Merge pull request #84522 from emilazy/add-linux-hardened-patches

linux_*_hardened: use linux-hardened patch set

5 files changed, 14 insertions, 41 deletions

diff --git a/nixos/modules/profiles/hardened.nix b/nixos/modules/profiles/hardened.nix
index 35743d83134b..ef8c0d74f062 100644
--- a/nixos/modules/profiles/hardened.nix
+++ b/nixos/modules/profiles/hardened.nix
@@ -7,7 +7,7 @@ with lib;
 
 {
   meta = {
-    maintainers = [ maintainers.joachifm ];
+    maintainers = [ maintainers.joachifm maintainers.emily ];
   };
 
   boot.kernelPackages = mkDefault pkgs.linuxPackages_hardened;
@@ -21,8 +21,6 @@ with lib;
 
   security.lockKernelModules = mkDefault true;
 
-  security.allowUserNamespaces = mkDefault false;
-
   security.protectKernelImage = mkDefault true;
 
   security.allowSimultaneousMultithreading = mkDefault false;
@@ -37,15 +35,9 @@ with lib;
     # Slab/slub sanity checks, redzoning, and poisoning
     "slub_debug=FZP"
 
-    # Disable slab merging to make certain heap overflow attacks harder
-    "slab_nomerge"
-
     # Overwrite free'd memory
     "page_poison=1"
 
-    # Disable legacy virtual syscalls
-    "vsyscall=none"
-
     # Enable page allocator randomization
     "page_alloc.shuffle=1"
   ];
@@ -82,38 +74,12 @@ with lib;
   # (e.g., parent/child)
   boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkOverride 500 1;
 
-  # Restrict access to kernel ring buffer (information leaks)
-  boot.kernel.sysctl."kernel.dmesg_restrict" = mkDefault true;
-
   # Hide kptrs even for processes with CAP_SYSLOG
   boot.kernel.sysctl."kernel.kptr_restrict" = mkOverride 500 2;
 
-  # Unprivileged access to bpf() has been used for privilege escalation in
-  # the past
-  boot.kernel.sysctl."kernel.unprivileged_bpf_disabled" = mkDefault true;
-
   # Disable bpf() JIT (to eliminate spray attacks)
   boot.kernel.sysctl."net.core.bpf_jit_enable" = mkDefault false;
 
-  # ... or at least apply some hardening to it
-  boot.kernel.sysctl."net.core.bpf_jit_harden" = mkDefault true;
-
-  # Raise ASLR entropy for 64bit & 32bit, respectively.
-  #
-  # Note: mmap_rnd_compat_bits may not exist on 64bit.
-  boot.kernel.sysctl."vm.mmap_rnd_bits" = mkDefault 32;
-  boot.kernel.sysctl."vm.mmap_rnd_compat_bits" = mkDefault 16;
-
-  # Allowing users to mmap() memory starting at virtual address 0 can turn a
-  # NULL dereference bug in the kernel into code execution with elevated
-  # privilege.  Mitigate by enforcing a minimum base addr beyond the NULL memory
-  # space.  This breaks applications that require mapping the 0 page, such as
-  # dosemu or running 16bit applications under wine.  It also breaks older
-  # versions of qemu.
-  #
-  # The value is taken from the KSPP recommendations (Debian uses 4096).
-  boot.kernel.sysctl."vm.mmap_min_addr" = mkDefault 65536;
-
   # Disable ftrace debugging
   boot.kernel.sysctl."kernel.ftrace_enabled" = mkDefault false;
 
@@ -140,7 +106,4 @@ with lib;
   # Ignore outgoing ICMP redirects (this is ipv4 only)
   boot.kernel.sysctl."net.ipv4.conf.all.send_redirects" = mkDefault false;
   boot.kernel.sysctl."net.ipv4.conf.default.send_redirects" = mkDefault false;
-
-  # Restrict userfaultfd syscalls to processes with the SYS_PTRACE capability
-  boot.kernel.sysctl."vm.unprivileged_userfaultfd" = mkDefault false;
 }
diff --git a/nixos/release-combined.nix b/nixos/release-combined.nix
index 02f19610f8a6..87783c660953 100644
--- a/nixos/release-combined.nix
+++ b/nixos/release-combined.nix
@@ -75,6 +75,7 @@ in rec {
         (onFullSupported "nixos.tests.fontconfig-default-fonts")
         (onFullSupported "nixos.tests.gnome3")
         (onFullSupported "nixos.tests.gnome3-xorg")
+        (onFullSupported "nixos.tests.hardened")
         (onSystems ["x86_64-linux"] "nixos.tests.hibernate")
         (onFullSupported "nixos.tests.i3wm")
         (onSystems ["x86_64-linux"] "nixos.tests.installer.btrfsSimple")
@@ -96,6 +97,8 @@ in rec {
         (onFullSupported "nixos.tests.keymap.dvp")
         (onFullSupported "nixos.tests.keymap.neo")
         (onFullSupported "nixos.tests.keymap.qwertz")
+        (onFullSupported "nixos.tests.latestKernel.hardened")
+        (onFullSupported "nixos.tests.latestKernel.login")
         (onFullSupported "nixos.tests.lightdm")
         (onFullSupported "nixos.tests.login")
         (onFullSupported "nixos.tests.misc")
diff --git a/nixos/release-small.nix b/nixos/release-small.nix
index 6da2c59cedd4..ed7bbd81138f 100644
--- a/nixos/release-small.nix
+++ b/nixos/release-small.nix
@@ -101,6 +101,7 @@ in rec {
         "nixos.tests.installer.separateBoot.x86_64-linux"
         "nixos.tests.installer.simple.x86_64-linux"
         "nixos.tests.ipv6.x86_64-linux"
+        "nixos.tests.latestKernel.login.x86_64-linux"
         "nixos.tests.login.x86_64-linux"
         "nixos.tests.misc.x86_64-linux"
         "nixos.tests.nat.firewall-conntrack.x86_64-linux"
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 5adfd6afd6a7..e52eb0d54824 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -160,6 +160,7 @@ in
   # kubernetes.e2e should eventually replace kubernetes.rbac when it works
   #kubernetes.e2e = handleTestOn ["x86_64-linux"] ./kubernetes/e2e.nix {};
   kubernetes.rbac = handleTestOn ["x86_64-linux"] ./kubernetes/rbac.nix {};
+  latestKernel.hardened = handleTest ./hardened.nix { latestKernel = true; };
   latestKernel.login = handleTest ./login.nix { latestKernel = true; };
   ldap = handleTest ./ldap.nix {};
   leaps = handleTest ./leaps.nix {};
diff --git a/nixos/tests/hardened.nix b/nixos/tests/hardened.nix
index cbf76f9e5587..5ed0dfcf9ab8 100644
--- a/nixos/tests/hardened.nix
+++ b/nixos/tests/hardened.nix
@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test.nix ({ pkgs, latestKernel ? false, ... } : {
   name = "hardened";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [ joachifm ];
@@ -10,6 +10,8 @@ import ./make-test.nix ({ pkgs, ...} : {
     { users.users.alice = { isNormalUser = true; extraGroups = [ "proc" ]; };
       users.users.sybil = { isNormalUser = true; group = "wheel"; };
       imports = [ ../modules/profiles/hardened.nix ];
+      boot.kernelPackages =
+        lib.mkIf latestKernel pkgs.linuxPackages_latest_hardened;
       environment.memoryAllocator.provider = "graphene-hardened";
       nix.useSandbox = false;
       virtualisation.emptyDiskImages = [ 4096 ];
@@ -23,7 +25,9 @@ import ./make-test.nix ({ pkgs, ...} : {
           options = [ "noauto" ];
         };
       };
-      boot.extraModulePackages = [ config.boot.kernelPackages.wireguard ];
+      boot.extraModulePackages =
+        optional (versionOlder config.boot.kernelPackages.kernel.version "5.6")
+          config.boot.kernelPackages.wireguard;
       boot.kernelModules = [ "wireguard" ];
     };
 
@@ -76,7 +80,8 @@ import ./make-test.nix ({ pkgs, ...} : {
 
       # Test userns
       subtest "userns", sub {
-          $machine->fail("unshare --user");
+          $machine->succeed("unshare --user true");
+          $machine->fail("su -l alice -c 'unshare --user true'");
       };
 
       # Test dmesg restriction