summary refs log tree commit diff
path: root/nixos/modules/security
Commit message (Collapse)AuthorAge
* nixos manual: move chapter on grsecurity to auto-generated module docsJoachim Fasting2016-08-29
|
* Merge pull request #15025 from ericsagnes/modules/manualDomen Kožar2016-08-28
|\ | | | | manual: automatically generate modules documentation
| * modules: move meta at top levelEric Sagnes2016-08-11
| |
* | Merge pull request #11484 from oxij/nixos-toposort-filesystemsNikolay Amiantov2016-08-27
|\ \ | | | | | | lib: add toposort, nixos: use toposort for fileSystems to properly support bind and move mounts
| * | nixos: apply toposort to fileSystems to support bind and move mountsJan Malakhovski2016-08-23
| | | | | | | | | | | | And use new `config.system.build.fileSystems` property everywhere.
* | | ldap: Add option for login PAM integrationMarkus Mueller2016-08-23
|/ /
* | grsecurity module: systemd-nspawn requires cap_sys_adminJoachim Fasting2016-08-15
| | | | | | | | | | | | As with 9ca3504a798291fbd7c49fcfeec8b64daa2022ad Closes https://github.com/NixOS/nixpkgs/issues/17714
* | grsecurity module: permit chmod +s in sandboxed buildsJoachim Fasting2016-08-15
|/ | | | | | | | | While useless, some builds may dabble with setuid bits (e.g., util-linux), which breaks under grsec. In the interest of user friendliness, we once again compromise by disabling an otherwise useful feature ... Closes https://github.com/NixOS/nixpkgs/issues/17501
* chromium-suid-sandbox module: fix descriptionNikolay Amiantov2016-08-08
|
* chromium: add nixos module security.chromiumSuidSandboxobadz2016-08-06
| | | | | | | | | | | | Closes #17460 Changed the wrapper derivation to produce a second output containing the sandbox. Add a launch wrapper to try and locate the sandbox (either in /var/setuid-wrappers or in /nix/store). This launch wrapper also sheds libredirect.so from LD_PRELOAD as Chromium does not tolerate it. Does not trigger a Chromium rebuild. cc @cleverca22 @joachifm @jasom
* grsecurity module: disable EFI runtime services by defaultJoachim Fasting2016-08-02
| | | | | | | | | | | | | | | Enabling EFI runtime services provides a venue for injecting code into the kernel. When grsecurity is enabled, we close this by default by disabling access to EFI runtime services. The upshot of this is that /sys/firmware/efi/efivars will be unavailable by default (and attempts to mount it will fail). This is not strictly a grsecurity related option, it could be made into a general option, but it seems to be of particular interest to grsecurity users (for non-grsecurity users, there are other, more immediate kernel injection attack dangers to contend with anyway).
* grsecurity module: correct internal noteJoachim Fasting2016-08-01
|
* grsecurity module: assert RBAC support in kernelJoachim Fasting2016-07-24
|
* grsecurity module: add gradm to system pathJoachim Fasting2016-07-24
|
* grsecurity module: tweak lockTunables option descriptionJoachim Fasting2016-07-16
|
* grsecurity module: grsecurity is not capitalized mid-sentenceJoachim Fasting2016-07-16
|
* grsecurity module: smarter container supportJoachim Fasting2016-07-16
| | | | Only set tunables required for container support if there are any containers.
* grsecurity module: enforce size overflows by defaultJoachim Fasting2016-07-16
| | | | | It is better to make this conditional on whether the configuration contains a known size overflow that could prevent the system from booting.
* Merge pull request #16180 from zimbatm/shell-escapingzimbatm2016-06-19
|\ | | | | Escape all shell arguments uniformly
| * Escape all shell arguments uniformlyzimbatm2016-06-12
| |
* | nixos: rewrite the grsecurity moduleJoachim Fasting2016-06-14
|/ | | | | | | | | | | | | | | | | The new module is specifically adapted to the NixOS Grsecurity/PaX kernel. The module declares the required kernel configurations and so *should* be somewhat compatible with custom Grsecurity kernels. The module exposes only a limited number of options, minimising the need for user intervention beyond enabling the module. For experts, Grsecurity/PaX behavior may be configured via `boot.kernelParams` and `boot.kernel.sysctl`. The module assumes the user knows what she's doing (esp. if she decides to modify configuration values not directly exposed by the module). Administration of Grsecurity's role based access control system is yet to be implemented.
* acme: added option `security.acme.preliminarySelfsigned` (#15562)Bob van der Linden2016-06-01
|
* setuid-wrappers: remove config.system.path from the closureDomen Kožar2016-05-23
| | | | | | | | | | | | | | | | | The motivation is using sudo in chroot nix builds, a somewhat special edge case I have and pulling system path into chroot yields to some very nasty bug like https://github.com/NixOS/nixpkgs/issues/15581 Previously: $ cat /var/setuid-wrappers/sudo.real /nix/store/3sm04dzh0994r86xqxy52jjc0lqnkn65-system-path/bin/sudo After the change: $ cat /var/setuid-wrappers/sudo.real /nix/store/4g9sxbzy8maxf1v217ikp69c0c3q12as-sudo-1.8.15/bin/sudo
* nixos/i3lock-color: added to pamRok Garbas2016-05-15
|
* grsecurity: add option to disable chroot caps restrictionJoachim Fasting2016-05-10
| | | | | | | | | The chroot caps restriction disallows chroot'ed processes from running any command that requires `CAP_SYS_ADMIN`, breaking `nixos-rebuild`. See e.g., https://github.com/NixOS/nixpkgs/issues/15293 This significantly weakens chroot protections, but to break nixos-rebuild out of the box is too severe.
* apparmor-suid module: fix libcap lib output referenceJoachim Fasting2016-05-07
| | | | After 7382afac40c23841e5d6a491bd4a9412d766ecab
* grsecurity: support disabling TCP simultaneous connectJoachim Fasting2016-05-04
| | | | | | | | | | Defaults to OFF because disabling TCP simultaneous connect breaks some legitimate use cases, notably WebRTC [1], but it's nice to provide the option for deployments where those features are unneeded anyway. This is an alternative to https://github.com/NixOS/nixpkgs/pull/4937 [1]: http://article.gmane.org/gmane.linux.documentation/9425
* grsecurity module: fix grsec-lock unit orderingJoachim Fasting2016-05-02
| | | | | Requirement without ordering implies parallel execution; it is crucial that sysctl tunables are finalized before the lock is engaged, however.
* acme.nix: Fix unit descriptionsEelco Dolstra2016-04-18
| | | | | Unit descriptions should be capitalized, and timer units don't have to describe that they're timers.
* Merge branch 'staging', containing closure-size #7701Vladimír Čunát2016-04-13
|\
| * Merge #12653: rework default outputsVladimír Čunát2016-04-07
| |\
| | * Merge branch 'closure-size' into p/default-outputsVladimír Čunát2016-03-14
| | |\
| | * | nixos systemPackages: rework default outputsVladimír Čunát2016-01-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Now `pkg.outputUnspecified = true` but this attribute is missing in every output, so we can recognize whether the user chose or not. If (s)he didn't choose, we put `pkg.bin or pkg.out or pkg` into `systemPackages`. - `outputsToLink` is replaced by `extraOutputsToLink`. We add extra outputs *regardless* of whether the user chose anything. It's mainly meant for outputs with docs and debug symbols. - Note that as a result, some libraries will disappear from system path.
| * | | Merge branch 'master' into closure-sizeVladimír Čunát2016-04-01
| |\ \ \ | | |_|/ | |/| | | | | | | | | | Beware that stdenv doesn't build. It seems something more will be needed than just resolution of merge conflicts.
| * | | Merge master into closure-sizeVladimír Čunát2016-03-08
| |\ \ \ | | | | | | | | | | | | | | | | | | | | The kde-5 stuff still didn't merge well. I hand-fixed what I saw, but there may be more problems.
| * \ \ \ Merge branch 'master' into closure-sizeVladimír Čunát2016-02-14
| |\ \ \ \
| * \ \ \ \ Merge recent 'staging' into closure-sizeVladimír Čunát2016-02-03
| |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | Let's get rid of those merge conflicts.
| * | | | | | treewide: Mass replace 'libcap}/lib' to refer the 'out' outputTuomas Tynkkynen2016-01-24
| | | | | | |
| * | | | | | treewide: Mass replace 'attr}/lib' to refer the 'out' outputTuomas Tynkkynen2016-01-24
| | |_|_|_|/ | |/| | | |
| * | | | | Merge branch 'staging' into closure-sizeVladimír Čunát2016-01-19
| |\ \ \ \ \
| * \ \ \ \ \ Merge branch 'master' into closure-sizeVladimír Čunát2015-12-31
| |\ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TODO: there was more significant refactoring of qtbase and plasma 5.5 on master, and I'm deferring pointing to correct outputs to later.
| * | | | | | | Fix system-path with multioutLuca Bruno2015-12-01
| | | | | | | |
| * | | | | | | Merge branch 'master' into closure-sizeLuca Bruno2015-11-29
| |\ \ \ \ \ \ \
| * | | | | | | | nixos/polkit: fix systemd service after spilttingLuca Bruno2015-11-26
| | | | | | | | |
| * | | | | | | | nixos/polkit: Reference correct output of polkitTuomas Tynkkynen2015-10-28
| | | | | | | | |
| * | | | | | | | polkit: split dev and bin outputsVladimír Čunát2015-10-14
| | | | | | | | |
| * | | | | | | | nixos/setuid-wrappers: Build with normal mkDerivation phasesTuomas Tynkkynen2015-10-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This way the binary gets stripped & rpath-shrinked etc. as usual. We'd seem to get a runtime reference to gcc otherwise.
| * | | | | | | | Merge commit staging+systemd into closure-sizeVladimír Čunát2015-10-03
| |\ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Many non-conflict problems weren't (fully) resolved in this commit yet.
| * | | | | | | | | fix "libc}/lib" and similar referencesVladimír Čunát2015-05-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Done mostly without any verification. I didn't bother with libc}/include, as the path is still correct.
* | | | | | | | | | nixos: add optional process information hidingJoachim Fasting2016-04-10
| |_|_|_|_|_|_|_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This module adds an option `security.hideProcessInformation` that, when enabled, restricts access to process information such as command-line arguments to the process owner. The module adds a static group "proc" whose members are exempt from process information hiding. Ideally, this feature would be implemented by simply adding the appropriate mount options to `fileSystems."/proc".fsOptions`, but this was found to not work in vmtests. To ensure that process information hiding is enforced, we use a systemd service unit that remounts `/proc` after `systemd-remount-fs.service` has completed. To verify the correctness of the feature, simple tests were added to nixos/tests/misc: the test ensures that unprivileged users cannot see process information owned by another user, while members of "proc" CAN. Thanks to @abbradar for feedback and suggestions.
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-07-17 13:26:39 +0000