mirror of
https://github.com/ilyakooo0/nixpkgs.git
synced 2024-12-27 05:43:50 +03:00
43fc394a5c
Enabling EFI runtime services provides a venue for injecting code into the kernel. When grsecurity is enabled, we close this by default by disabling access to EFI runtime services. The upshot of this is that /sys/firmware/efi/efivars will be unavailable by default (and attempts to mount it will fail). This is not strictly a grsecurity related option, it could be made into a general option, but it seems to be of particular interest to grsecurity users (for non-grsecurity users, there are other, more immediate kernel injection attack dangers to contend with anyway). |
||
|---|---|---|
| .. | ||
| acme.nix | ||
| acme.xml | ||
| apparmor-suid.nix | ||
| apparmor.nix | ||
| audit.nix | ||
| ca.nix | ||
| duosec.nix | ||
| grsecurity.nix | ||
| hidepid.nix | ||
| oath.nix | ||
| pam_mount.nix | ||
| pam_usb.nix | ||
| pam.nix | ||
| polkit.nix | ||
| prey.nix | ||
| rngd.nix | ||
| rtkit.nix | ||
| setuid-wrapper.c | ||
| setuid-wrappers.nix | ||
| sudo.nix | ||