commit b80c3284d5d2a7282272e764e3c48bccccdbadcb · pyrox.dev/nixpkgs

+6 -3

nixos/modules/profiles/hardened.nix

···

       39
       39
        
         security.apparmor.killUnconfinedConfinables = mkDefault true;

     

       40
       40
        
       

     

       41
       41
        
         boot.kernelParams = [

     

       42
       42
       -
           # Slab/slub sanity checks, redzoning, and poisoning

     

       43
       43
       -
           "slub_debug=FZP"

     

       42
       42
       +
           # Don't merge slabs

     

       43
       43
       +
           "slab_nomerge"

     

       44
       44
        
       

     

       45
       45
       -
           # Overwrite free'd memory

     

       45
       45
       +
           # Overwrite free'd pages

     

       46
       46
        
           "page_poison=1"

     

       47
       47
        
       

     

       48
       48
        
           # Enable page allocator randomization

     

       49
       49
        
           "page_alloc.shuffle=1"

     

       50
       50
       +
       

     

       51
       51
       +
           # Disable debugfs

     

       52
       52
       +
           "debugfs=off"

     

       50
       53
        
         ];

     

       51
       54
        
       

     

       52
       55
        
         boot.blacklistedKernelModules = [

+36 -3

pkgs/os-specific/linux/kernel/hardened/config.nix

···

       39
       39
        
         DEBUG_PI_LIST         = whenOlder "5.2" yes; # doesn't BUG()

     

       40
       40
        
         DEBUG_PLIST           = whenAtLeast "5.2" yes;

     

       41
       41
        
         DEBUG_SG              = yes;

     

       42
       42
       +
         DEBUG_VIRTUAL         = yes;

     

       42
       43
        
         SCHED_STACK_END_CHECK = yes;

     

       43
       44
        
       

     

       44
       45
        
         REFCOUNT_FULL = whenOlder "5.4.208" yes;

     

       45
       46
        
       

     

       47
       47
       +
         # tell EFI to wipe memory during reset

     

       48
       48
       +
         # https://lwn.net/Articles/730006/

     

       49
       49
       +
         RESET_ATTACK_MITIGATION = yes;

     

       50
       50
       +
       

     

       51
       51
       +
         # restricts loading of line disciplines via TIOCSETD ioctl to CAP_SYS_MODULE

     

       52
       52
       +
         CONFIG_LDISC_AUTOLOAD = option no;

     

       53
       53
       +
       

     

       46
       54
        
         # Randomize page allocator when page_alloc.shuffle=1

     

       47
       55
        
         SHUFFLE_PAGE_ALLOCATOR = whenAtLeast "5.2" yes;

     

       48
       56
        
       

     

       49
       49
       -
         # Allow enabling slub/slab free poisoning with slub_debug=P

     

       50
       50
       -
         SLUB_DEBUG = yes;

     

       51
       51
       -
       

     

       52
       57
        
         # Wipe higher-level memory allocations on free() with page_poison=1

     

       53
       58
        
         PAGE_POISONING           = yes;

     

       54
       59
        
         PAGE_POISONING_NO_SANITY = whenOlder "5.11" yes;

     

       55
       60
        
         PAGE_POISONING_ZERO      = whenOlder "5.11" yes;

     

       61
       61
       +
       

     

       62
       62
       +
         # Enable init_on_alloc and init_on_free by default

     

       63
       63
       +
         INIT_ON_ALLOC_DEFAULT_ON = yes;

     

       64
       64
       +
         INIT_ON_FREE_DEFAULT_ON  = yes;

     

       65
       65
       +
       

     

       66
       66
       +
         # Wipe all caller-used registers on exit from a function

     

       67
       67
       +
         ZERO_CALL_USED_REGS = yes;

     

       56
       68
        
       

     

       57
       69
        
         # Enable the SafeSetId LSM

     

       58
       70
        
         SECURITY_SAFESETID = whenAtLeast "5.1" yes;

     
···

       70
       82
        
         GCC_PLUGIN_RANDSTRUCT = whenOlder "5.19" yes; # A port of the PaX randstruct plugin

     

       71
       83
        
         GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenOlder "5.19" yes;

     

       72
       84
        
       

     

       85
       85
       +
         # Runtime undefined behaviour checks

     

       86
       86
       +
         # https://www.kernel.org/doc/html/latest/dev-tools/ubsan.html

     

       87
       87
       +
         # https://developers.redhat.com/blog/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan

     

       88
       88
       +
         UBSAN      = yes;

     

       89
       89
       +
         UBSAN_TRAP = yes;

     

       90
       90
       +
         UBSAN_BOUNDS = yes;

     

       91
       91
       +
         UBSAN_SANITIZE_ALL = yes;

     

       92
       92
       +
         UBSAN_LOCAL_BOUNDS = option yes; # clang only

     

       93
       93
       +
         CFI_CLANG = option yes; # clang only Control Flow Integrity since 6.1

     

       94
       94
       +
       

     

       73
       95
        
         # Same as GCC_PLUGIN_RANDSTRUCT*, but has been renamed to `RANDSTRUCT*` in 5.19.

     

       74
       96
        
         RANDSTRUCT = whenAtLeast "5.19" yes;

     

       75
       97
        
         RANDSTRUCT_PERFORMANCE = whenAtLeast "5.19" yes;

     
···

       97
       119
        
         # CONFIG_DEVMEM=n causes these to not exist anymore.

     

       98
       120
        
         STRICT_DEVMEM    = option no;

     

       99
       121
        
         IO_STRICT_DEVMEM = option no;

     

       122
       122
       +
       

     

       123
       123
       +
         # stricter IOMMU TLB invalidation

     

       124
       124
       +
         IOMMU_DEFAULT_DMA_STRICT = option yes;

     

       125
       125
       +
         IOMMU_DEFAULT_DMA_LAZY = option no;

     

       126
       126
       +
       

     

       127
       127
       +
         # not needed for less than a decade old glibc versions

     

       128
       128
       +
         LEGACY_VSYSCALL_NONE = yes;

     

       129
       129
       +
       

     

       130
       130
       +
         # Straight-Line-Speculation

     

       131
       131
       +
         # https://lwn.net/Articles/877845/

     

       132
       132
       +
         SLS = option yes;

     

       100
       133
        
       }