diff options
author | Joachim Fasting <joachifm@fastmail.fm> | 2016-11-28 12:04:51 +0100 |
---|---|---|
committer | Joachim Fasting <joachifm@fastmail.fm> | 2016-11-28 12:11:04 +0100 |
commit | e99228db3014131255e19b88ba78e47b46a4bff8 (patch) | |
tree | 9694ad1fb32139759bc60fa2a5a9d09c4f4ee110 /nixos | |
parent | 5da1394a587a9123f07a55d2bf8d9966df907c10 (diff) | |
download | nixlib-e99228db3014131255e19b88ba78e47b46a4bff8.tar nixlib-e99228db3014131255e19b88ba78e47b46a4bff8.tar.gz nixlib-e99228db3014131255e19b88ba78e47b46a4bff8.tar.bz2 nixlib-e99228db3014131255e19b88ba78e47b46a4bff8.tar.lz nixlib-e99228db3014131255e19b88ba78e47b46a4bff8.tar.xz nixlib-e99228db3014131255e19b88ba78e47b46a4bff8.tar.zst nixlib-e99228db3014131255e19b88ba78e47b46a4bff8.zip |
grsecurity module: force a known good kernel package set
Previously, we would only set a default value, on the theory that `boot.kernelPackages` could be used to sanely configure a custom grsec kernel. Regrettably, this is not the case and users who expect e.g., `boot.kernelPackages = pkgs.linuxPackages_latest` to work will end up with a non-grsec kernel (this problem has come up twice on the bug tracker recently). With this patch, `security.grsecurity.enable = true` implies `boot.kernelPackages = linuxPackages_grsec_nixos` and any customization must be done via package override or by eschewing the module.
Diffstat (limited to 'nixos')
-rw-r--r-- | nixos/modules/security/grsecurity.nix | 2 | ||||
-rw-r--r-- | nixos/modules/security/grsecurity.xml | 44 |
2 files changed, 33 insertions, 13 deletions
diff --git a/nixos/modules/security/grsecurity.nix b/nixos/modules/security/grsecurity.nix index ea245ecc5b6a..92afb74956eb 100644 --- a/nixos/modules/security/grsecurity.nix +++ b/nixos/modules/security/grsecurity.nix @@ -57,7 +57,7 @@ in config = mkIf cfg.enable { - boot.kernelPackages = mkDefault pkgs.linuxPackages_grsec_nixos; + boot.kernelPackages = mkForce pkgs.linuxPackages_grsec_nixos; boot.kernelParams = optional cfg.disableEfiRuntimeServices "noefi"; diff --git a/nixos/modules/security/grsecurity.xml b/nixos/modules/security/grsecurity.xml index 6f9884336b1e..e41748358fbb 100644 --- a/nixos/modules/security/grsecurity.xml +++ b/nixos/modules/security/grsecurity.xml @@ -51,6 +51,13 @@ # nixos-rebuild boot # reboot </programlisting> + <note><para> + Enabling the grsecurity module overrides + <option>boot.kernelPackages</option>, to reduce the risk of + misconfiguration. <xref linkend="sec-grsec-custom-kernel" /> + describes how to use a custom kernel package set. + </para></note> + For most users, further configuration should be unnecessary. All users are encouraged to look over <xref linkend="sec-grsec-security" /> before using the system, however. If you experience problems, please refer to @@ -205,21 +212,22 @@ </para> <para> - To use a custom kernel with upstream's recommended settings for server - deployments: + To build a custom kernel using upstream's recommended settings for server + deployments, while still using the NixOS module: <programlisting> - boot.kernelPackages = - let - kernel = pkgs.linux_grsec_nixos.override { - extraConfig = '' - GRKERNSEC_CONFIG_AUTO y - GRKERNSEC_CONFIG_SERVER y - GRKERNSEC_CONFIG_SECURITY y - ''; + nixpkgs.config.packageOverrides = super: { + linux_grsec_nixos = super.linux_grsec_nixos.override { + extraConfig = '' + GRKERNSEC_CONFIG_AUTO y + GRKERNSEC_CONFIG_SERVER y + GRKERNSEC_CONFIG_SECURITY y + ''; }; - self = pkgs.linuxPackagesFor kernel self; - in self; + } </programlisting> + </para> + + <para> The wikibook provides an exhaustive listing of <link xlink:href="https://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity_and_PaX_Configuration_Options">kernel configuration options</link>. </para> @@ -228,6 +236,18 @@ The NixOS module makes several assumptions about the kernel and so may be incompatible with your customised kernel. Currently, the only way to work around incompatibilities is to eschew the NixOS module. + + If not using the NixOS module, a custom grsecurity package set can + be specified inline instead, as in + <programlisting> + boot.kernelPackages = + let + kernel = pkgs.linux_grsec_nixos.override { + extraConfig = /* as above */; + }; + self = pkgs.linuxPackagesFor kernel self; + in self; + </programlisting> </para> </sect1> |