diff options
| author | Joachim Fasting <joachifm@fastmail.fm> | 2016-05-06 15:22:40 +0200 |
|---|---|---|
| committer | Joachim Fasting <joachifm@fastmail.fm> | 2016-05-06 16:37:25 +0200 |
| commit | 50d915c758efca9237144d64312289e012c049ef (patch) | |
| tree | 3b46941fb03cc7424c87d25d9b5325100acc6fe8 /pkgs/build-support | |
| parent | 27061905bd149151ad10bbc0f634955c397f27db (diff) | |
| download | nixlib-50d915c758efca9237144d64312289e012c049ef.tar nixlib-50d915c758efca9237144d64312289e012c049ef.tar.gz nixlib-50d915c758efca9237144d64312289e012c049ef.tar.bz2 nixlib-50d915c758efca9237144d64312289e012c049ef.tar.lz nixlib-50d915c758efca9237144d64312289e012c049ef.tar.xz nixlib-50d915c758efca9237144d64312289e012c049ef.tar.zst nixlib-50d915c758efca9237144d64312289e012c049ef.zip | |
grsecurity: optionally disable features for redistributed kernels
Diffstat (limited to 'pkgs/build-support')
| -rw-r--r-- | pkgs/build-support/grsecurity/default.nix | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/pkgs/build-support/grsecurity/default.nix b/pkgs/build-support/grsecurity/default.nix index d8042d652732..e06c02a294f6 100644 --- a/pkgs/build-support/grsecurity/default.nix +++ b/pkgs/build-support/grsecurity/default.nix @@ -15,6 +15,7 @@ let unrestrictProcGid = 121; # Ugh, an awful hack. See grsecurity NixOS gid disableRBAC = false; disableSimultConnect = false; + redistKernel = true; verboseVersion = false; kernelExtraConfig = ""; } // grsecOptions.config; @@ -91,6 +92,12 @@ let GRKERNSEC y ${grsecMainConfig} + # Disable features rendered useless by redistributing the kernel + ${optionalString cfg.config.redistKernel '' + GRKERNSEC_RANDSTRUCT n + GRKERNSEC_HIDESYM n + ''} + # The paxmarks mechanism relies on ELF header markings, but the default # grsecurity configuration only enables xattr markings PAX_PT_PAX_FLAGS y |