diff options
author | Joachim Fasting <joachifm@fastmail.fm> | 2019-04-23 22:16:22 +0200 |
---|---|---|
committer | Joachim Fasting <joachifm@fastmail.fm> | 2019-05-07 13:45:38 +0200 |
commit | a84be28270fe0d51d372f06d4c49ffc9ea9bf195 (patch) | |
tree | fbbaddd2c88387a45442b1ef5850357ee2f7b6e7 /nixos/modules | |
parent | 4b201f6c5797ed44f0fc044c1fcc21d949c87199 (diff) | |
download | nixlib-a84be28270fe0d51d372f06d4c49ffc9ea9bf195.tar nixlib-a84be28270fe0d51d372f06d4c49ffc9ea9bf195.tar.gz nixlib-a84be28270fe0d51d372f06d4c49ffc9ea9bf195.tar.bz2 nixlib-a84be28270fe0d51d372f06d4c49ffc9ea9bf195.tar.lz nixlib-a84be28270fe0d51d372f06d4c49ffc9ea9bf195.tar.xz nixlib-a84be28270fe0d51d372f06d4c49ffc9ea9bf195.tar.zst nixlib-a84be28270fe0d51d372f06d4c49ffc9ea9bf195.zip |
nixos/malloc: configure system-wide malloc provider
Currently, this uses the somewhat crude method of setting LD_PRELOAD in the system environment. This works, but should be considered a stepping stone to a more robust solution.
Diffstat (limited to 'nixos/modules')
-rw-r--r-- | nixos/modules/config/malloc.nix | 91 | ||||
-rw-r--r-- | nixos/modules/module-list.nix | 1 |
2 files changed, 92 insertions, 0 deletions
diff --git a/nixos/modules/config/malloc.nix b/nixos/modules/config/malloc.nix new file mode 100644 index 000000000000..7a42b0803be5 --- /dev/null +++ b/nixos/modules/config/malloc.nix @@ -0,0 +1,91 @@ +{ config, lib, pkgs, ... }: +with lib; + +let + cfg = config.environment.memoryAllocator; + + # The set of alternative malloc(3) providers. + providers = { + "graphene-hardened" = rec { + libPath = "${pkgs.graphene-hardened-malloc}/lib/libhardened_malloc.so"; + description = '' + An allocator designed to mitigate memory corruption attacks, such as + those caused by use-after-free bugs. + ''; + }; + + "jemalloc" = { + libPath = "${pkgs.jemalloc}/lib/libjemalloc.so"; + description = '' + A general purpose allocator that emphasizes fragmentation avoidance + and scalable concurrency support. + ''; + }; + }; + + providerConf = providers."${cfg.provider}"; + + # An output that contains only the shared library, to avoid + # needlessly bloating the system closure + mallocLib = pkgs.runCommand "malloc-provider-${cfg.provider}" + rec { + preferLocalBuild = true; + allowSubstitutes = false; + origLibPath = providerConf.libPath; + libName = baseNameOf origLibPath; + } + '' + mkdir -p $out/lib + cp -L $origLibPath $out/lib/$libName + ''; + + # The full path to the selected provider shlib. + providerLibPath = "${mallocLib}/lib/${mallocLib.libName}"; +in + +{ + meta = { + maintainers = [ maintainers.joachifm ]; + }; + + options = { + environment.memoryAllocator.provider = mkOption { + type = types.enum ([ "libc" ] ++ attrNames providers); + default = "libc"; + description = '' + The system-wide memory allocator. + </para> + + <para> + Briefly, the system-wide memory allocator providers are: + <itemizedlist> + <listitem><para><literal>libc</literal>: the standard allocator provided by libc</para></listitem> + ${toString (mapAttrsToList + (name: value: "<listitem><para><literal>${name}</literal>: ${value.description}</para></listitem>") + providers)} + </itemizedlist> + </para> + + <warning> + <para> + Selecting an alternative allocator (i.e., anything other than + <literal>libc</literal>) may result in instability, data loss, + and/or service failure. + </para> + </warning> + + <note> + <para> + Changing this option does not affect the current session. + </para> + </note> + + <para> + ''; + }; + }; + + config = mkIf (cfg.provider != "libc") { + environment.variables.LD_PRELOAD = providerLibPath; + }; +} diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index c97e9f01ad77..6cf0a47043bc 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -19,6 +19,7 @@ ./config/iproute2.nix ./config/krb5/default.nix ./config/ldap.nix + ./config/malloc.nix ./config/networking.nix ./config/no-x-libs.nix ./config/nsswitch.nix |