From 831024e2b93782519b3b5a998473434a0eb5d401 Mon Sep 17 00:00:00 2001 From: pennae Date: Wed, 22 Dec 2021 18:23:48 +0100 Subject: [PATCH] nixos/dhcpcd: assert if privSep && alternative malloc dhcpcd does not run properly with some of the hardened system mallocs that are currently available. assert when an incompatible configuration is detected, as a switch into such a config from eg auto-update can take hosts offline. --- nixos/modules/services/networking/dhcpcd.nix | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/nixos/modules/services/networking/dhcpcd.nix b/nixos/modules/services/networking/dhcpcd.nix index 2c339350acd3..3eb7ca99eafd 100644 --- a/nixos/modules/services/networking/dhcpcd.nix +++ b/nixos/modules/services/networking/dhcpcd.nix @@ -183,6 +183,20 @@ in config = mkIf enableDHCP { + assertions = [ { + # dhcpcd doesn't start properly with malloc ∉ [ libc scudo ] + # see https://github.com/NixOS/nixpkgs/issues/151696 + assertion = + dhcpcd.enablePrivSep + -> elem config.environment.memoryAllocator.provider [ "libc" "scudo" ]; + message = '' + dhcpcd with privilege separation is incompatible with chosen system malloc. + Currently only the `libc` and `scudo` allocators are known to work. + To disable dhcpcd's privilege separation, overlay Nixpkgs and override dhcpcd + to set `enablePrivSep = false`. + ''; + } ]; + systemd.services.dhcpcd = let cfgN = config.networking; hasDefaultGatewaySet = (cfgN.defaultGateway != null && cfgN.defaultGateway.address != "")