JakeHillion/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
222,983 Commits 2 Branches 0 Tags 12 GiB
9d7f94a3f0
Commit Graph

3646 Commits

Author SHA1 Message Date
Austin Seipp
d403911451
linux_testing: 5.6-rc7 -> 5.7-rc2 
Signed-off-by: Austin Seipp <aseipp@pobox.com>
 2020-04-24 10:58:31 -05:00
Emily
2c1db9649e linux_*_hardened: index patches by major kernel version 
This will avoid breaking the build whenever a non-major kernel update
happens. In the update script, we map each kernel version to the latest
patch for the latest kernel version less than or equal to what we
have packaged.
 2020-04-23 18:50:26 +01:00
Jörg Thalheim
6dfd563633
linux_latest-hardened: fix evaluation 2020-04-23 16:45:06 +01:00
Jörg Thalheim
1bceaa1cee
linux_hardened: fix evaluation 2020-04-23 15:52:14 +01:00
Tim Steinbach
45c22565f6
linux: 5.6.6 -> 5.6.7 2020-04-23 08:17:15 -04:00
Tim Steinbach
2f10053834
linux: 5.4.34 -> 5.4.35 2020-04-23 08:17:06 -04:00
Tim Steinbach
62a608fd63
linux: 4.19.117 -> 4.19.118 2020-04-23 08:16:58 -04:00
Frederik Rietdijk
cff0669a48 Merge master into staging-next 2020-04-23 08:11:16 +02:00
Tim Steinbach
629068fe5b
linux_latest-libre: 17402 -> 17445 2020-04-22 19:40:01 -04:00
kraem
fca903c7dd
linux/hardened-patches/4.19.117: init at 4.19.117.a 2020-04-22 02:12:28 +02:00
kraem
99f30a5635
linux/hardened-patches/5.4.34: init at 5.4.34.a 2020-04-22 02:12:25 +02:00
kraem
3c81b3df4e
linux/hardened-patches/5.5.19: init at 5.5.19.a 2020-04-22 02:12:21 +02:00
kraem
c8b5e37764
linux/hardened-patches/5.6.6: init at 5.6.6.a 2020-04-22 02:12:17 +02:00
kraem
efafc50f5c
linux/hardened-patches/4.19.116: remove 2020-04-21 22:18:03 +02:00
kraem
8f2e9fcadd
linux/hardened-patches/5.5.18: remove 2020-04-21 22:18:03 +02:00
kraem
9ed70f4e46
linux/hardened-patches/5.6.5: remove 2020-04-21 22:18:03 +02:00
kraem
15807c58ad
linux/hardened-patches/5.4.33: remove 2020-04-21 22:18:02 +02:00
kraem
c9cf25bc61
linux: 5.6.5 -> 5.6.6 2020-04-21 21:59:59 +02:00
kraem
1e23dcbf22
linux: 5.5.18 -> 5.5.19 2020-04-21 21:59:22 +02:00
kraem
18c2b5a9aa
linux: 5.4.33 -> 5.4.34 2020-04-21 21:58:45 +02:00
kraem
e074301be8
linux: 4.19.116 -> 4.19.117 2020-04-21 21:58:03 +02:00
Frederik Rietdijk
803b3d296c Merge staging-next into staging 2020-04-21 08:29:51 +02:00
kraem
523fe98821 linux/hardened-patches/4.19.116: 4.19.116.NixOS-a -> 4.19.116.a 2020-04-20 10:05:36 -04:00
kraem
45343beffe linux/hardened-patches/5.4.33: 5.4.33.NixOS-a -> 5.4.33.a 2020-04-20 10:05:36 -04:00
kraem
48d908b731 linux/hardened-patches/5.5.18: init at 5.5.18.a 2020-04-20 10:05:36 -04:00
kraem
0fd9293703 linux/hardened-patches/5.6.5: init at 5.6.5.a 2020-04-20 10:05:36 -04:00
kraem
e7a65e6c41 linux/hardened-patches/5.5.17: remove 2020-04-20 10:05:36 -04:00
kraem
eb41f8122e linux/hardened-patches/5.6.4: remove 2020-04-20 10:05:36 -04:00
kraem
8879086cfc linux: 5.5.17 -> 5.5.18 2020-04-20 10:05:36 -04:00
kraem
4307923b86 linux: 5.6.4 -> 5.6.5 2020-04-20 10:05:36 -04:00
Yegor Timoshenko
6f1165a0cb
Merge pull request #84522 from emilazy/add-linux-hardened-patches 
linux_*_hardened: use linux-hardened patch set
 2020-04-19 20:01:35 +03:00
Vladimír Čunát
d96487b9ca
Merge branch 'master' into staging-next 
Hydra nixpkgs: ?compare=1582510
 2020-04-18 07:42:26 +02:00
John Ericson
33c2a76c5e Merge remote-tracking branch 'upstream/master' into staging 2020-04-17 18:40:51 -04:00
Emily
7fdfe5381d linux_*_hardened: don't set FORTIFY_SOURCE 
Upstreamed in anthraxx/linux-hardened@d12c0d5f0c.
 2020-04-17 16:13:39 +01:00
Emily
ed89b5b3f1 linux_*_hardened: don't set PANIC_ON_OOPS 
Upstreamed in anthraxx/linux-hardened@366e0216f1.
 2020-04-17 16:13:39 +01:00
Emily
0d5f1697b7 linux_*_hardened: don't set SLAB_FREELIST_{RANDOM,HARDENED} 
Upstreamed in anthraxx/linux-hardened@786126f177,
anthraxx/linux-hardened@44822ebeb7.
 2020-04-17 16:13:39 +01:00
Emily
4fb796e341 linux_*_hardened: don't set HARDENED_USERCOPY_FALLBACK 
Upstreamed in anthraxx/linux-hardened@c1fe7a68e3,
anthraxx/linux-hardened@2c553a2bb1.
 2020-04-17 16:13:39 +01:00
Emily
3eeb5240ac linux_*_hardened: don't set DEBUG_LIST 
Upstreamed in anthraxx/linux-hardened@6b20124185.
 2020-04-17 16:13:39 +01:00
Emily
0611462e33 linux_*_hardened: don't set {,IO_}STRICT_DEVMEM 
STRICT_DEVMEM is on by default in upstream 5.6.2; IO_STRICT_DEVMEM is
turned on by anthraxx/linux-hardened@103d23cb66.

Note that anthraxx/linux-hardened@db1d27e10e
disables DEVMEM by default, so this is only relevant if that default is
overridden to turn it back on.
 2020-04-17 16:13:39 +01:00
Emily
303bb60fb1 linux_*_hardened: don't set DEBUG_WX 
Upstreamed in anthraxx/linux-hardened@55ee7417f3.
 2020-04-17 16:13:39 +01:00
Emily
33b94e5a44 linux_*_hardened: don't set BUG_ON_DATA_CORRUPTION 
Upstreamed in anthraxx/linux-hardened@3fcd15014c.
 2020-04-17 16:13:39 +01:00
Emily
db6b327508 linux_*_hardened: don't set LEGACY_VSYSCALL_NONE 
Upstreamed in anthraxx/linux-hardened@d300b0fdad.
 2020-04-17 16:13:39 +01:00
Emily
130f6812be linux_*_hardened: don't set RANDOMIZE_{BASE,MEMORY} 
These are on by default for x86 in upstream linux-5.6.2, and turned on
for arm64 by anthraxx/linux-hardened@90f9670bc3.
 2020-04-17 16:13:39 +01:00
Emily
8c68055432 linux_*_hardened: don't set MODIFY_LDT_SYSCALL 
Upstreamed in anthraxx/linux-hardened@05644876fa.
 2020-04-17 16:13:39 +01:00
Emily
8efe83c22e linux_*_hardened: don't set DEFAULT_MMAP_MIN_ADDR 
Upstreamed in anthraxx/linux-hardened@f1fe0a64dd.
 2020-04-17 16:13:39 +01:00
Emily
3d4c8ae901 linux_*_hardened: don't set VMAP_STACK 
This has been on by default upstream for as long as it's been an option.
 2020-04-17 16:13:39 +01:00
Emily
7d5352df31 linux_*_hardened: don't set X86_X32 
As far as I can tell, this has never defaulted to on upstream, and our
common kernel configuration doesn't turn it on, so the attack surface
reduction here is somewhat homeopathic.
 2020-04-17 16:13:39 +01:00
Emily
0d4f35efd4 linux_*_hardened: use linux-hardened patch set 
This is an updated version of the former upstream,
https://github.com/AndroidHardeningArchive/linux-hardened, and provides
a minimal set of additional hardening patches on top of upstream.

The patch already incorporates many of our hardened profile defaults,
and releases are timely (Linux 5.5.15 and 5.6.2 were released on
2020-04-02; linux-hardened patches for them came out on 2020-04-03 and
2020-04-04 respectively).
 2020-04-17 16:13:39 +01:00
Emily
3d01e802bd linux: explicitly enable SYSVIPC 
The linux-hardened patch set removes this default, probably because of
its original focus on Android kernel hardening.
 2020-04-17 16:12:29 +01:00
Tim Steinbach
e341107367
linux: 5.4.32 -> 5.4.33 2020-04-17 08:34:01 -04:00