nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-02-18 01:54:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

hardened-config: clarify readonly LSM hooks config

Browse Source 
SECURITY_WRITABLE_HOOKS is implicitly controlled by SECURITY_SELINUX_DISABLE;
explicitly unsetting results in an error because the configfile builder fails
to detect that it has in fact been unset (reporting it as an unused option).
For now, leave WRITABLE_HOOKS as an "optional" config for documentation
purposes.
This commit is contained in:
Joachim Fasting 2019-01-05 13:20:09 +01:00
parent c68e8b05f0
commit abc8ed3fca
No known key found for this signature in database
GPG Key ID: 5C204DF675C90294
1 changed files with 9 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
pkgs/os-specific/linux/kernel/hardened-config.nix
View File

@ -52,15 +52,17 @@ ${optionalString (versionOlder version "4.11") ''
DEBUG_SET_MODULE_RONX y
''}
# Mark LSM hooks read-only after init. Conflicts with SECURITY_SELINUX_DISABLE
# (disabling SELinux at runtime); hence, SELinux can only be disabled at boot
# via the selinux=0 boot parameter.
# Mark LSM hooks read-only after init. SECURITY_WRITABLE_HOOKS n
# conflicts with SECURITY_SELINUX_DISABLE y; disabling the latter
# implicitly marks LSM hooks read-only after init.
#
# SELinux can only be disabled at boot via selinux=0
#
# We set SECURITY_WRITABLE_HOOKS n primarily for documentation purposes; the
# config builder fails to detect that it has indeed been unset.
${optionalString (versionAtLeast version "4.12") ''
SECURITY_SELINUX_DISABLE n
''}
${optionalString ((versionAtLeast version "4.12") && (versionOlder version "4.17")) ''
SECURITY_WRITABLE_HOOKS n
SECURITY_WRITABLE_HOOKS? n
''}
DEBUG_WX y # boot-time warning on RWX mappings