From d81067f3f3c1c82231eeca2b0e69b89d544ea028 Mon Sep 17 00:00:00 2001 From: "Ricardo M. Correia" Date: Wed, 10 Jun 2020 16:29:14 +0200 Subject: [PATCH] linux: fix fallout from conflicting kernel configs The parent commit forbids conflicting kernel config options. Fix the hardened kernels by allowing options in common-config.nix to be overridden by conflicting ones in hardened/config.nix. I'm explicitly avoiding using a higher priority (e.g. using mkForce) in hardened/config.nix so that the user can easily override the options in that file. --- pkgs/os-specific/linux/kernel/common-config.nix | 13 +++++++------ pkgs/os-specific/linux/kernel/hardened/config.nix | 10 +++++++++- 2 files changed, 16 insertions(+), 7 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index 24c992dc907d..62fe54bbe3fd 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -193,16 +193,17 @@ let NET_DROP_MONITOR = yes; # needed for ss - INET_DIAG = module; - INET_TCP_DIAG = module; - INET_UDP_DIAG = module; - INET_RAW_DIAG = whenAtLeast "4.14" module; - INET_DIAG_DESTROY = whenAtLeast "4.9" yes; + # Use a lower priority to allow these options to be overridden in hardened/config.nix + INET_DIAG = mkDefault module; + INET_TCP_DIAG = mkDefault module; + INET_UDP_DIAG = mkDefault module; + INET_RAW_DIAG = whenAtLeast "4.14" (mkDefault module); + INET_DIAG_DESTROY = whenAtLeast "4.9" (mkDefault yes); # enable multipath-tcp MPTCP = whenAtLeast "5.6" yes; MPTCP_IPV6 = whenAtLeast "5.6" yes; - INET_MPTCP_DIAG = whenAtLeast "5.9" module; + INET_MPTCP_DIAG = whenAtLeast "5.9" (mkDefault module); }; wireless = { diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix index bd0518650d6c..acffa383f076 100644 --- a/pkgs/os-specific/linux/kernel/hardened/config.nix +++ b/pkgs/os-specific/linux/kernel/hardened/config.nix @@ -65,7 +65,7 @@ assert (versionAtLeast version "4.9"); PANIC_TIMEOUT = freeform "-1"; GCC_PLUGINS = yes; # Enable gcc plugin options - # Gather additional entropy at boot time for systems that may = no;ot have appropriate entropy sources. + # Gather additional entropy at boot time for systems that may not have appropriate entropy sources. GCC_PLUGIN_LATENT_ENTROPY = yes; GCC_PLUGIN_STRUCTLEAK = whenAtLeast "4.11" yes; # A port of the PaX structleak plugin @@ -79,6 +79,14 @@ assert (versionAtLeast version "4.9"); PROC_KCORE = no; # Exposes kernel text image layout INET_DIAG = no; # Has been used for heap based attacks in the past + # INET_DIAG=n causes the following options to not exist anymore, but since they are defined in common-config.nix, + # make them optional + INET_DIAG_DESTROY = option no; + INET_RAW_DIAG = option no; + INET_TCP_DIAG = option no; + INET_UDP_DIAG = option no; + INET_MPTCP_DIAG = option no; + # Use -fstack-protector-strong (gcc 4.9+) for best stack canary coverage. CC_STACKPROTECTOR_REGULAR = whenOlder "4.18" no; CC_STACKPROTECTOR_STRONG = whenOlder "4.18" yes;