dev/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

linux: add space to avoid attributing comments too widely

Browse Source 
The comments from the blocks above apply only to a single line, but that
is not necessarily clear. Add blank lines to more clearly narrow the
scope of them.
This commit is contained in:
Andrew Marshall 2024-04-01 12:13:57 -04:00
parent 79c15abc7d
commit ff5cd23067
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
pkgs/os-specific/linux/kernel/common-config.nix
View File

@ -671,16 +671,19 @@ let
# https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html # https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html
DEBUG_LIST = yes; DEBUG_LIST = yes;
HARDENED_USERCOPY = yes; HARDENED_USERCOPY = yes;
RANDOMIZE_BASE = option yes; RANDOMIZE_BASE = option yes;
STRICT_DEVMEM = mkDefault yes; # Filter access to /dev/mem STRICT_DEVMEM = mkDefault yes; # Filter access to /dev/mem
IO_STRICT_DEVMEM = mkDefault yes; IO_STRICT_DEVMEM = mkDefault yes;
SECURITY_SELINUX_BOOTPARAM_VALUE = whenOlder "5.1" (freeform "0"); # Disable SELinux by default SECURITY_SELINUX_BOOTPARAM_VALUE = whenOlder "5.1" (freeform "0"); # Disable SELinux by default
# Prevent processes from ptracing non-children processes # Prevent processes from ptracing non-children processes
SECURITY_YAMA = option yes; SECURITY_YAMA = option yes;
# The goal of Landlock is to enable to restrict ambient rights (e.g. global filesystem access) for a set of processes. # The goal of Landlock is to enable to restrict ambient rights (e.g. global filesystem access) for a set of processes.
# This does not have any effect if a program does not support it # This does not have any effect if a program does not support it
SECURITY_LANDLOCK = whenAtLeast "5.13" yes; SECURITY_LANDLOCK = whenAtLeast "5.13" yes;
DEVKMEM = whenOlder "5.13" no; # Disable /dev/kmem DEVKMEM = whenOlder "5.13" no; # Disable /dev/kmem
USER_NS = yes; # Support for user namespaces USER_NS = yes; # Support for user namespaces