nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-12-13 01:03:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

linux: enable INIT_ON_ALLOC_DEFAULT_ON

Browse Source 
Enabled in [Arch][1], [Debian][2]; not in Fedora. Recommended by [Kernel
Self Protection Project][3].

This can still be disabled with `init_on_alloc=0` boot arg.

As it is now in common-config, remove from hardened’s extra config.

[1]: 6392fb2bed/config (L10859)
[2]: 5f6aa5cb48/debian/config/config (L7718)
[3]: https://kernsec.org/wiki/index.php?title=Kernel_Self_Protection_Project/Recommended_Settings&oldid=4078
This commit is contained in:
Andrew Marshall 2024-04-01 11:37:34 -04:00
parent b23e741b70
commit b6c752bddb
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkgs/os-specific/linux/kernel/common-config.nix
View File

@ -723,6 +723,8 @@ let
# Randomize page allocator when page_alloc.shuffle=1 # Randomize page allocator when page_alloc.shuffle=1
SHUFFLE_PAGE_ALLOCATOR = whenAtLeast "5.2" yes; SHUFFLE_PAGE_ALLOCATOR = whenAtLeast "5.2" yes;
INIT_ON_ALLOC_DEFAULT_ON = whenAtLeast "5.3" yes;
# Enable stack smashing protections in schedule() # Enable stack smashing protections in schedule()
# See: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v4.8&id=0d9e26329b0c9263d4d9e0422d80a0e73268c52f # See: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v4.8&id=0d9e26329b0c9263d4d9e0422d80a0e73268c52f
SCHED_STACK_END_CHECK = yes; SCHED_STACK_END_CHECK = yes;

3
pkgs/os-specific/linux/kernel/hardened/config.nix
View File

@ -53,8 +53,7 @@ assert (versionAtLeast version "4.9");
PAGE_POISONING_NO_SANITY = whenOlder "5.11" yes; PAGE_POISONING_NO_SANITY = whenOlder "5.11" yes;
PAGE_POISONING_ZERO = whenOlder "5.11" yes; PAGE_POISONING_ZERO = whenOlder "5.11" yes;
# Enable init_on_alloc and init_on_free by default # Enable init_on_free by default
INIT_ON_ALLOC_DEFAULT_ON = whenAtLeast "5.3" yes;
INIT_ON_FREE_DEFAULT_ON = whenAtLeast "5.3" yes; INIT_ON_FREE_DEFAULT_ON = whenAtLeast "5.3" yes;
# Wipe all caller-used registers on exit from a function # Wipe all caller-used registers on exit from a function