ilyakooo0/nixpkgs
1
0
Fork 0
mirror of https://github.com/ilyakooo0/nixpkgs.git synced 2024-11-14 15:36:47 +03:00
Code Issues Projects Releases Wiki Activity

hardened-config: enable read-only LSM hooks

Browse Source 
Implies that SELinux can no longer be disabled at runtime (only at boot
time, via selinux=0).

See https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dd0859dccbe291cf8179a96390f5c0e45cb9af1d
This commit is contained in:
Joachim Fasting 2017-08-11 23:25:30 +02:00
parent 723bd8b9c5
commit 345e0e6794
No known key found for this signature in database
GPG Key ID: 66EAB6B14F6B6E0D
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
pkgs/os-specific/linux/kernel/hardened-config.nix
View File

@ -46,6 +46,14 @@ ${optionalString (versionOlder version "4.11") ''
DEBUG_SET_MODULE_RONX y
''}
# Mark LSM hooks read-only after init. Conflicts with SECURITY_SELINUX_DISABLE
# (disabling SELinux at runtime); hence, SELinux can only be disabled at boot
# via the selinux=0 boot parameter.
${optionalString (versionAtLeast version "4.12") ''
SECURITY_SELINUX_DISABLE n
SECURITY_WRITABLE_HOOKS n
''}
DEBUG_WX y # boot-time warning on RWX mappings
# Stricter /dev/mem