slab_nomerge may reduce surface somewhat
slub_debug is used to enable additional sanity checks and "red zones" around
allocations to detect read/writes beyond the allocated area, as well as
poisoning to overwrite free'd data.
The cost is yet more memory fragmentation ...
This likely never worked; MODIFY_LDT_SYSCALL depends on EXPERT; enabling
EXPERT however seems to introduce quite a few changes that would need to be
properly vetted.
The version guard is unnecessary, however, as this config has been supported
since 4.3.
SECURITY_WRITABLE_HOOKS is implicitly controlled by SECURITY_SELINUX_DISABLE;
explicitly unsetting results in an error because the configfile builder fails
to detect that it has in fact been unset (reporting it as an unused option).
For now, leave WRITABLE_HOOKS as an "optional" config for documentation
purposes.
For the hardened profile disable symmetric multi threading. There seems to be
no *proven* method of exploiting cache sharing between threads on the same CPU
core, so this may be considered quite paranoid, considering the perf cost.
SMT can be controlled at runtime, however. This is in keeping with OpenBSD
defaults.
TODO: since SMT is left to be controlled at runtime, changing the option
definition should take effect on system activation. Write to
/sys/devices/system/cpu/smt/control
For the hardened profile enable flushing whenever the hypervisor enters the
guest, but otherwise leave at kernel default (conditional flushing as of
writing).
Introduces the option security.protectKernelImage that is intended to control
various mitigations to protect the integrity of the running kernel
image (i.e., prevent replacing it without rebooting).
This makes sense as a dedicated module as it is otherwise somewhat difficult
to override for hardened profile users who want e.g., hibernation to work.
A module for security options that are too small to warrant their own module.
The impetus for adding this module is to make it more convenient to override
the behavior of the hardened profile wrt user namespaces.
Without a dedicated option for user namespaces, the user needs to
1) know which sysctl knob controls userns
2) know how large a value the sysctl knob needs to allow e.g.,
Nix sandbox builds to work
In the future, other mitigations currently enabled by the hardened profile may
be promoted to options in this module.
For now check that the default client config boots.
Ideas for the future:
- Expand on control via netcat
- Configure a circuit of nodes exercise various configs (e.g., check
that a client node can access a hidden www service). Needs setting up
authoritative directory servers &c.
This reverts commit 67c5cb23e9, reversing
changes made to 431c004fbd.
I failed to notice that this depends on a package that had since
been removed. My bad :(
Note that due to runtime impurities, non-NixOS users must prepend and export
QT_PLUGIN_PATH=${qt5.qtbase.qtPluginPrefix}
and
LD_LIBRARY_PATH=/run/opengl-driver/lib
before running electrum, lest it fail to find runtime dependencies or pick
up mismatching libraries from the host system.
Quoth the release notes:
> It includes several bugfixes, including a bugfix for a crash issue that
had affected relays under memory pressure. It also adds a new directory
authority, Bastet.
The original browser bundle expects to run from a bundled directory,
typically under user's home. This version creates a firefox distribution
with preloaded extensions and settings that functions more like an
ordinary firefox installation.
The approach used here could be generalized to allow specification of
custom firefox distributions. Eventually, the code will be factored so
that the tbb is just an instance of that more general construct (firefox
base + extensions + prefs).
Currently, we use the latest upstream versions of extensions and so on.
Eventually we want to track the upstream bundle more closely and ideally
use the exact same inputs (firefox source, extension sources).
To avoid mixing up profile data, all runtime state is stored under
$XDG_DATA_HOME/tor-browser.
Major TODO items
- Pluggable transports
- Upstream TBB version parity
- Avoid fetchgit
- Build NoScript from source (no upstream source repo, however, must rely
on third-parties)
- Improved notation for packaging extensions
- Feature parity with the binary bundle (apulse and runtime purity, in
particular)
Joachim Fasting