diff options
| author | Alyssa Ross <hi@alyssa.is> | 2026-01-26 13:50:15 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-01-26 13:50:15 +0000 |
| commit | e10ae47b4bb5e2c8ff3ea221d88f78a9996fe2fa (patch) | |
| tree | 211c096a2e261245244a3dbbc88dbf56f1fd9fb5 /pkgs/os-specific | |
| parent | androidStudioPackages.canary: 2025.3.1.4 -> 2025.3.1.5 (#481159) (diff) | |
| parent | linux/hardened: limit SECURITY_WRITABLE_HOOKS to 6.3 and older kernels (diff) | |
| download | nixpkgs-e10ae47b4bb5e2c8ff3ea221d88f78a9996fe2fa.tar.gz | |
linux/hardening: miscellaneous config updates (#474719)
Diffstat (limited to 'pkgs/os-specific')
| -rw-r--r-- | pkgs/os-specific/linux/kernel/hardened/config.nix | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix index 85c5fb47191c..beebef90db38 100644 --- a/pkgs/os-specific/linux/kernel/hardened/config.nix +++ b/pkgs/os-specific/linux/kernel/hardened/config.nix @@ -1,5 +1,5 @@ # Based on recommendations from: -# http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project#Recommended_settings +# https://kspp.github.io/Recommended_Settings # https://wiki.gentoo.org/wiki/Hardened/Hardened_Kernel_Project # # Dangerous features that can be permanently (for the boot session) disabled at @@ -29,7 +29,7 @@ assert (lib.versionAtLeast version "4.9"); # We set SECURITY_WRITABLE_HOOKS n primarily for documentation purposes; the # config builder fails to detect that it has indeed been unset. SECURITY_SELINUX_DISABLE = whenOlder "6.4" no; # On 6.4: error: unused option: SECURITY_SELINUX_DISABLE - SECURITY_WRITABLE_HOOKS = option no; + SECURITY_WRITABLE_HOOKS = whenOlder "6.4" no; # Perform additional validation of commonly targeted structures. DEBUG_CREDENTIALS = whenOlder "6.6" yes; @@ -56,6 +56,9 @@ assert (lib.versionAtLeast version "4.9"); # Enable init_on_free by default INIT_ON_FREE_DEFAULT_ON = whenAtLeast "5.3" yes; + # Initialize all stack variables on function entry + INIT_STACK_ALL_ZERO = yes; + # Wipe all caller-used registers on exit from a function ZERO_CALL_USED_REGS = whenAtLeast "5.15" yes; @@ -67,8 +70,6 @@ assert (lib.versionAtLeast version "4.9"); GCC_PLUGINS = yes; # Enable gcc plugin options - GCC_PLUGIN_STRUCTLEAK = option yes; # A port of the PaX structleak plugin - GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = option yes; # Also cover structs passed by address GCC_PLUGIN_STACKLEAK = whenAtLeast "4.20" yes; # A port of the PaX stackleak plugin GCC_PLUGIN_RANDSTRUCT = whenOlder "5.19" yes; # A port of the PaX randstruct plugin GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenOlder "5.19" yes; |