public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

grsecurity: use kernel version instead of testing / stable

Browse Source
This commit is contained in:
tg(x)
2016-02-28 04:10:59 +01:00
parent 4e3d6d3e90
commit 38614d3f6a
5 changed files with 76 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/security/grsecurity.nix
+5 -22
View File
@@ -26,19 +26,11 @@ in
'';
};
stable = mkOption {
type = types.bool;
default = false;
kernelPatch = mkOption {
type = types.attrs;
default = pkgs.kernelPatches.grsecurity_latest;
description = ''
Enable the stable grsecurity patch, based on Linux 3.14.
'';
};
testing = mkOption {
type = types.bool;
default = false;
description = ''
Enable the testing grsecurity patch, based on Linux 4.0.
Grsecurity patch to use.
'';
};
@@ -219,16 +211,7 @@ in
config = mkIf cfg.enable {
assertions =
[ { assertion = cfg.stable || cfg.testing;
message = ''
If grsecurity is enabled, you must select either the
stable patch (with kernel 3.14), or the testing patch (with
kernel 4.0) to continue.
'';
}
{ assertion = !(cfg.stable && cfg.testing);
message = "Select either one of the stable or testing patch";
}
[
{ assertion = (cfg.config.restrictProc -> !cfg.config.restrictProcWithGroup) ||
(cfg.config.restrictProcWithGroup -> !cfg.config.restrictProc);
message = "You cannot enable both restrictProc and restrictProcWithGroup";