Commit graph

2885 commits

Author SHA1 Message Date
Matthieu Coudron
7aacbdb898 linux: convert hardened-config to a structured one 2019-01-28 09:07:24 +09:00
Matthieu Coudron
3bb7b3f02e linux: ability to merge structured configs
This should make the composability of kernel configurations more straigthforward.

- now distinguish freeform options from tristate ones
- will look for a structured config in kernelPatches too
one can now access the structuredConfig from a kernel via linux_test.configfile.structuredConfig
in order to reinject it into another kernel, no need to rewrite the config from scratch

The following merge strategies are used in case of conflict:
-- freeform items must be equal or they conflict (mergeEqualOption)
-- for tristate (y/m/n) entries, I use the mergeAnswer strategy which takes the best available value, "best" being defined by the user (by default "y" > "m" > "n", e.g. if one entry is both marked "y" and "n", "y" wins)
-- if one item is both marked optional/mandatory, mandatory wins (mergeFalseByDefault)
2019-01-28 09:06:33 +09:00
Tim Steinbach
39fdfd0eb1
linux: 4.20.4 -> 4.20.5 2019-01-27 16:12:13 -05:00
Tim Steinbach
4ab5604c85
linux: 4.19.17 -> 4.19.18 2019-01-27 16:12:13 -05:00
Tim Steinbach
19505bb8d1
linux: 4.14.95 -> 4.14.96 2019-01-27 16:12:12 -05:00
Tim Steinbach
4606793349
linux: 4.9.152 -> 4.9.153 2019-01-27 16:12:12 -05:00
Tim Steinbach
6df6bb42b5
linux: 4.4.171 -> 4.4.172 2019-01-27 16:12:12 -05:00
Joachim F
f6414428ed
Merge pull request #53511 from joachifm/kernel-32bit-emu-feature-flag
linux: flag to indicate 32bit emulation support
2019-01-25 14:13:45 +00:00
Tim Steinbach
8ee43e01fa
linux: 4.9.151 -> 4.9.152 2019-01-23 07:10:45 -05:00
Tim Steinbach
6da5e2d45f
linux: 4.20.3 -> 4.20.4 2019-01-23 07:10:35 -05:00
Tim Steinbach
1b8beae40b
linux: 4.19.16 -> 4.19.17 2019-01-23 07:10:27 -05:00
Tim Steinbach
5f0a4ee69f
linux: 4.14.94 -> 4.14.95 2019-01-23 07:10:18 -05:00
Tim Steinbach
538ce21fe8
linux: 5.0-rc2 -> 5.0-rc3 2019-01-21 08:14:14 -05:00
Vladimír Čunát
3fa77297b5
linux: avoid memory hotplug support on most platforms
It broke i686 build, and it's probably not worth it on others, too.
/cc #54095 e63414078a.
2019-01-19 19:22:02 +01:00
Vladimír Čunát
23eb5e846d
Merge #54095: linux: enable memory hotplug support 2019-01-19 16:26:01 +01:00
Aaron Andersen
e63414078a Enable memory hotplug support 2019-01-18 13:17:33 +00:00
Danylo Hlynskyi
23a13b562c
kernel config: add support for CONFIG_SQUASHFS_ZSTD (#52967)
Also, allow override `make-squashfs.nix` compression parameters.
2019-01-17 15:24:44 +02:00
Tim Steinbach
bae1a0f825
linux: 4.20.2 -> 4.20.3 2019-01-17 06:56:20 -05:00
Tim Steinbach
b4ab6ffb7f
linux: 4.19.15 -> 4.19.16 2019-01-17 06:56:08 -05:00
Tim Steinbach
6ad56550e4
linux: 4.14.93 -> 4.14.94 2019-01-17 06:55:59 -05:00
Tim Steinbach
1e62588421
linux: 4.9.150 -> 4.9.151 2019-01-17 06:55:42 -05:00
Tim Steinbach
2833865206
linux: 4.4.170 -> 4.4.171 2019-01-17 06:55:31 -05:00
Tim Steinbach
429166fea2
linux: 5.0-rc1 -> 5.0-rc2 2019-01-14 09:24:39 -05:00
Tim Steinbach
bddaa4bc16
linux: 4.20.1 -> 4.20.2 2019-01-13 15:50:00 -05:00
Tim Steinbach
bbc1f0c452
linux: 4.19.14 -> 4.19.15 2019-01-13 15:50:00 -05:00
Tim Steinbach
0a8b109e81
linux: 4.14.92 -> 4.14.93 2019-01-13 15:49:59 -05:00
Tim Steinbach
887fd04623
linux: 4.9.149 -> 4.9.150 2019-01-13 15:49:59 -05:00
Tim Steinbach
c88c0538ea
linux: 4.4.169 -> 4.4.170 2019-01-13 15:49:59 -05:00
Pierre Bourdon
b26c824da3
Revert "Revert "Revert "linux-hardened: Disable GCC_PLUGIN_RANDSTRUCT"""
The issue with out-of-tree modules has been addressed and the feature
should now be good to re-enable again.

This reverts commit 865f7a14b4.
2019-01-11 12:35:16 +01:00
Pierre Bourdon
1b9bf8fa75
kernel: make the RANDSTRUCT seed deterministic 2019-01-11 12:35:16 +01:00
Tim Steinbach
20f9b5d10a
linux: 4.19.13 -> 4.19.14 2019-01-09 12:10:11 -05:00
Tim Steinbach
39173bff87
linux: 4.20 -> 4.20.1 2019-01-09 11:59:35 -05:00
Tim Steinbach
d55b3c9bf0
linux: 4.14.91 -> 4.14.92 2019-01-09 11:24:45 -05:00
Tim Steinbach
ec3e81beaf
linux: 4.9.148 -> 4.9.149 2019-01-09 11:03:10 -05:00
Bastian Köcher
a90fc6d3ef linux: Adds patch for fixing wifi on raspberry pi 2019-01-09 11:18:09 +01:00
Joachim Fasting
865f7a14b4
Revert "Revert "linux-hardened: Disable GCC_PLUGIN_RANDSTRUCT""
This reverts commit c68e8b05f0.

RANDSTRUCT currently fails to work with out-of-tree modules, as
evinced by
c68e8b05f0 (commitcomment-31850284)
and https://github.com/NixOS/nixpkgs/issues/53522.

Specifically, loading out-of-tree modules results in modsym version
mismatches, as in
   spl: version magic '4.20.0 SMP mod_unload modversions RANDSTRUCT_PLUGIN
from the issue above.

A working hypothesis is that the randstruct seed is not carried over when
building out-of-tree modules but more investigation is needed here.

Closes https://github.com/NixOS/nixpkgs/issues/53522
2019-01-07 19:50:12 +01:00
Tim Steinbach
97aba92bcd
linux: 4.20-rc7 -> 5.0-rc1 2019-01-07 07:57:38 -05:00
Joachim Fasting
6eea9ac868
linux: add feature flag to indicate support for 32bit emulation
Motivated by the need to warn users trying to build configurations that depend
on being able to run 32bit apps on 64bit kernels.
2019-01-06 19:52:03 +01:00
Joachim Fasting
d62086e6fc
hardened-config: allow slub/slab free poisoning 2019-01-05 14:07:36 +01:00
Joachim Fasting
11840f5c70
hardened-config: explain HARDENED_USERCOPY_FALLBACK n 2019-01-05 14:07:36 +01:00
Joachim Fasting
dfd77a046d
hardened-config: ensure STRICT_KERNEL_RWX
This is y in the default config, but enable it explicitly here to catch
situations where it has been disabled (explicitly or implicitly).
2019-01-05 14:07:35 +01:00
Joachim Fasting
1801aad7b8
hardened-config: clarify MODIFY_LDT_SYSCALL
This likely never worked; MODIFY_LDT_SYSCALL depends on EXPERT; enabling
EXPERT however seems to introduce quite a few changes that would need to be
properly vetted.

The version guard is unnecessary, however, as this config has been supported
since 4.3.
2019-01-05 14:07:34 +01:00
Joachim Fasting
abc8ed3fca
hardened-config: clarify readonly LSM hooks config
SECURITY_WRITABLE_HOOKS is implicitly controlled by SECURITY_SELINUX_DISABLE;
explicitly unsetting results in an error because the configfile builder fails
to detect that it has in fact been unset (reporting it as an unused option).
For now, leave WRITABLE_HOOKS as an "optional" config for documentation
purposes.
2019-01-05 14:07:33 +01:00
Joachim Fasting
c68e8b05f0
Revert "linux-hardened: Disable GCC_PLUGIN_RANDSTRUCT"
This reverts commit 5dda1324be.

Presumably this was done to work around build errors or something but it
works fine now.
2019-01-05 14:07:21 +01:00
Pierre Bourdon
0f7ca26a48
kernel/hardened-config.nix: add STACKLEAK plugin on 4.20+ 2019-01-04 22:24:50 +01:00
Pierre Bourdon
9dc0d94896
kernel/hardened-config.nix: re-enable GCC plugins 2019-01-04 22:24:50 +01:00
Pierre Bourdon
c789f642f0
kernel/generic.nix: provide required dependencies for GCC plugins builds 2019-01-04 22:24:50 +01:00
Benno Fünfstück
7817aa3641
linux-rpi: set correct hydraPlatforms (#53325) 2019-01-03 22:42:14 +01:00
Joachim F
88c516dd55
Merge pull request #52606 from lopsided98/linux-hardkernel-update
linux_hardkernel_4_14: 4.14.85-152 -> 4.14.87-153
2019-01-02 18:16:47 +00:00
Tim Steinbach
d6805baded
linux: 4.19.12 -> 4.19.13 2018-12-30 09:57:54 -05:00