nixpkgs/pkgs/os-specific/linux/kernel/grsecurity-nixos-config.nix

{ stdenv }:

with stdenv.lib;

''
GRKERNSEC y
PAX y

GRKERNSEC_CONFIG_AUTO y
GRKERNSEC_CONFIG_DESKTOP y
GRKERNSEC_CONFIG_VIRT_HOST y
GRKERNSEC_CONFIG_VIRT_EPT y
GRKERNSEC_CONFIG_VIRT_KVM y
GRKERNSEC_CONFIG_PRIORITY_SECURITY y

PAX_PT_PAX_FLAGS y
PAX_XATTR_PAX_FLAGS n
PAX_EI_PAX n

GRKERNSEC_PROC_GID 0

PAX_LATENT_ENTROPY n
PAX_SIZE_OVERFLOW n
GRKERNSEC_HIDESYM n
GRKERNSEC_RANDSTRUCT n
GRKERNSEC_PROC n
GRKERNSEC_SYSFS_RESTRICT n
GRKERNSEC_KMEM n
GRKERNSEC_MODHARDEN n
GRKERNSEC_NO_SIMULT_CONNECT n

PAX_KERNEXEC_PLUGIN_METHOD_BTS y

GRKERNSEC_ACL_HIDEKERN y
GRKERNSEC_IO y

GRKERNSEC_AUDIT_PTRACE y
GRKERNSEC_FORKFAIL y

GRKERNSEC_SYSCTL y
GRKERNSEC_SYSCTL_DISTRO y
GRKERNSEC_SYSCTL_ON y
''
grsecurity: implement a single NixOS kernel This patch replaces the old grsecurity kernels with a single NixOS specific grsecurity kernel. This kernel is intended as a general purpose kernel, tuned for casual desktop use. Providing only a single kernel may seem like a regression compared to offering a multitude of flavors. It is impossible, however, to effectively test and support that many options. This is amplified by the reality that very few seem to actually use grsecurity on NixOS, meaning that bugs go unnoticed for long periods of time, simply because those code paths end up never being exercised. More generally, it is hopeless to anticipate imagined needs. It is better to start from a solid foundation and possibly add more flavours on demand. While the generic kernel is intended to cover a wide range of use cases, it cannot cover everything. For some, the configuration will be either too restrictive or too lenient. In those cases, the recommended solution is to build a custom kernel --- this is strongly recommended for security sensitive deployments. Building a custom grsec kernel should be as simple as ```nix linux_grsec_nixos.override { extraConfig = '' GRKERNSEC y PAX y # and so on ... ''; } ``` The generic kernel should be usable both as a KVM guest and host. When running as a host, the kernel assumes hardware virtualisation support. Virtualisation systems other than KVM are unsupported: users of non-KVM systems are better served by compiling a custom kernel. Unlike previous Grsecurity kernels, this configuration disables `/proc` restrictions in favor of `security.hideProcessInformation`. Known incompatibilities: - ZFS: can't load spl and zfs kernel modules; claims incompatibility with KERNEXEC method `or` and RAP; changing to `bts` does not fix the problem, which implies we'd have to disable RAP as well for ZFS to work - `kexec()`: likely incompatible with KERNEXEC (unverified) - Xen: likely incompatible with KERNEXEC and UDEREF (unverified) - Virtualbox: likely incompatible with UDEREF (unverified) 2016-06-13 23:04:56 +01:00			`{ stdenv }:`

			`with stdenv.lib;`

			`''`
			`GRKERNSEC y`
			`PAX y`

			`GRKERNSEC_CONFIG_AUTO y`
			`GRKERNSEC_CONFIG_DESKTOP y`
			`GRKERNSEC_CONFIG_VIRT_HOST y`
			`GRKERNSEC_CONFIG_VIRT_EPT y`
			`GRKERNSEC_CONFIG_VIRT_KVM y`
			`GRKERNSEC_CONFIG_PRIORITY_SECURITY y`

			`PAX_PT_PAX_FLAGS y`
			`PAX_XATTR_PAX_FLAGS n`
			`PAX_EI_PAX n`

			`GRKERNSEC_PROC_GID 0`

			`PAX_LATENT_ENTROPY n`
			`PAX_SIZE_OVERFLOW n`
			`GRKERNSEC_HIDESYM n`
			`GRKERNSEC_RANDSTRUCT n`
			`GRKERNSEC_PROC n`
			`GRKERNSEC_SYSFS_RESTRICT n`
			`GRKERNSEC_KMEM n`
			`GRKERNSEC_MODHARDEN n`
			`GRKERNSEC_NO_SIMULT_CONNECT n`

			`PAX_KERNEXEC_PLUGIN_METHOD_BTS y`

			`GRKERNSEC_ACL_HIDEKERN y`
			`GRKERNSEC_IO y`

			`GRKERNSEC_AUDIT_PTRACE y`
			`GRKERNSEC_FORKFAIL y`

			`GRKERNSEC_SYSCTL y`
			`GRKERNSEC_SYSCTL_DISTRO y`
			`GRKERNSEC_SYSCTL_ON y`
			`''`