public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

grsecurity: optionally disable features for redistributed kernels

Browse Source
This commit is contained in:
Joachim Fasting
2016-05-06 16:37:25 +02:00
parent 27061905bd
commit 50d915c758
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/build-support/grsecurity/default.nix
+7
View File
@@ -15,6 +15,7 @@ let
unrestrictProcGid = 121; # Ugh, an awful hack. See grsecurity NixOS gid unrestrictProcGid = 121; # Ugh, an awful hack. See grsecurity NixOS gid
disableRBAC = false; disableRBAC = false;
disableSimultConnect = false; disableSimultConnect = false;
redistKernel = true;
verboseVersion = false; verboseVersion = false;
kernelExtraConfig = ""; kernelExtraConfig = "";
} // grsecOptions.config; } // grsecOptions.config;
@@ -91,6 +92,12 @@ let
GRKERNSEC y GRKERNSEC y
${grsecMainConfig} ${grsecMainConfig}
# Disable features rendered useless by redistributing the kernel
${optionalString cfg.config.redistKernel ''
GRKERNSEC_RANDSTRUCT n
GRKERNSEC_HIDESYM n
''}
# The paxmarks mechanism relies on ELF header markings, but the default # The paxmarks mechanism relies on ELF header markings, but the default
# grsecurity configuration only enables xattr markings # grsecurity configuration only enables xattr markings
PAX_PT_PAX_FLAGS y PAX_PT_PAX_FLAGS y