
        
       

     

       11896
       11896
       -
         linux_grsec_nixos = callPackage ../build-support/grsecurity {

     

       11897
       11897
       -
           inherit (lib) overrideDerivation;

     

       11898
       11898
       -
           kernel = callPackage ../os-specific/linux/kernel/linux-grsecurity.nix {

     

       11899
       11899
       -
             kernelPatches = with self.kernelPatches; [

     

       11900
       11900
       -
               bridge_stp_helper

     

       11901
       11901
       -
               modinst_arg_list_too_long

     

       11902
       11902
       -
             ] ++ lib.optionals ((platform.kernelArch or null) == "mips")

     

       11903
       11903
       -
               [ kernelPatches.mips_fpureg_emu

     

       11904
       11904
       -
                 kernelPatches.mips_fpu_sigill

     

       11905
       11905
       -
                 kernelPatches.mips_ext3_n32

     

       11906
       11906
       -
               ];

     

       11907
       11907
       -
           };

     

       11908
       11908
       -
           grsecPatch = self.kernelPatches.grsecurity_testing;

     

       11909
       11909
       -
           kernelPatches = [ self.kernelPatches.grsecurity_nixos_kmod ];

     

       11910
       11910
       -
           extraConfig = callPackage ../os-specific/linux/kernel/grsecurity-nixos-config.nix { };

     

       11911
       11911
       -
         };

     

       11896
       11896
       +
         linux_grsec_nixos = kernelPatches.grsecurity_testing;

     

       11912
       11897
        
       

     

       11913
       11898
        
         linuxPackages_grsec_nixos =

     

       11914
       11899
        
           recurseIntoAttrs (linuxPackagesFor linux_grsec_nixos);