Merge pull request #191670 from Ma27/fix-hardened-kernel-update
linux/hardened: fix update script and build for 5.19
This commit is contained in:
commit
b2ec74836b
|
@ -30,6 +30,7 @@ let
|
||||||
linux_5_4_hardened
|
linux_5_4_hardened
|
||||||
linux_5_10_hardened
|
linux_5_10_hardened
|
||||||
linux_5_15_hardened
|
linux_5_15_hardened
|
||||||
|
linux_5_19_hardened
|
||||||
|
|
||||||
linux_testing;
|
linux_testing;
|
||||||
};
|
};
|
||||||
|
|
|
@ -72,8 +72,12 @@ assert (stdenv.hostPlatform.isx86_64 -> versions.majorMinor version != "5.4");
|
||||||
GCC_PLUGIN_STRUCTLEAK = whenAtLeast "4.11" yes; # A port of the PaX structleak plugin
|
GCC_PLUGIN_STRUCTLEAK = whenAtLeast "4.11" yes; # A port of the PaX structleak plugin
|
||||||
GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = whenAtLeast "4.14" yes; # Also cover structs passed by address
|
GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = whenAtLeast "4.14" yes; # Also cover structs passed by address
|
||||||
GCC_PLUGIN_STACKLEAK = whenAtLeast "4.20" yes; # A port of the PaX stackleak plugin
|
GCC_PLUGIN_STACKLEAK = whenAtLeast "4.20" yes; # A port of the PaX stackleak plugin
|
||||||
GCC_PLUGIN_RANDSTRUCT = whenAtLeast "4.13" yes; # A port of the PaX randstruct plugin
|
GCC_PLUGIN_RANDSTRUCT = whenBetween "4.13" "5.19" yes; # A port of the PaX randstruct plugin
|
||||||
GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenAtLeast "4.13" yes;
|
GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenBetween "4.13" "5.19" yes;
|
||||||
|
|
||||||
|
# Same as GCC_PLUGIN_RANDSTRUCT*, but has been renamed to `RANDSTRUCT*` in 5.19.
|
||||||
|
RANDSTRUCT = whenAtLeast "5.19" yes;
|
||||||
|
RANDSTRUCT_PERFORMANCE = whenAtLeast "5.19" yes;
|
||||||
|
|
||||||
# Disable various dangerous settings
|
# Disable various dangerous settings
|
||||||
ACPI_CUSTOM_METHOD = no; # Allows writing directly to physical memory
|
ACPI_CUSTOM_METHOD = no; # Allows writing directly to physical memory
|
||||||
|
|
|
@ -41,10 +41,10 @@
|
||||||
},
|
},
|
||||||
"5.19": {
|
"5.19": {
|
||||||
"patch": {
|
"patch": {
|
||||||
"extra": "-hardened1",
|
"extra": "-hardened2",
|
||||||
"name": "linux-hardened-5.19.8-hardened1.patch",
|
"name": "linux-hardened-5.19.8-hardened2.patch",
|
||||||
"sha256": "1j7wg4hq06drxr42jl89za1f7x52d4ck5i38p4njz4j415ihsiys",
|
"sha256": "1dfgnx2yr5d5kh2d8r7ywqkyjq1rfni2b5sdpqly0w986rlkw48k",
|
||||||
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.19.8-hardened1/linux-hardened-5.19.8-hardened1.patch"
|
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.19.8-hardened2/linux-hardened-5.19.8-hardened2.patch"
|
||||||
},
|
},
|
||||||
"sha256": "1kl7fifsa6vsm34xg3kd2svhx18n771hfj67nhwnlalmb9whhqv1",
|
"sha256": "1kl7fifsa6vsm34xg3kd2svhx18n771hfj67nhwnlalmb9whhqv1",
|
||||||
"version": "5.19.8"
|
"version": "5.19.8"
|
||||||
|
|
|
@ -138,7 +138,7 @@ def fetch_patch(*, name: str, release_info: ReleaseInfo) -> Optional[Patch]:
|
||||||
if not sig_ok:
|
if not sig_ok:
|
||||||
return None
|
return None
|
||||||
|
|
||||||
kernel_ver = release_info.release.tag_name.replace("-hardened1", "")
|
kernel_ver = re.sub(r"(.*)(-hardened[\d]+)$", r'\1', release_info.release.tag_name)
|
||||||
major = kernel_ver.split('.')[0]
|
major = kernel_ver.split('.')[0]
|
||||||
sha256_kernel, _ = nix_prefetch_url(f"mirror://kernel/linux/kernel/v{major}.x/linux-{kernel_ver}.tar.xz")
|
sha256_kernel, _ = nix_prefetch_url(f"mirror://kernel/linux/kernel/v{major}.x/linux-{kernel_ver}.tar.xz")
|
||||||
|
|
||||||
|
|
|
@ -1,8 +1,8 @@
|
||||||
{ stdenv, lib, fetchsvn, linux
|
{ stdenv, lib, fetchsvn, linux
|
||||||
, scripts ? fetchsvn {
|
, scripts ? fetchsvn {
|
||||||
url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
|
url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
|
||||||
rev = "18911";
|
rev = "18916";
|
||||||
sha256 = "1f5b936a7ayva2kyly3n71sg6cqdvcavcxbj3cy3imaj9247bx72";
|
sha256 = "0axjbr1zbj7izkvvz2nv4ij1xjjnbxpch43cpl169cr8rqdl6n6i";
|
||||||
}
|
}
|
||||||
, ...
|
, ...
|
||||||
}:
|
}:
|
||||||
|
|
|
@ -131,11 +131,14 @@ let
|
||||||
# the buildFlags, but that would require also patching the kernel's
|
# the buildFlags, but that would require also patching the kernel's
|
||||||
# toplevel Makefile to add a variable export. This would be likely to
|
# toplevel Makefile to add a variable export. This would be likely to
|
||||||
# cause future patch conflicts.
|
# cause future patch conflicts.
|
||||||
if [ -f scripts/gcc-plugins/gen-random-seed.sh ]; then
|
for file in scripts/gen-randstruct-seed.sh scripts/gcc-plugins/gen-random-seed.sh; do
|
||||||
substituteInPlace scripts/gcc-plugins/gen-random-seed.sh \
|
if [ -f "$file" ]; then
|
||||||
--replace NIXOS_RANDSTRUCT_SEED \
|
substituteInPlace "$file" \
|
||||||
$(echo ${randstructSeed}${src} ${configfile} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
|
--replace NIXOS_RANDSTRUCT_SEED \
|
||||||
fi
|
$(echo ${randstructSeed}${src} ${configfile} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
patchShebangs scripts
|
patchShebangs scripts
|
||||||
|
|
||||||
|
|
|
@ -244,6 +244,7 @@ in {
|
||||||
linux_5_10_hardened = hardenedKernelFor kernels.linux_5_10 { };
|
linux_5_10_hardened = hardenedKernelFor kernels.linux_5_10 { };
|
||||||
linux_5_15_hardened = hardenedKernelFor kernels.linux_5_15 { };
|
linux_5_15_hardened = hardenedKernelFor kernels.linux_5_15 { };
|
||||||
linux_5_18_hardened = throw "linux 5.18 was removed because it has reached its end of life upstream";
|
linux_5_18_hardened = throw "linux 5.18 was removed because it has reached its end of life upstream";
|
||||||
|
linux_5_19_hardened = hardenedKernelFor kernels.linux_5_19 { };
|
||||||
|
|
||||||
}));
|
}));
|
||||||
/* Linux kernel modules are inherently tied to a specific kernel. So
|
/* Linux kernel modules are inherently tied to a specific kernel. So
|
||||||
|
@ -569,6 +570,7 @@ in {
|
||||||
linux_5_10_hardened = recurseIntoAttrs (hardenedPackagesFor kernels.linux_5_10 { });
|
linux_5_10_hardened = recurseIntoAttrs (hardenedPackagesFor kernels.linux_5_10 { });
|
||||||
linux_5_15_hardened = recurseIntoAttrs (hardenedPackagesFor kernels.linux_5_15 { });
|
linux_5_15_hardened = recurseIntoAttrs (hardenedPackagesFor kernels.linux_5_15 { });
|
||||||
linux_5_18_hardened = throw "linux 5.18 was removed because it has reached its end of life upstream";
|
linux_5_18_hardened = throw "linux 5.18 was removed because it has reached its end of life upstream";
|
||||||
|
linux_5_19_hardened = recurseIntoAttrs (hardenedPackagesFor kernels.linux_5_19 { });
|
||||||
|
|
||||||
linux_zen = recurseIntoAttrs (packagesFor kernels.linux_zen);
|
linux_zen = recurseIntoAttrs (packagesFor kernels.linux_zen);
|
||||||
linux_lqx = recurseIntoAttrs (packagesFor kernels.linux_lqx);
|
linux_lqx = recurseIntoAttrs (packagesFor kernels.linux_lqx);
|
||||||
|
|
Loading…
Reference in a new issue