public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge master into staging-next

Browse Source
This commit is contained in:
github-actions[bot]
2021-03-09 00:39:09 +00:00
committed by GitHub
parent 3521dc45ed 909cd83cb2
commit 3db2dee35f
65 changed files with 2594 additions and 1218 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/os-specific/linux/bolt/default.nix
+2 -2
View File
@@ -20,14 +20,14 @@
stdenv.mkDerivation rec {
pname = "bolt";
version = "0.9";
version = "0.9.1";
src = fetchFromGitLab {
domain = "gitlab.freedesktop.org";
owner = "bolt";
repo = "bolt";
rev = version;
sha256 = "sha256-lcJE+bMK2S2GObHMy/Fu12WGb3T1HrWjsNyZPz4/f4E=";
sha256 = "1phgp8fs0dlj74kbkqlvfniwc32daz47b3pvsxlfxqzyrp77xrfm";
};
nativeBuildInputs = [
pkgs/os-specific/linux/kernel/common-config.nix
+7 -6
View File
@@ -193,16 +193,17 @@ let
NET_DROP_MONITOR = yes;
# needed for ss
INET_DIAG = module;
INET_TCP_DIAG = module;
INET_UDP_DIAG = module;
INET_RAW_DIAG = whenAtLeast "4.14" module;
INET_DIAG_DESTROY = whenAtLeast "4.9" yes;
# Use a lower priority to allow these options to be overridden in hardened/config.nix
INET_DIAG = mkDefault module;
INET_TCP_DIAG = mkDefault module;
INET_UDP_DIAG = mkDefault module;
INET_RAW_DIAG = whenAtLeast "4.14" (mkDefault module);
INET_DIAG_DESTROY = whenAtLeast "4.9" (mkDefault yes);
# enable multipath-tcp
MPTCP = whenAtLeast "5.6" yes;
MPTCP_IPV6 = whenAtLeast "5.6" yes;
INET_MPTCP_DIAG = whenAtLeast "5.9" module;
INET_MPTCP_DIAG = whenAtLeast "5.9" (mkDefault module);
};
wireless = {
pkgs/os-specific/linux/kernel/hardened/config.nix
+9 -1
View File
@@ -65,7 +65,7 @@ assert (versionAtLeast version "4.9");
PANIC_TIMEOUT = freeform "-1";
GCC_PLUGINS = yes; # Enable gcc plugin options
# Gather additional entropy at boot time for systems that may = no;ot have appropriate entropy sources.
# Gather additional entropy at boot time for systems that may not have appropriate entropy sources.
GCC_PLUGIN_LATENT_ENTROPY = yes;
GCC_PLUGIN_STRUCTLEAK = whenAtLeast "4.11" yes; # A port of the PaX structleak plugin
@@ -79,6 +79,14 @@ assert (versionAtLeast version "4.9");
PROC_KCORE = no; # Exposes kernel text image layout
INET_DIAG = no; # Has been used for heap based attacks in the past
# INET_DIAG=n causes the following options to not exist anymore, but since they are defined in common-config.nix,
# make them optional
INET_DIAG_DESTROY = option no;
INET_RAW_DIAG = option no;
INET_TCP_DIAG = option no;
INET_UDP_DIAG = option no;
INET_MPTCP_DIAG = option no;
# Use -fstack-protector-strong (gcc 4.9+) for best stack canary coverage.
CC_STACKPROTECTOR_REGULAR = whenOlder "4.18" no;
CC_STACKPROTECTOR_STRONG = whenOlder "4.18" yes;