···

       
32
       
32
       
 
       
      linux_6_1_hardened

     

       
33
       
33
       
 
       
      linux_6_6_hardened

     

       
34
       
34
       
 
       
      linux_6_8_hardened

     

       
35
       
35
       
+
       
      linux_6_9_hardened

     

       
35
       
36
       
 
       
      linux_rt_5_4

     

       
36
       
37
       
 
       
      linux_rt_5_10

     

       
37
       
38
       
 
       
      linux_rt_5_15

     

···

       
88
       
88
       
 
       
  UBSAN      = yes;

     

       
89
       
89
       
 
       
  UBSAN_TRAP = whenAtLeast "5.7" yes;

     

       
90
       
90
       
 
       
  UBSAN_BOUNDS = whenAtLeast "5.7" yes;

     

       
91
       
91
       
-
       
  UBSAN_SANITIZE_ALL = yes;

     

       
91
       
91
       
+
       
  UBSAN_SANITIZE_ALL = whenOlder "6.9" yes;

     

       
92
       
92
       
 
       
  UBSAN_LOCAL_BOUNDS = option yes; # clang only

     

       
93
       
93
       
 
       
  CFI_CLANG = option yes; # clang only Control Flow Integrity since 6.1

     

       
94
       
94
       
 
       


     
···

       
97
       
97
       
 
       
  RANDSTRUCT_PERFORMANCE = whenAtLeast "5.19" yes;

     

       
98
       
98
       
 
       


     

       
99
       
99
       
 
       
  # Disable various dangerous settings

     

       
100
       
100
       
-
       
  ACPI_CUSTOM_METHOD = no; # Allows writing directly to physical memory

     

       
100
       
100
       
+
       
  ACPI_CUSTOM_METHOD = whenOlder "6.9" no; # Allows writing directly to physical memory

     

       
101
       
101
       
 
       
  PROC_KCORE         = no; # Exposes kernel text image layout

     

       
102
       
102
       
 
       
  INET_DIAG          = no; # Has been used for heap based attacks in the past

     

       
103
       
103
       
 
       


     

···

       
68
       
68
       
 
       
        },

     

       
69
       
69
       
 
       
        "sha256": "0xjirg2w5fc2w2q6wr702akszq32m31lk4q5nbjq10zqhbcr5fxh",

     

       
70
       
70
       
 
       
        "version": "6.8.10"

     

       
71
       
71
       
+
       
    },

     

       
72
       
72
       
+
       
    "6.9": {

     

       
73
       
73
       
+
       
        "patch": {

     

       
74
       
74
       
+
       
            "extra": "-hardened1",

     

       
75
       
75
       
+
       
            "name": "linux-hardened-6.9.1-hardened1.patch",

     

       
76
       
76
       
+
       
            "sha256": "1zp0qwri43v4h234x1vqbwcbd50hryshi7i717xandzkpxvq72l2",

     

       
77
       
77
       
+
       
            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.9.1-hardened1/linux-hardened-6.9.1-hardened1.patch"

     

       
78
       
78
       
+
       
        },

     

       
79
       
79
       
+
       
        "sha256": "0jn0qp22vx7xf2mgaj7cwf8agqhahvrwlda4ak6rw67xk2x19d01",

     

       
80
       
80
       
+
       
        "version": "6.9.1"

     

       
71
       
81
       
 
       
    }

     

       
72
       
82
       
 
       
}

     

···

       
27330
       
27330
       
 
       
  linux_6_6_hardened = linuxKernel.kernels.linux_6_6_hardened;

     

       
27331
       
27331
       
 
       
  linuxPackages_6_8_hardened = linuxKernel.packages.linux_6_8_hardened;

     

       
27332
       
27332
       
 
       
  linux_6_8_hardened = linuxKernel.kernels.linux_6_8_hardened;

     

       
27333
       
27333
       
+
       
  linuxPackages_6_9_hardened = linuxKernel.packages.linux_6_9_hardened;

     

       
27334
       
27334
       
+
       
  linux_6_9_hardened = linuxKernel.kernels.linux_6_9_hardened;

     

       
27333
       
27335
       
 
       


     

       
27334
       
27336
       
 
       
  # GNU Linux-libre kernels

     

       
27335
       
27337
       
 
       
  linuxPackages-libre = linuxKernel.packages.linux_libre;

     

···

       
270
       
270
       
 
       
    linux_6_1_hardened = hardenedKernelFor kernels.linux_6_1 { };

     

       
271
       
271
       
 
       
    linux_6_6_hardened = hardenedKernelFor kernels.linux_6_6 { };

     

       
272
       
272
       
 
       
    linux_6_8_hardened = hardenedKernelFor kernels.linux_6_8 { };

     

       
273
       
273
       
+
       
    linux_6_9_hardened = hardenedKernelFor kernels.linux_6_9 { };

     

       
273
       
274
       
 
       


     

       
274
       
275
       
 
       
  } // lib.optionalAttrs config.allowAliases {

     

       
275
       
276
       
 
       
    linux_4_9 = throw "linux 4.9 was removed because it will reach its end of life within 22.11";

     
···

       
659
       
660
       
 
       
    linux_6_1_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_1_hardened);

     

       
660
       
661
       
 
       
    linux_6_6_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_6_hardened);

     

       
661
       
662
       
 
       
    linux_6_8_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_8_hardened);

     

       
663
       
663
       
+
       
    linux_6_9_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_9_hardened);

     

       
662
       
664
       
 
       


     

       
663
       
665
       
 
       
    linux_zen = recurseIntoAttrs (packagesFor kernels.linux_zen);

     

       
664
       
666
       
 
       
    linux_lqx = recurseIntoAttrs (packagesFor kernels.linux_lqx);