grsecurity module: disable EFI runtime services by default
Enabling EFI runtime services provides a venue for injecting code into the kernel. When grsecurity is enabled, we close this by default by disabling access to EFI runtime services. The upshot of this is that /sys/firmware/efi/efivars will be unavailable by default (and attempts to mount it will fail). This is not strictly a grsecurity related option, it could be made into a general option, but it seems to be of particular interest to grsecurity users (for non-grsecurity users, there are other, more immediate kernel injection attack dangers to contend with anyway).
This commit is contained in:
parent
402a53736e
commit
43fc394a5c
|
@ -265,6 +265,11 @@
|
|||
<sect1 xml:id="sec-grsec-issues"><title>Issues and work-arounds</title>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem><para>Access to EFI runtime services is disabled by default:
|
||||
this plugs a potential code injection attack vector; use
|
||||
<option>security.grsecurity.disableEfiRuntimeServices</option> to override
|
||||
this behavior.</para></listitem>
|
||||
|
||||
<listitem><para>Virtualization: KVM is the preferred virtualization
|
||||
solution. Xen, Virtualbox, and VMWare are
|
||||
<emphasis>unsupported</emphasis> and most likely require a custom kernel.
|
||||
|
|
|
@ -37,6 +37,18 @@ in
|
|||
'';
|
||||
};
|
||||
|
||||
disableEfiRuntimeServices = mkOption {
|
||||
type = types.bool;
|
||||
example = false;
|
||||
default = true;
|
||||
description = ''
|
||||
Whether to disable access to EFI runtime services. Enabling EFI runtime
|
||||
services creates a venue for code injection attacks on the kernel and
|
||||
should be disabled if at all possible. Changing this option enters into
|
||||
effect upon reboot.
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
|
@ -45,6 +57,8 @@ in
|
|||
# required kernel config
|
||||
boot.kernelPackages = mkDefault pkgs.linuxPackages_grsec_nixos;
|
||||
|
||||
boot.kernelParams = optional cfg.disableEfiRuntimeServices "noefi";
|
||||
|
||||
system.requiredKernelConfig = with config.lib.kernelConfig;
|
||||
[ (isEnabled "GRKERNSEC")
|
||||
(isEnabled "PAX")
|
||||
|
|
Loading…
Reference in a new issue