BoomMicrophone/nixpkgs-suyu
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

nixos/hardened profile: disable legacy virtual syscalls

Browse source 
This eliminates a theoretical risk of ASLR bypass due to the fixed address
mapping used by the legacy vsyscall mechanism.  Modern glibc use vdso(7)
instead so there is no loss of functionality, but some programs may fail
to run in this configuration.  Programs that fail to run because vsyscall
has been disabled will be logged to dmesg.

For background on virtual syscalls see https://lwn.net/Articles/446528/

Closes https://github.com/NixOS/nixpkgs/pull/25289
This commit is contained in:
Joachim Fasting 2017-04-29 17:27:08 +02:00
parent f1c7d5a6ba
commit 63433537ce
No known key found for this signature in database
GPG key ID: 7544761007FE4E08
1 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
nixos/modules/profiles/hardened.nix
View file

@ -10,6 +10,11 @@ with lib;
security.apparmor.enable = mkDefault true; security.apparmor.enable = mkDefault true;
boot.kernelParams = [
# Disable legacy virtual syscalls
"vsyscall=none"
];
# Restrict ptrace() usage to processes with a pre-defined relationship # Restrict ptrace() usage to processes with a pre-defined relationship
# (e.g., parent/child) # (e.g., parent/child)
boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkOverride 500 1; boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkOverride 500 1;