git.iko.soy/typeable/nixpkgs
on master help sign in
grsecurity module: force a known good kernel package set

Previously, we would only set a default value, on the theory that `boot.kernelPackages` could be used to sanely configure a custom grsec kernel. Regrettably, this is not the case and users who expect e.g., `boot.kernelPackages = pkgs.linuxPackages_latest` to work will end up with a non-grsec kernel (this problem has come up twice on the bug tracker recently). With this patch, `security.grsecurity.enable = true` implies `boot.kernelPackages = linuxPackages_grsec_nixos` and any customization must be done via package override or by eschewing the module.

commite99228db3014131255e19b88ba78e47b46a4bff8 authorJoachim Fasting <joachifm@fastmail.fm> dateMon 28 Nov 2016, 12:04 (10 years ago) parent5da1394
2 files changed+33−13
compare with master
unifiedsplit
nixos/modules/security/grsecurity.nix+1−1 nixos/modules/security/grsecurity.xml+32−12
nixos/modules/security/grsecurity.nix+1−1
@@ -57,7 +57,7 @@ in
5757
5858 config = mkIf cfg.enable {
5959
60− boot.kernelPackages = mkDefault pkgs.linuxPackages_grsec_nixos;
60+ boot.kernelPackages = mkForce pkgs.linuxPackages_grsec_nixos;
6161
6262 boot.kernelParams = optional cfg.disableEfiRuntimeServices "noefi";
6363
nixos/modules/security/grsecurity.xml+32−12
@@ -51,6 +51,13 @@
5151 # nixos-rebuild boot
5252 # reboot
5353 </programlisting>
54+ <note><para>
55+ Enabling the grsecurity module overrides
56+ <option>boot.kernelPackages</option>, to reduce the risk of
57+ misconfiguration. <xref linkend="sec-grsec-custom-kernel" />
58+ describes how to use a custom kernel package set.
59+ </para></note>
60+
5461 For most users, further configuration should be unnecessary. All users
5562 are encouraged to look over <xref linkend="sec-grsec-security" /> before
5663 using the system, however. If you experience problems, please refer to
@@ -205,21 +212,22 @@
205212 </para>
206213
207214 <para>
208− To use a custom kernel with upstream's recommended settings for server
209− deployments:
215+ To build a custom kernel using upstream's recommended settings for server
216+ deployments, while still using the NixOS module:
210217 <programlisting>
211− boot.kernelPackages =
212− let
213− kernel = pkgs.linux_grsec_nixos.override {
214− extraConfig = ''
215− GRKERNSEC_CONFIG_AUTO y
216− GRKERNSEC_CONFIG_SERVER y
217− GRKERNSEC_CONFIG_SECURITY y
218− '';
218+ nixpkgs.config.packageOverrides = super: {
219+ linux_grsec_nixos = super.linux_grsec_nixos.override {
220+ extraConfig = ''
221+ GRKERNSEC_CONFIG_AUTO y
222+ GRKERNSEC_CONFIG_SERVER y
223+ GRKERNSEC_CONFIG_SECURITY y
224+ '';
219225 };
220− self = pkgs.linuxPackagesFor kernel self;
221− in self;
226+ }
222227 </programlisting>
228+ </para>
229+
230+ <para>
223231 The wikibook provides an exhaustive listing of
224232 <link xlink:href="https://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity_and_PaX_Configuration_Options">kernel configuration options</link>.
225233 </para>
@@ -228,6 +236,18 @@
228236 The NixOS module makes several assumptions about the kernel and so
229237 may be incompatible with your customised kernel. Currently, the only way
230238 to work around incompatibilities is to eschew the NixOS module.
239+
240+ If not using the NixOS module, a custom grsecurity package set can
241+ be specified inline instead, as in
242+ <programlisting>
243+ boot.kernelPackages =
244+ let
245+ kernel = pkgs.linux_grsec_nixos.override {
246+ extraConfig = /* as above */;
247+ };
248+ self = pkgs.linuxPackagesFor kernel self;
249+ in self;
250+ </programlisting>
231251 </para>
232252
233253 </sect1>