public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Revert "Revert "linux-hardened: Disable GCC_PLUGIN_RANDSTRUCT""

Browse Source 
This reverts commit c68e8b05f0.

RANDSTRUCT currently fails to work with out-of-tree modules, as
evinced by
https://github.com/NixOS/nixpkgs/commit/c68e8b05f005381ac1caf51bb28282b70242b77b#commitcomment-31850284
and https://github.com/NixOS/nixpkgs/issues/53522.

Specifically, loading out-of-tree modules results in modsym version
mismatches, as in
   spl: version magic '4.20.0 SMP mod_unload modversions RANDSTRUCT_PLUGIN
from the issue above.

A working hypothesis is that the randstruct seed is not carried over when
building out-of-tree modules but more investigation is needed here.

Closes https://github.com/NixOS/nixpkgs/issues/53522
This commit is contained in:
Joachim Fasting
2019-01-07 19:50:12 +01:00
parent a4f51746f8
commit 865f7a14b4
1 changed files with 0 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/os-specific/linux/kernel/hardened-config.nix
-5
View File
@@ -125,11 +125,6 @@ ${optionalString (versionAtLeast version "4.20") ''
GCC_PLUGIN_STACKLEAK y # A port of the PaX stackleak plugin
''}
${optionalString (versionAtLeast version "4.13") ''
GCC_PLUGIN_RANDSTRUCT y # A port of the PaX randstruct plugin
GCC_PLUGIN_RANDSTRUCT_PERFORMANCE y
''}
# Disable various dangerous settings
ACPI_CUSTOM_METHOD n # Allows writing directly to physical memory
PROC_KCORE n # Exposes kernel text image layout