dev/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

hardened-config: clarify MODIFY_LDT_SYSCALL

Browse Source 
This likely never worked; MODIFY_LDT_SYSCALL depends on EXPERT; enabling
EXPERT however seems to introduce quite a few changes that would need to be
properly vetted.

The version guard is unnecessary, however, as this config has been supported
since 4.3.
This commit is contained in:
Joachim Fasting 2019-01-05 13:24:54 +01:00
parent abc8ed3fca
commit 1801aad7b8
No known key found for this signature in database
GPG Key ID: 5C204DF675C90294
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pkgs/os-specific/linux/kernel/hardened-config.nix
View File

@ -28,9 +28,9 @@ ${optionalString (stdenv.hostPlatform.platform.kernelArch == "x86_64") ''
# Reduce attack surface by disabling various emulations
IA32_EMULATION n
X86_X32 n
${optionalString (versionOlder version "4.17") ''
# Note: this config depends on EXPERT y and so will not take effect, hence
# it is left "optional" for now.
MODIFY_LDT_SYSCALL? n
''}
VMAP_STACK y # Catch kernel stack overflows