diff options
Diffstat (limited to 'nixpkgs/nixos/modules/config/malloc.nix')
| -rw-r--r-- | nixpkgs/nixos/modules/config/malloc.nix | 22 |
1 files changed, 10 insertions, 12 deletions
diff --git a/nixpkgs/nixos/modules/config/malloc.nix b/nixpkgs/nixos/modules/config/malloc.nix index a3fed33afa18..ae0661f472f6 100644 --- a/nixpkgs/nixos/modules/config/malloc.nix +++ b/nixpkgs/nixos/modules/config/malloc.nix @@ -30,7 +30,7 @@ let systemPlatform = platformMap.${pkgs.stdenv.hostPlatform.system} or (throw "scudo not supported on ${pkgs.stdenv.hostPlatform.system}"); in { - libPath = "${pkgs.llvmPackages_latest.compiler-rt}/lib/linux/libclang_rt.scudo-${systemPlatform}.so"; + libPath = "${pkgs.llvmPackages_14.compiler-rt}/lib/linux/libclang_rt.scudo-${systemPlatform}.so"; description = '' A user-mode allocator based on LLVM Sanitizer’s CombinedAllocator, which aims at providing additional mitigations against heap based @@ -77,29 +77,27 @@ in environment.memoryAllocator.provider = mkOption { type = types.enum ([ "libc" ] ++ attrNames providers); default = "libc"; - description = '' + description = lib.mdDoc '' The system-wide memory allocator. Briefly, the system-wide memory allocator providers are: - <itemizedlist> - <listitem><para><literal>libc</literal>: the standard allocator provided by libc</para></listitem> - ${toString (mapAttrsToList - (name: value: "<listitem><para><literal>${name}</literal>: ${value.description}</para></listitem>") + + - `libc`: the standard allocator provided by libc + ${concatStringsSep "\n" (mapAttrsToList + (name: value: "- `${name}`: ${replaceStrings [ "\n" ] [ " " ] value.description}") providers)} - </itemizedlist> - <warning> - <para> + ::: {.warning} Selecting an alternative allocator (i.e., anything other than - <literal>libc</literal>) may result in instability, data loss, + `libc`) may result in instability, data loss, and/or service failure. - </para> - </warning> + ::: ''; }; }; config = mkIf (cfg.provider != "libc") { + boot.kernel.sysctl."vm.max_map_count" = mkIf (cfg.provider == "graphene-hardened") (mkDefault 1048576); environment.etc."ld-nix.so.preload".text = '' ${providerLibPath} ''; |