grsecurity: add option to disable chroot caps restriction

The chroot caps restriction disallows chroot'ed processes from running
any command that requires `CAP_SYS_ADMIN`, breaking `nixos-rebuild`. See
e.g., https://github.com/NixOS/nixpkgs/issues/15293

This significantly weakens chroot protections, but to break
nixos-rebuild out of the box is too severe.

Changed files
+15
nixos
modules
security
pkgs
build-support
grsecurity
+13
nixos/modules/security/grsecurity.nix
···
'';
};
denyUSB = mkOption {
type = types.bool;
default = false;
···
'';
};
+
denyChrootCaps = mkOption {
+
type = types.bool;
+
default = false;
+
description = ''
+
Whether to lower capabilities of all processes within a chroot,
+
preventing commands that require <literal>CAP_SYS_ADMIN</literal>.
+
+
This protection is disabled by default because it breaks
+
<literal>nixos-rebuild</literal>. Whenever possible, it is
+
highly recommended to enable this protection.
+
'';
+
};
+
denyUSB = mkOption {
type = types.bool;
default = false;
+2
pkgs/build-support/grsecurity/default.nix
···
config = {
mode = "auto";
sysctl = false;
denyChrootChmod = false;
denyUSB = false;
restrictProc = false;
···
}
GRKERNSEC_SYSCTL ${boolToKernOpt cfg.config.sysctl}
GRKERNSEC_CHROOT_CHMOD ${boolToKernOpt cfg.config.denyChrootChmod}
GRKERNSEC_DENYUSB ${boolToKernOpt cfg.config.denyUSB}
GRKERNSEC_NO_RBAC ${boolToKernOpt cfg.config.disableRBAC}
···
config = {
mode = "auto";
sysctl = false;
+
denyChrootCaps = false;
denyChrootChmod = false;
denyUSB = false;
restrictProc = false;
···
}
GRKERNSEC_SYSCTL ${boolToKernOpt cfg.config.sysctl}
+
GRKERNSEC_CHROOT_CAPS ${boolToKernOpt cfg.config.denyChrootCaps}
GRKERNSEC_CHROOT_CHMOD ${boolToKernOpt cfg.config.denyChrootChmod}
GRKERNSEC_DENYUSB ${boolToKernOpt cfg.config.denyUSB}
GRKERNSEC_NO_RBAC ${boolToKernOpt cfg.config.disableRBAC}