From b628400f5e70c361cc74e6a5c1d041f6a2189e5f Mon Sep 17 00:00:00 2001 From: Emily Date: Sat, 7 Mar 2020 18:48:08 +0000 Subject: linuxPackages_{,_latest,_testing}_hardened: enable 32-bit emulation Per discussion in #81943. Resolves #79798. --- pkgs/os-specific/linux/kernel/hardened-config.nix | 3 +-- pkgs/top-level/all-packages.nix | 1 - 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/hardened-config.nix b/pkgs/os-specific/linux/kernel/hardened-config.nix index 156a4cf44234..00aceefa1330 100644 --- a/pkgs/os-specific/linux/kernel/hardened-config.nix +++ b/pkgs/os-specific/linux/kernel/hardened-config.nix @@ -18,8 +18,7 @@ assert (versionAtLeast version "4.9"); optionalAttrs (stdenv.hostPlatform.platform.kernelArch == "x86_64") { DEFAULT_MMAP_MIN_ADDR = freeform "65536"; # Prevent allocation of first 64K of memory - # Reduce attack surface by disabling various emulations - IA32_EMULATION = no; + # Reduce attack surface by disabling X32 X86_X32 = no; # Note: this config depends on EXPERT y and so will not take effect, hence # it is left "optional" for now. diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 5574d0cc76aa..f47f8df580a8 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -16828,7 +16828,6 @@ in # Hardened linux hardenedLinuxPackagesFor = kernel: linuxPackagesFor (kernel.override { - features.ia32Emulation = false; structuredExtraConfig = import ../os-specific/linux/kernel/hardened-config.nix { inherit stdenv; inherit (kernel) version; -- cgit 1.4.1