nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-12-30 17:43:42 +00:00
Code Issues Packages Projects Releases Wiki Activity
109,406 Commits 184 Branches 125 Tags 9.8 GiB
9da4cb176a
Commit Graph

352 Commits

Author SHA1 Message Date
Joachim Fasting
72899d92d0
grsecurity: 4.5.5-201605291201 -> 4.5.6-201606051644 2016-06-07 15:04:24 +02:00
Joachim Fasting
bfefc54bc5
grsecurity: 4.5.5-201605211442 -> 4.5.5-201605291201 2016-05-29 20:34:24 +02:00
Joachim Fasting
5a357d9731
grsecurity: 4.5.5-201605202102 -> 4.5.5-201605211442 2016-05-21 22:28:36 +02:00
Joachim Fasting
cdf2ffda9d
grsecurity: 4.5.4-201605131918 -> 4.5.5-201605202102 2016-05-21 07:37:41 +02:00
Joachim Fasting
f99c86eec1
grsecurity: remove expressions for unsupported versions 
Retain top-level attributes for now but consolidate compatibility
attributes.

Part of ongoing cleanup, doing it all at once is infeasible.
 2016-05-16 09:10:27 +02:00
Joachim Fasting
6194e9d801
kernelPatches.grsecurity: 4.5.4-201605122039 -> 4.5.4-201605131918 
Also revert to using the grsecurity-scrape mirror; relying on upstream
just isn't viable. Lately, updates have been so frequent that a new
version is released before Hydra even gets around to building the
previous one.
 2016-05-14 05:15:35 +02:00
Joachim Fasting
7fdce2feb0
kernelPatches.grsecurity_4_5: 4.5.4-201605112030 -> 4.5.4-201605122039 2016-05-13 23:11:07 +02:00
Joachim Fasting
10aaca8c1f
grsecurity_4_5: 4.5.3-201605080858 -> 4.5.4-201605112030 2016-05-13 20:11:31 +02:00
Joachim Fasting
52477b0a0b
kernelPatches.grsecurity_4_5: 201605060852 -> 201605080858 2016-05-09 16:38:44 +02:00
Joachim Fasting
27061905bd
linuxPackages_grsec_4_5: 3.1-4.5.2-201604290633 -> 3.1-4.5.3-201605060852 2016-05-06 16:37:25 +02:00
Joachim Fasting
0bd31bce10
grsecurity: drop support for 4.4 kernels 
From now on, only the testing branch of grsecurity will be supported.
Additionally, use only patches from upstream.

It's impossible to provide meaningful support for grsecurity stable.
First, because building and testing \(m \times n \times z) [1], packages
is infeasible.  Second, because stable patches are only available from
upstream for-pay, making us reliant on third-parties for patches. In
addition to creating yet more work for the maintainers, using stable
patches provided by a third-party goes against the wishes of upstream.

nixpkgs provides the tools necessary to build grsecurity kernels for any
version the user chooses, however, provided they pay for, or otherwise
acquire, the patch themselves.

Eventually, we'll want to remove the now obsolete top-level attributes,
but leave them in for now to smoothe migration (they have been removed
from top-level/release.nix, though, because it makes no sense to have
them there).

[1]: where \(m\) is the number of grsecurity flavors, \(n\) is the
number of kernel versions, and z is the size of the `linuxPackages` set
 2016-05-04 01:07:53 +02:00
Joachim Fasting
7893cb1aea
linuxPackages_grsec_4_1: delete 
Upstream supports 3.14, 4.4, and 4.5
 2016-05-02 11:28:05 +02:00
Joachim Fasting
fecb56fc3f
linuxPackages_grsec_4_5: init at 3.1-4.5.2-201604290633 2016-05-02 11:28:05 +02:00
obadz
4788ec1372 linux kernel 4.4: fix race during build 
Patch drivers/crypto/qat/qat_common/Makefile so that qat_asym_algs.o
explicitly depends on headers qat_rsaprivkey-asn1.h and qat_rsapubkey-asn1.h

Hopefully fixes #14595
 2016-04-12 22:45:57 +01:00
Charles Strahan
ad7b1e24c2 fan-networking: updated patches from Ubuntu 
This pulls in updated Fan Networking patches from Ubuntu.
(https://wiki.ubuntu.com/FanNetworking)

closes #14328
 2016-04-10 16:07:03 -04:00
Domen Kožar
b95a1c4f77 kernel: fix build of 3.10 and 3.12 on i686 
(cherry picked from commit 23730413fe)
Signed-off-by: Domen Kožar <domen@dev.si>
 2016-04-06 10:36:04 +01:00
Tim Steinbach
a5d8256df4 grsecurity: 4.4.4 -> 4.4.5 2016-03-14 21:29:42 +00:00
Franz Pletz
255d710757 grsecurity: 4.4.2 -> 4.4.4 
See #13505.
 2016-03-08 01:03:47 +01:00
tg(x)
be3bd972d5 grsecurity: add 4.1 kernel 2016-02-28 15:00:16 +01:00
tg(x)
38614d3f6a grsecurity: use kernel version instead of testing / stable 2016-02-28 04:10:59 +01:00
tg(x)
4e3d6d3e90 grsecurity: separate fix patches for testing & stable 2016-02-27 19:54:55 +01:00
tg(x)
75f353ffbd grsecurity: decouple from mainline 2016-02-27 19:33:35 +01:00
tg(x)
7547960546 grsecurity: move version information to one place 2016-02-27 18:36:12 +01:00
tg(x)
d95321b83e grsecurity: 4.3.4 -> 4.4.2 2016-02-27 18:36:12 +01:00
tg(x)
42deddb17a grsecurity: use source URL from a scraped repository as grsecurity.net only has the latest version 2016-02-10 00:46:11 +01:00
Dan Peebles
78956c77c0 linux: 4.3.3 -> 4.34 (and update grsecurity patches, too) 2016-01-24 03:53:46 +00:00
Dan Peebles
33cf0792b1 grsecurity-testing: update patches and associated kernel version 2016-01-23 14:29:34 +00:00
Al Zohali
a3a5bc6095 linux_chromiumos_3_14: init at 3.14.0 
Co-authored-by: Nikolay Amiantov <ab@fmap.me>
 2016-01-13 22:43:19 +03:00
Al Zohali
ee9e7b7224 linux_chromiumos_3_18: init at 3.18.0 
Co-authored-by: Nikolay Amiantov <ab@fmap.me>
 2016-01-13 22:43:19 +03:00
William A. Kennington III
194357ad20 grsecurityUnstable: 4.1.7 -> 4.2.3 2015-10-15 10:41:04 -07:00
Paul Colomiets
84c0098117 Unprivileged overlayfs mounts kernel patch from ubuntu 
This allows to create overlayfs mounts by unprivileged containers (i.e.
in user and mount namespace). It's super-useful for containers.

The patch is trivial as I understand from the patch description it's
does not have security implications (on top of what user namespaces
already have). And it's enabled in ubuntu long time ago. Here is a proof:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1357025
 2015-09-26 00:42:16 +03:00
William A. Kennington III
84505bd36a grsecurity: Update patches 2015-09-16 13:35:41 -07:00
William A. Kennington III
d70c01daec grsecurity: Update patches 2015-08-18 21:06:45 -07:00
Charles Strahan
c1ee8fefd4 nixos: add support for Ubuntu Fan Networking 
This provides support for Ubuntu Fan Networking [1].

This includes:

* The fanctl package, and a corresponding NixOS service.
* iproute patches.
* kernel patches.

closes #9188

1: https://wiki.ubuntu.com/FanNetworking
 2015-08-13 14:27:14 -04:00
William A. Kennington III
52e55d85cb kernel: 3.14.49 -> 3.14.50 2015-08-10 23:35:43 -07:00
William A. Kennington III
974b9cc8cc kernel: 4.1.4 -> 4.1.5 2015-08-10 23:34:31 -07:00
William A. Kennington III
04f1b451d7 kernel: 3.14.48 -> 3.14.49 2015-08-04 13:30:08 -07:00
William A. Kennington III
a5d6e61c2f grsecurity: Push testing from 4.0 -> 4.1 2015-08-04 13:28:16 -07:00
William A. Kennington III
0245b28796 kernel: 3.14.47 -> 3.14.48 2015-07-11 20:15:05 -07:00
William A. Kennington III
3284b216a4 kernel: 4.0.7 -> 4.0.8 2015-07-11 20:15:05 -07:00
Eelco Dolstra
5c9f437d2f linux: 3.14.46 -> 3.14.47 
CVE-2014-7822
 2015-07-09 15:10:12 +02:00
William A. Kennington III
d64b3c8a5c kernel: 3.14.45 -> 3.14.46 2015-06-30 11:28:59 -07:00
William A. Kennington III
b25930c4c8 kernel: 4.0.6 -> 4.0.7 2015-06-30 11:20:41 -07:00
William A. Kennington III
b08d384da8 kernel: 3.14.44 -> 3.14.45 2015-06-24 18:12:20 -07:00
William A. Kennington III
2f255eafd9 kernel: 4.0.5 -> 4.0.6 2015-06-24 18:11:25 -07:00
Ricardo M. Correia
e26bfbe26f grsecurity: Update stable and test patches 
stable: 3.1-3.14.43-201506021902 -> 3.1-3.14.44-201506082249
test:   3.1-4.0.4-201506021902   -> 3.1-4.0.5-201506082251
 2015-06-10 18:33:28 +02:00
Ricardo M. Correia
07c26ee680 grsecurity: Update stable and test patches 
stable: 3.1-3.14.43-201505272112 -> 3.1-3.14.43-201506021902
test:   3.1-4.0.4-201505272113   -> 3.1-4.0.4-201506021902
 2015-06-03 19:38:05 +02:00
Ricardo M. Correia
b59d52daf7 grsecurity: Update stable and test patches 
stable: 3.1-3.14.43-201505222221 -> 3.1-3.14.43-201505272112
test:   3.1-4.0.4-201505222222   -> 3.1-4.0.4-201505272113
 2015-05-29 19:49:46 +02:00
Ricardo M. Correia
c0f09411e8 grsecurity: Update stable and test patches 
stable: 3.1-3.14.43-201505191737 -> 3.1-3.14.43-201505222221
test:   3.1-4.0.4-201505182014   -> 3.1-4.0.4-201505222222
 2015-05-27 20:27:43 +02:00
Ricardo M. Correia
5277bf945d grsecurity: Update stable patch from 3.1-3.14.43-201505181929 -> 3.1-3.14.43-201505191737 2015-05-21 14:45:56 +02:00
Ricardo M. Correia
0cb3c2d684 grsecurity: Update stable and test patches 
stable: 3.1-3.14.43-201505171736 -> 3.1-3.14.43-201505181929
test:   3.1-4.0.4-201505171737   -> 3.1-4.0.4-201505182014
 2015-05-19 19:21:31 +02:00
William A. Kennington III
9265918fea kernel: 3.14.42 -> 3.14.43 2015-05-18 01:45:49 -07:00
William A. Kennington III
4a7a3cd8a5 kernel: 4.0.3 -> 4.0.4 2015-05-18 01:43:03 -07:00
William A. Kennington III
fcf15de248 kernel: 3.14.41 -> 3.14.42 2015-05-15 18:38:14 -07:00
William A. Kennington III
90659e2735 kernel: 4.0.2 -> 4.0.3 2015-05-15 18:38:14 -07:00
Ricardo M. Correia
aa75bb25d8 grsecurity: Update stable and test patches 
stable: 3.1-3.14.41-201505072056 -> 3.1-3.14.41-201505101121
test:   3.1-4.0.2-201505072057   -> 3.1-4.0.2-201505101122
 2015-05-11 02:45:38 +02:00
William A. Kennington III
8209d3f78b kernel: 3.14.40 -> 3.14.41 2015-05-07 20:34:26 -07:00
William A. Kennington III
0e4057b167 kernel: 4.0.1 -> 4.0.2 2015-05-07 20:32:24 -07:00
Ricardo M. Correia
b95fa1c852 grsecurity: Update stable and test patches 
stable: 3.1-3.14.40-201504290821 -> 3.1-3.14.40-201504302118
test:   3.1-3.19.6-201504290821  -> 3.1-3.19.6-201504302119
 2015-05-02 01:03:05 +02:00
William A. Kennington III
084d1143e6 kernel: 3.14.39 -> 3.14.40 2015-04-29 14:34:11 -07:00
William A. Kennington III
dfd7b26e3a kernel: 3.19.5 -> 3.19.6 2015-04-29 14:33:23 -07:00
William A. Kennington III
dbaeb7c428 kernel: 3.14.38 -> 3.14.39 2015-04-20 22:41:47 -07:00
William A. Kennington III
2c35a4aa39 kernel: 3.19.4 -> 3.19.5 2015-04-20 22:40:31 -07:00
William A. Kennington III
0fd4774781 kernel: 3.14.37 -> 3.14.38 2015-04-15 16:22:42 -07:00
William A. Kennington III
2ded7833ed kernel: 3.19.3 -> 3.19.4 2015-04-15 16:22:42 -07:00
Nikolay Amiantov
285d64d2f0 kernel: add patch to fix btrfs deadlocks to affected kernels 2015-04-08 20:49:12 +03:00
Ricardo M. Correia
6566738b29 grsecurity: Update stable and test patches 
stable: 3.1-3.14.37-201503270048 -> 3.1-3.14.37-201504051405
test:   3.1-3.19.3-201503270049  -> 3.1-3.19.3-201504021826
 2015-04-06 18:26:05 +02:00
William A. Kennington III
304b3c077c kernel: 3.14.36 -> 3.14.37 2015-03-27 10:45:13 -07:00
William A. Kennington III
ca12b0b304 kernel: 3.19.2 -> 3.19.3 2015-03-27 10:44:19 -07:00
Ricardo M. Correia
0f5a5cae76 grsecurity: Update test patch from 3.1-3.19.2-201503182219 -> 3.1-3.19.2-201503201903 2015-03-21 06:23:26 +01:00
William A. Kennington III
36ada70250 kernel: 3.14.35 -> 3.14.36 2015-03-20 14:21:39 -07:00
William A. Kennington III
a7c32c8ea5 kernel: 3.19.1 -> 3.19.2 2015-03-20 14:19:49 -07:00
Eelco Dolstra
cb7b0f3c1b Merge pull request #6898 from joachifm/redundant-params 
kernelPatches: remove unused parameters
 2015-03-19 15:31:03 +01:00
Joachim Fasting
cd55b6b5bb kernelPatches: remove unused parameters 2015-03-19 14:08:16 +01:00
Ricardo M. Correia
7c8247a8c5 grsecurity: Update stable and test patches 
stable: 3.1-3.14.35-201503071140 -> 3.1-3.14.35-201503092203
test:   3.1-3.18.9-201503071142  -> 3.1-3.19.1-201503122205
 2015-03-15 03:49:58 +01:00
William A. Kennington III
6b666dca7c kernel: 3.14.34 -> 3.14.35 2015-03-08 14:58:46 -07:00
William A. Kennington III
cf9d5ceda1 kernel: 3.18.8 -> 3.18.9 2015-03-08 14:57:44 -07:00
William A. Kennington III
24f25e6f9a kernel: 3.18.7 -> 3.18.8 2015-03-02 19:52:26 -08:00
William A. Kennington III
103f9820f6 kernel: 3.14.33 -> 3.14.34 2015-03-02 19:52:26 -08:00
Ricardo M. Correia
e196cd5611 grsecurity: Update stable and test patches 
stable: 3.0-3.14.33-201502200812 -> 3.1-3.14.33-201502222137
test:   3.0-3.18.7-201502200813  -> 3.1-3.18.7-201502222138
 2015-02-23 18:38:13 +01:00
Ricardo M. Correia
50bf56fd09 grsecurity: Update stable and test patches 
stable: 3.0-3.14.33-201502181906 -> 3.0-3.14.33-201502200812
test:   3.0-3.18.7-201502180834  -> 3.0-3.18.7-201502200813
 2015-02-20 14:29:45 +01:00
Ricardo M. Correia
99eb8705cd grsecurity: Update stable patch from 3.0-3.14.33-201502180832 -> 3.0-3.14.33-201502181906 2015-02-19 04:47:44 +01:00
Ricardo M. Correia
c5a7115721 grsecurity: Update stable and test patches 
stable: 3.0-3.14.32-201502062101 -> 3.0-3.14.33-201502180832
test:   3.0-3.18.6-201502062100  -> 3.0-3.18.7-201502180834
 2015-02-18 17:24:53 +01:00
Vladimír Čunát
57f2d329ac linux_3_{10,12,14}: fix upstream regression, fixes #6231 
Some modules wouldn't load crc32c dependency due to module renaming.
 2015-02-10 13:45:20 +01:00
William A. Kennington III
c4d21cf1c4 kernel: 3.14.31 -> 3.14.32 2015-02-07 12:08:09 -08:00
William A. Kennington III
f103b0f78b kernel: 3.18.5 -> 3.18.6 2015-02-07 12:07:17 -08:00
William A. Kennington III
bbd6384f62 kernel: 3.14.29 -> 3.14.31 2015-01-31 18:55:09 -08:00
William A. Kennington III
8a2f7375d6 kernel: 3.18.3 -> 3.18.5 2015-01-31 18:54:59 -08:00
Ricardo M. Correia
23ffd6ad22 grsecurity: Update stable and test patches 
stable: 3.0-3.14.29-201501182217 -> 3.0-3.14.29-201501211943
test:   3.0-3.18.3-201501182219  -> 3.0-3.18.3-201501211944
 2015-01-22 05:39:01 +01:00
William A. Kennington III
fb921695b6 kernel: Fix grsec patch for 3.18.3 2015-01-18 21:11:07 -08:00
William A. Kennington III
2c02b7caff kernel: 3.14.28 -> 3.14.29 2015-01-18 21:11:07 -08:00
Ricardo M. Correia
1f28bfa284 grsecurity: Update stable and test patches 
stable: 3.0-3.14.28-201501120819 -> 3.0-3.14.28-201501142323
test:   3.0-3.18.2-201501120821  -> 3.0-3.18.2-201501142325
 2015-01-16 02:47:12 +01:00
William A. Kennington III
1ec68e0d13 kernel: Fix path to stp bridge helper 2015-01-14 10:34:28 -08:00
William A. Kennington III
3d4b315d91 Revert "kernel: Add a patch to remove checks for bridge stp helpers" 
This reverts commit f64c3ce18d.
 2015-01-13 15:34:26 -08:00
William A. Kennington III
f64c3ce18d kernel: Add a patch to remove checks for bridge stp helpers 2015-01-13 15:24:02 -08:00
Ricardo M. Correia
757071af5b grsecurity: Update stable and test patches 
stable: 3.0-3.14.28-201501111421 -> 3.0-3.14.28-201501120819
test:   3.0-3.18.2-201501111422  -> 3.0-3.18.2-201501120821
 2015-01-12 18:21:22 +01:00
William A. Kennington III
97783b87c0 kernel: 3.14.27 -> 3.14.28 2015-01-11 23:59:13 -08:00
William A. Kennington III
33651bb865 kernel: 3.18.1 -> 3.18.2 2015-01-11 23:58:19 -08:00
Ricardo M. Correia
e90bfba2f6 grsecurity: Update stable and test patches 
stable: 3.0-3.14.27-201412280859 -> 3.0-3.14.27-201501042018
test:   3.0-3.18.1-201412281149  -> 3.0-3.18.1-201501042021
 2015-01-07 05:49:56 +01:00
Ricardo M. Correia
1d44322d53 grsecurity: Update stable and test patches 
stable: 3.0-3.14.27-201412211908 -> 3.0-3.14.27-201412280859
test:   3.0-3.17.7-201412211910  -> 3.0-3.18.1-201412281149
 2014-12-29 03:00:47 +01:00
Ricardo M. Correia
a8e33da2dd grsecurity: Update stable and test patches 
stable: 3.0-3.14.27-201412170659 -> 3.0-3.14.27-201412211908
test:   3.0-3.17.7-201412170700  -> 3.0-3.17.7-201412211910
 2014-12-22 20:33:00 +01:00
William A. Kennington III
7e8c5b578a kernel: 3.14.26 -> 3.14.27 2014-12-17 14:36:38 -08:00
William A. Kennington III
eea5383b48 kernel: 3.17.6 -> 3.17.7 2014-12-17 14:36:29 -08:00
William A. Kennington III
042f266e10 kernel: 3.14.25 -> 3.14.26 2014-12-08 23:24:50 -08:00
William A. Kennington III
c8abfe37ab kernel: 3.17.4 -> 3.17.6 2014-12-08 23:23:42 -08:00
Ricardo M. Correia
7ce1cbed93 grsecurity: Update stable and test patches 
stable: 3.0-3.14.25-201411260106 -> 3.0-3.14.25-201412040016
test:   3.0-3.17.4-201411260107  -> 3.0-3.17.4-201412040017
 2014-12-05 18:26:21 +01:00
Ricardo M. Correia
6f31905563 grsecurity: Update stable and test patches 
stable: 3.0-3.14.25-201411231452 -> 3.0-3.14.25-201411260106
test:   3.0-3.17.4-201411231452  -> 3.0-3.17.4-201411260107
 2014-11-27 18:36:01 +01:00
Ricardo M. Correia
c07f81ce89 grsecurity: Update stable and test patches 
stable: 3.0-3.14.25-201411220954 -> 3.0-3.14.25-201411231452
test:   3.0-3.17.4-201411220955  -> 3.0-3.17.4-201411231452
 2014-11-24 03:53:28 +01:00
William A. Kennington III
d1493bc1ee kernel: 3.14.24 -> 3.14.25 2014-11-23 02:47:36 -08:00
Jonathan Rudenberg
30578e30d8 kernel: 3.17.3 -> 3.17.4 2014-11-22 16:50:16 -05:00
William A. Kennington III
f4a27311b7 kernel: 3.14.23 -> 3.14.24 2014-11-14 23:03:54 -08:00
William A. Kennington III
0ef4ee5d06 kernel: 3.17.2 -> 3.17.3 2014-11-14 23:03:47 -08:00
Ricardo M. Correia
c108ab47be grsecurity: Update stable and test patches 
stable: 3.0-3.14.23-201411062033 -> 3.0-3.14.23-201411091053
test:   3.0-3.17.2-201411062034  -> 3.0-3.17.2-201411091054
 2014-11-10 19:34:00 +01:00
Ricardo M. Correia
5701e40681 grsecurity: Update stable and test patches 
stable: 3.0-3.14.23-201410312212 -> 3.0-3.14.23-201411062033
test:   3.0-3.17.2-201410312213  -> 3.0-3.17.2-201411062034
 2014-11-09 02:47:54 +01:00
Ricardo M. Correia
268c72b92b grsecurity: Update stable and test patches 
stable: 3.0-3.14.22-201410250026 -> 3.0-3.14.23-201410312212
test:   3.0-3.17.1-201410281754  -> 3.0-3.17.2-201410312213
 2014-11-01 17:25:22 +01:00
Ricardo M. Correia
a9170c0dba grsecurity: Update stable and test patches 
stable: 3.0-3.14.22-201410192047 -> 3.0-3.14.22-201410250026
test:   3.0-3.17.1-201410192051  -> 3.0-3.17.1-201410281754
 2014-10-30 12:47:36 +01:00
Alexander Kjeldaas
005bb796e6 Updated grsec. 2014-10-22 02:18:41 +02:00
Ricardo M. Correia
c615793317 grsecurity: Update stable and test patches 
stable: 3.0-3.14.19-201409282024 -> 3.0-3.14.20-201410062037
test:   3.0-3.16.3-201409282025  -> 3.0-3.16.4-201410062041
 2014-10-07 16:55:49 +02:00
Ricardo M. Correia
bbdc35d4dd grsecurity: Update stable and test patches 
stable: 3.0-3.14.19-201409180900 -> 3.0-3.14.19-201409282024
test:   3.0-3.16.3-201409180901  -> 3.0-3.16.3-201409282025
 2014-09-29 14:44:20 +02:00
Ricardo M. Correia
cf61fa8013 grsecurity: Update stable and test patches 
stable: 3.0-3.14.18-201409060013 -> 3.0-3.14.19-201409180900
test:   3.0-3.16.2-201409060014  -> 3.0-3.16.3-201409180901
 2014-09-25 23:37:26 +02:00
Ricardo M. Correia
238a84ac78 grsecurity: Update stable and test patches 
stable: 3.0-3.14.17-201408260041 -> 3.0-3.14.18-201409060013
test:   3.0-3.15.10-201408212335 -> 3.0-3.16.2-201409060014
 2014-09-08 15:16:38 +02:00
Austin Seipp
2dc2699ca4 linux/grsec: updates 
3.15.10 is EOL soon, but grsecurity/unstable hasn't moved to 3.16.x yet.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
 2014-08-27 15:14:19 -05:00
Ricardo M. Correia
b50074929e grsecurity: Update stable and test patches 
stable: 3.0-3.14.9-201406262057 -> 3.0-3.14.10-201407012152
test:   3.0-3.15.2-201406262058 -> 3.0-3.15.3-201407012153
 2014-07-03 11:37:19 +02:00
Austin Seipp
dd56bfbd00 kernel/grsec: updates 
Signed-off-by: Austin Seipp <aseipp@pobox.com>
 2014-06-27 00:52:12 -05:00
Austin Seipp
0399c5ee24 grsecurity: update stable/testing kernels, refactoring 
This updates the new stable kernel to 3.14, and the new testing kernel
to 3.15.

This also removes the vserver kernel, since it's probably not nearly as
used.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
 2014-06-22 22:29:10 -05:00
Austin Seipp
b8ede68b25 kernel/grsec: updates 
Signed-off-by: Austin Seipp <aseipp@pobox.com>
 2014-06-21 22:13:49 -05:00
Austin Seipp
b43421221f kernel/grsec: updates; add mainline package for brave souls 
Signed-off-by: Austin Seipp <aseipp@pobox.com>
 2014-06-05 06:06:19 -05:00
Austin Seipp
cb894d4fc3 grsec: updates 
Signed-off-by: Austin Seipp <aseipp@pobox.com>
 2014-05-17 14:09:09 -05:00
Austin Seipp
92abc4c610 kernel: enable AppArmor by default 
AppArmor only requires a few patches to the 3.2 and 3.4 kernels in order
to work properly (with the minor catch grsecurity -stable includes the
3.2 patches.) This adds them to the kernel builds by default, removes
features.apparmor (since it's always true) and makes it the default MAC
system.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
 2014-05-17 14:09:09 -05:00
Austin Seipp
92f7781f00 kernel/grsecurity: stable/longterm/testing updates 
kernels:

  - longterm: 3.4.87  -> 3.4.88
  - longterm: 3.10.37 -> 3.10.38
  - stable:   3.13.10 -> 3.13.11
  - stable:   3.14.1  -> 3.14.2

grsecurity:

  - test: 3.0-3.14.1-201404241722 -> 3.0-3.14.2-201404270907

NOTE: technically the 3.13 stable kernel is now EOL. However, it will
become the long-term grsecurity stable kernel, and will have ongoing
support from Canonical.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
 2014-04-27 08:41:42 -05:00
Ricardo M. Correia
efae8ce543 grsecurity: Update all patches 
stable:  3.0-3.2.57-201404182109            -> 3.0-3.2.57-201404241714
test:    3.0-3.14.1-201404201132            -> 3.0-3.14.1-201404241722
vserver: 3.0-3.2.57-vs2.3.2.16-201404182110 -> 3.0-3.2.57-vs2.3.2.16-201404241715
 2014-04-25 04:41:58 +02:00
Ricardo M. Correia
5d5ca7b260 grsecurity: Update all patches 
stable:  3.0-3.2.57-201404131252            -> 3.0-3.2.57-201404182109
test:    3.0-3.13.10-201404141717           -> 3.0-3.14.1-201404201132
vserver: 3.0-3.2.57-vs2.3.2.16-201404131253 -> 3.0-3.2.57-vs2.3.2.16-201404182110
 2014-04-21 18:46:41 +02:00
Ricardo M. Correia
1b113178ee grsecurity: Update test patch from 3.0-3.13.9-201404131254 -> 3.0-3.13.10-201404141717 2014-04-15 00:16:29 +02:00
Austin Seipp
788d9a13fb grsecurity: stable/vserver/testing updates 
- stable:  201404111812            -> 201404131252
 - vserver: vs2.3.2.16-201404111814 -> vs2.3.2.16-201404131253
 - testing: 201404111815            -> 201404131254

Signed-off-by: Austin Seipp <aseipp@pobox.com>
 2014-04-13 13:11:17 -05:00
Austin Seipp
172dc1336f nixos: add grsecurity module (#1875) 
This module implements a significant refactoring in grsecurity
configuration for NixOS, making it far more usable by default and much
easier to configure.

 - New security.grsecurity NixOS attributes.
   - All grsec kernels supported
   - Allows default 'auto' grsec configuration, or custom config
   - Supports custom kernel options through kernelExtraConfig
   - Defaults to high-security - user must choose kernel, server/desktop
     mode, and any virtualisation software. That's all.
   - kptr_restrict is fixed under grsecurity (it's unwriteable)
 - grsecurity patch creation is now significantly abstracted
   - only need revision, version, and SHA1
   - kernel version requirements are asserted for sanity
   - built kernels can have the uname specify the exact grsec version
     for development or bug reports. Off by default (requires
     `security.grsecurity.config.verboseVersion = true;`)
 - grsecurity sysctl support
   - By default, disabled.
   - For people who enable it, NixOS deploys a 'grsec-lock' systemd
     service which runs at startup. You are expected to configure sysctl
     through NixOS like you regularly would, which will occur before the
     service is started. As a result, changing sysctl settings requires
     a reboot.
 - New default group: 'grsecurity'
   - Root is a member by default
   - GRKERNSEC_PROC_GID is implicitly set to the 'grsecurity' GID,
     making it possible to easily add users to this group for /proc
     access
 - AppArmor is now automatically enabled where it wasn't before, despite
   implying features.apparmor = true

The most trivial example of enabling grsecurity in your kernel is by
specifying:

    security.grsecurity.enable          = true;
    security.grsecurity.testing         = true;      # testing 3.13 kernel
    security.grsecurity.config.system   = "desktop"; # or "server"

This specifies absolutely no virtualisation support. In general, you
probably at least want KVM host support, which is a little more work.
So:

    security.grsecurity.enable = true;
    security.grsecurity.stable = true; # enable stable 3.2 kernel
    security.grsecurity.config = {
      system   = "server";
      priority = "security";
      virtualisationConfig   = "host";
      virtualisationSoftware = "kvm";
      hardwareVirtualisation = true;
    }

This module has primarily been tested on Hetzner EX40 & VQ7 servers
using NixOps.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
 2014-04-11 22:43:51 -05:00
Ricardo M. Correia
5dfc6584a5 grsecurity: Update stable patch from 3.0-3.2.56-201404062126 -> 3.0-3.2.57-201404091758 2014-04-10 00:37:33 +02:00
Ricardo M. Correia
807fad571a grsecurity: Update stable and test patches 
stable: 3.0-3.2.56-201404012135 -> 3.0-3.2.56-201404062126
test:   3.0-3.13.8-201404011912 -> 3.0-3.13.9-201404062127
 2014-04-07 15:31:12 +02:00
Ricardo M. Correia
52d233af22 grsecurity: Update stable patch from 3.0-3.2.55-201403300851 -> 3.0-3.2.56-201404012135 2014-04-02 15:11:33 +02:00
Ricardo M. Correia
407a6857c6 grsecurity: Update stable and test patches 
stable: 3.0-3.2.55-201403252026 -> 3.0-3.2.55-201403300851
test:   3.0-3.13.7-201403252047 -> 3.0-3.13.8-201404011912
 2014-04-02 02:16:59 +02:00
Ricardo M. Correia
911f332279 grsecurity: Update stable and test patches 
stable: 3.0-3.2.55-201403202347 -> 3.0-3.2.55-201403252026
test:   3.0-3.13.6-201403202349 -> 3.0-3.13.7-201403252047
 2014-03-26 23:07:57 +00:00
Ricardo M. Correia
9db587bf7d grsecurity: Update stable and test patches 
stable: 3.0-3.2.55-201403172027 -> 3.0-3.2.55-201403202347
test:   3.0-3.13.6-201403172032 -> 3.0-3.13.6-201403202349
 2014-03-21 15:41:32 +01:00
Shea Levy
e4961c63f7 Remove sec_perm patch that was needed by AUFS 
Now the kernel is unpatched by default on non-MIPS!
 2014-03-21 04:37:23 -04:00
Ricardo M. Correia
cc69228119 grsecurity: Update stable and test patches 
stable: 3.0-3.2.55-201403142107 -> 3.0-3.2.55-201403172027
test:   3.0-3.13.6-201403142112 -> 3.0-3.13.6-201403172032
 2014-03-18 16:51:25 +01:00
Ricardo M. Correia
ceec014020 grsecurity: Update stable and test patches 
stable: 3.0-3.2.55-201403122114 -> 3.0-3.2.55-201403142107
test:   3.0-3.13.6-201403122116 -> 3.0-3.13.6-201403142112
 2014-03-15 04:15:28 +01:00
Ricardo M. Correia
86b8cf954a grsecurity: Update stable and test patches 
stable: 3.0-3.2.55-201403072107 -> 3.0-3.2.55-201403122114
test:   3.0-3.13.6-201403072241 -> 3.0-3.13.6-201403122116
 2014-03-13 02:28:58 +01:00
Ricardo M. Correia
d999872b8d grsecurity: Update stable and test patches 
stable: 3.0-3.2.55-201403022154 -> 3.0-3.2.55-201403072107
test:   3.0-3.13.5-201403031445 -> 3.0-3.13.6-201403072241
 2014-03-10 17:23:17 +01:00
Austin Seipp
c4d5757e29 grsecurity updates 
- stable:  3.0-3.2.55-201402241936 -> 3.0-3.2.55-201403022154
  - testing: 3.0-3.13.5-201402241943 -> 3.0-3.13.5-201403031445

Signed-off-by: Austin Seipp <aseipp@pobox.com>
 2014-03-04 01:13:22 +01:00
Ricardo M. Correia
69a83ba99f grsecurity: Update stable and test patches 
stable: 3.0-3.2.55-201402221305 -> 3.0-3.2.55-201402241936
test:   3.0-3.13.4-201402221308 -> 3.0-3.13.5-201402241943
 2014-03-03 02:16:58 +01:00
Austin Seipp
7f4b97d495 grsecurity: stable/testing updates 
- stable:  3.0-3.2.55-201402201903 -> 3.0-3.2.55-201402221305
 - testing: 3.0-3.13.4-201402201908 -> 3.0-3.13.4-201402221308

Signed-off-by: Austin Seipp <aseipp@pobox.com>
 2014-02-22 20:29:25 +01:00
Austin Seipp
18f65f3640 grsecurity: stable/testing updates 
- stable:  3.0-3.2.55-201402192249 -> 3.0-3.2.55-201402201903
  - testing: 3.0-3.13.3-201402192252 -> 3.0-3.13.4-201402201908

Signed-off-by: Austin Seipp <aseipp@pobox.com>
 2014-02-20 20:21:16 -06:00