Merge pull request #191670 from Ma27/fix-hardened-kernel-update
linux/hardened: fix update script and build for 5.19
This commit is contained in:
commit
b2ec74836b
|
@ -30,6 +30,7 @@ let
|
|||
linux_5_4_hardened
|
||||
linux_5_10_hardened
|
||||
linux_5_15_hardened
|
||||
linux_5_19_hardened
|
||||
|
||||
linux_testing;
|
||||
};
|
||||
|
|
|
@ -72,8 +72,12 @@ assert (stdenv.hostPlatform.isx86_64 -> versions.majorMinor version != "5.4");
|
|||
GCC_PLUGIN_STRUCTLEAK = whenAtLeast "4.11" yes; # A port of the PaX structleak plugin
|
||||
GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = whenAtLeast "4.14" yes; # Also cover structs passed by address
|
||||
GCC_PLUGIN_STACKLEAK = whenAtLeast "4.20" yes; # A port of the PaX stackleak plugin
|
||||
GCC_PLUGIN_RANDSTRUCT = whenAtLeast "4.13" yes; # A port of the PaX randstruct plugin
|
||||
GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenAtLeast "4.13" yes;
|
||||
GCC_PLUGIN_RANDSTRUCT = whenBetween "4.13" "5.19" yes; # A port of the PaX randstruct plugin
|
||||
GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenBetween "4.13" "5.19" yes;
|
||||
|
||||
# Same as GCC_PLUGIN_RANDSTRUCT*, but has been renamed to `RANDSTRUCT*` in 5.19.
|
||||
RANDSTRUCT = whenAtLeast "5.19" yes;
|
||||
RANDSTRUCT_PERFORMANCE = whenAtLeast "5.19" yes;
|
||||
|
||||
# Disable various dangerous settings
|
||||
ACPI_CUSTOM_METHOD = no; # Allows writing directly to physical memory
|
||||
|
|
|
@ -41,10 +41,10 @@
|
|||
},
|
||||
"5.19": {
|
||||
"patch": {
|
||||
"extra": "-hardened1",
|
||||
"name": "linux-hardened-5.19.8-hardened1.patch",
|
||||
"sha256": "1j7wg4hq06drxr42jl89za1f7x52d4ck5i38p4njz4j415ihsiys",
|
||||
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.19.8-hardened1/linux-hardened-5.19.8-hardened1.patch"
|
||||
"extra": "-hardened2",
|
||||
"name": "linux-hardened-5.19.8-hardened2.patch",
|
||||
"sha256": "1dfgnx2yr5d5kh2d8r7ywqkyjq1rfni2b5sdpqly0w986rlkw48k",
|
||||
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.19.8-hardened2/linux-hardened-5.19.8-hardened2.patch"
|
||||
},
|
||||
"sha256": "1kl7fifsa6vsm34xg3kd2svhx18n771hfj67nhwnlalmb9whhqv1",
|
||||
"version": "5.19.8"
|
||||
|
|
|
@ -138,7 +138,7 @@ def fetch_patch(*, name: str, release_info: ReleaseInfo) -> Optional[Patch]:
|
|||
if not sig_ok:
|
||||
return None
|
||||
|
||||
kernel_ver = release_info.release.tag_name.replace("-hardened1", "")
|
||||
kernel_ver = re.sub(r"(.*)(-hardened[\d]+)$", r'\1', release_info.release.tag_name)
|
||||
major = kernel_ver.split('.')[0]
|
||||
sha256_kernel, _ = nix_prefetch_url(f"mirror://kernel/linux/kernel/v{major}.x/linux-{kernel_ver}.tar.xz")
|
||||
|
||||
|
|
|
@ -1,8 +1,8 @@
|
|||
{ stdenv, lib, fetchsvn, linux
|
||||
, scripts ? fetchsvn {
|
||||
url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
|
||||
rev = "18911";
|
||||
sha256 = "1f5b936a7ayva2kyly3n71sg6cqdvcavcxbj3cy3imaj9247bx72";
|
||||
rev = "18916";
|
||||
sha256 = "0axjbr1zbj7izkvvz2nv4ij1xjjnbxpch43cpl169cr8rqdl6n6i";
|
||||
}
|
||||
, ...
|
||||
}:
|
||||
|
|
|
@ -131,11 +131,14 @@ let
|
|||
# the buildFlags, but that would require also patching the kernel's
|
||||
# toplevel Makefile to add a variable export. This would be likely to
|
||||
# cause future patch conflicts.
|
||||
if [ -f scripts/gcc-plugins/gen-random-seed.sh ]; then
|
||||
substituteInPlace scripts/gcc-plugins/gen-random-seed.sh \
|
||||
for file in scripts/gen-randstruct-seed.sh scripts/gcc-plugins/gen-random-seed.sh; do
|
||||
if [ -f "$file" ]; then
|
||||
substituteInPlace "$file" \
|
||||
--replace NIXOS_RANDSTRUCT_SEED \
|
||||
$(echo ${randstructSeed}${src} ${configfile} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
patchShebangs scripts
|
||||
|
||||
|
|
|
@ -244,6 +244,7 @@ in {
|
|||
linux_5_10_hardened = hardenedKernelFor kernels.linux_5_10 { };
|
||||
linux_5_15_hardened = hardenedKernelFor kernels.linux_5_15 { };
|
||||
linux_5_18_hardened = throw "linux 5.18 was removed because it has reached its end of life upstream";
|
||||
linux_5_19_hardened = hardenedKernelFor kernels.linux_5_19 { };
|
||||
|
||||
}));
|
||||
/* Linux kernel modules are inherently tied to a specific kernel. So
|
||||
|
@ -569,6 +570,7 @@ in {
|
|||
linux_5_10_hardened = recurseIntoAttrs (hardenedPackagesFor kernels.linux_5_10 { });
|
||||
linux_5_15_hardened = recurseIntoAttrs (hardenedPackagesFor kernels.linux_5_15 { });
|
||||
linux_5_18_hardened = throw "linux 5.18 was removed because it has reached its end of life upstream";
|
||||
linux_5_19_hardened = recurseIntoAttrs (hardenedPackagesFor kernels.linux_5_19 { });
|
||||
|
||||
linux_zen = recurseIntoAttrs (packagesFor kernels.linux_zen);
|
||||
linux_lqx = recurseIntoAttrs (packagesFor kernels.linux_lqx);
|
||||
|
|
Loading…
Reference in a new issue