b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Merge pull request #191670 from Ma27/fix-hardened-kernel-update

Browse source 
linux/hardened: fix update script and build for 5.19
This commit is contained in:
Maximilian Bosch 2022-09-22 11:03:31 +02:00 committed by GitHub
parent 4ae405c834 dd6727e7b8
commit b2ec74836b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
7 changed files with 24 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
nixos/tests/kernel-generic.nix
View file

@ -30,6 +30,7 @@ let
linux_5_4_hardened
linux_5_10_hardened
linux_5_15_hardened
linux_5_19_hardened
linux_testing;
};

8
pkgs/os-specific/linux/kernel/hardened/config.nix
View file

@ -72,8 +72,12 @@ assert (stdenv.hostPlatform.isx86_64 -> versions.majorMinor version != "5.4");
GCC_PLUGIN_STRUCTLEAK = whenAtLeast "4.11" yes; # A port of the PaX structleak plugin
GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = whenAtLeast "4.14" yes; # Also cover structs passed by address
GCC_PLUGIN_STACKLEAK = whenAtLeast "4.20" yes; # A port of the PaX stackleak plugin
GCC_PLUGIN_RANDSTRUCT = whenAtLeast "4.13" yes; # A port of the PaX randstruct plugin
GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenAtLeast "4.13" yes;
GCC_PLUGIN_RANDSTRUCT = whenBetween "4.13" "5.19" yes; # A port of the PaX randstruct plugin
GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenBetween "4.13" "5.19" yes;
# Same as GCC_PLUGIN_RANDSTRUCT*, but has been renamed to `RANDSTRUCT*` in 5.19.
RANDSTRUCT = whenAtLeast "5.19" yes;
RANDSTRUCT_PERFORMANCE = whenAtLeast "5.19" yes;
# Disable various dangerous settings
ACPI_CUSTOM_METHOD = no; # Allows writing directly to physical memory

8
pkgs/os-specific/linux/kernel/hardened/patches.json
View file

@ -41,10 +41,10 @@
},
"5.19": {
"patch": {
"extra": "-hardened1",
"name": "linux-hardened-5.19.8-hardened1.patch",
"sha256": "1j7wg4hq06drxr42jl89za1f7x52d4ck5i38p4njz4j415ihsiys",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.19.8-hardened1/linux-hardened-5.19.8-hardened1.patch"
"extra": "-hardened2",
"name": "linux-hardened-5.19.8-hardened2.patch",
"sha256": "1dfgnx2yr5d5kh2d8r7ywqkyjq1rfni2b5sdpqly0w986rlkw48k",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.19.8-hardened2/linux-hardened-5.19.8-hardened2.patch"
},
"sha256": "1kl7fifsa6vsm34xg3kd2svhx18n771hfj67nhwnlalmb9whhqv1",
"version": "5.19.8"

2
pkgs/os-specific/linux/kernel/hardened/update.py
View file

@ -138,7 +138,7 @@ def fetch_patch(*, name: str, release_info: ReleaseInfo) -> Optional[Patch]:
if not sig_ok:
return None
kernel_ver = release_info.release.tag_name.replace("-hardened1", "")
kernel_ver = re.sub(r"(.*)(-hardened[\d]+)$", r'\1', release_info.release.tag_name)
major = kernel_ver.split('.')[0]
sha256_kernel, _ = nix_prefetch_url(f"mirror://kernel/linux/kernel/v{major}.x/linux-{kernel_ver}.tar.xz")

4
pkgs/os-specific/linux/kernel/linux-libre.nix
View file

@ -1,8 +1,8 @@
{ stdenv, lib, fetchsvn, linux
, scripts ? fetchsvn {
url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
rev = "18911";
sha256 = "1f5b936a7ayva2kyly3n71sg6cqdvcavcxbj3cy3imaj9247bx72";
rev = "18916";
sha256 = "0axjbr1zbj7izkvvz2nv4ij1xjjnbxpch43cpl169cr8rqdl6n6i";
}
, ...
}:

13
pkgs/os-specific/linux/kernel/manual-config.nix
View file

@ -131,11 +131,14 @@ let
# the buildFlags, but that would require also patching the kernel's
# toplevel Makefile to add a variable export. This would be likely to
# cause future patch conflicts.
if [ -f scripts/gcc-plugins/gen-random-seed.sh ]; then
substituteInPlace scripts/gcc-plugins/gen-random-seed.sh \
--replace NIXOS_RANDSTRUCT_SEED \
$(echo ${randstructSeed}${src} ${configfile} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
fi
for file in scripts/gen-randstruct-seed.sh scripts/gcc-plugins/gen-random-seed.sh; do
if [ -f "$file" ]; then
substituteInPlace "$file" \
--replace NIXOS_RANDSTRUCT_SEED \
$(echo ${randstructSeed}${src} ${configfile} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
break
fi
done
patchShebangs scripts

2
pkgs/top-level/linux-kernels.nix
View file

@ -244,6 +244,7 @@ in {
linux_5_10_hardened = hardenedKernelFor kernels.linux_5_10 { };
linux_5_15_hardened = hardenedKernelFor kernels.linux_5_15 { };
linux_5_18_hardened = throw "linux 5.18 was removed because it has reached its end of life upstream";
linux_5_19_hardened = hardenedKernelFor kernels.linux_5_19 { };
}));
/* Linux kernel modules are inherently tied to a specific kernel. So
@ -569,6 +570,7 @@ in {
linux_5_10_hardened = recurseIntoAttrs (hardenedPackagesFor kernels.linux_5_10 { });
linux_5_15_hardened = recurseIntoAttrs (hardenedPackagesFor kernels.linux_5_15 { });
linux_5_18_hardened = throw "linux 5.18 was removed because it has reached its end of life upstream";
linux_5_19_hardened = recurseIntoAttrs (hardenedPackagesFor kernels.linux_5_19 { });
linux_zen = recurseIntoAttrs (packagesFor kernels.linux_zen);
linux_lqx = recurseIntoAttrs (packagesFor kernels.linux_lqx);