Archive/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-10-23 12:00:35 -04:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
nixpkgs/pkgs/os-specific/linux
History
Joachim Fasting 75b9a7beac
grsecurity: implement a single NixOS kernel 
This patch replaces the old grsecurity kernels with a single NixOS
specific grsecurity kernel.  This kernel is intended as a general
purpose kernel, tuned for casual desktop use.

Providing only a single kernel may seem like a regression compared to
offering a multitude of flavors.  It is impossible, however, to
effectively test and support that many options.  This is amplified by
the reality that very few seem to actually use grsecurity on NixOS,
meaning that bugs go unnoticed for long periods of time, simply because
those code paths end up never being exercised.  More generally, it is
hopeless to anticipate imagined needs.  It is better to start from a
solid foundation and possibly add more flavours on demand.

While the generic kernel is intended to cover a wide range of use cases,
it cannot cover everything.  For some, the configuration will be either
too restrictive or too lenient.  In those cases, the recommended
solution is to build a custom kernel --- this is *strongly* recommended
for security sensitive deployments.

Building a custom grsec kernel should be as simple as
```nix
linux_grsec_nixos.override {
  extraConfig = ''
    GRKERNSEC y
    PAX y
    # and so on ...
  '';
}
```

The generic kernel should be usable both as a KVM guest and host.  When
running as a host, the kernel assumes hardware virtualisation support.
Virtualisation systems other than KVM are *unsupported*: users of
non-KVM systems are better served by compiling a custom kernel.

Unlike previous Grsecurity kernels, this configuration disables `/proc`
restrictions in favor of `security.hideProcessInformation`.

Known incompatibilities:
- ZFS: can't load spl and zfs kernel modules; claims incompatibility
  with KERNEXEC method `or` and RAP; changing to `bts` does not fix the
  problem, which implies we'd have to disable RAP as well for ZFS to
  work
- `kexec()`: likely incompatible with KERNEXEC (unverified)
- Xen: likely incompatible with KERNEXEC and UDEREF (unverified)
- Virtualbox: likely incompatible with UDEREF (unverified)
2016-06-14 00:08:20 +02:00
..
915resolution
acpi
acpi-call
acpid acpid: 2.0.25 -> 2.0.27; maintain 2016-04-30 14:15:33 +02:00
acpitool
afuse
alienfx
alsa-firmware
alsa-lib alsaLib: 1.1.0 -> 1.1.1 2016-05-10 04:53:17 +02:00
alsa-oss
alsa-plugins alsa : 1.0.9 -> 1.1.0 2016-02-13 19:04:41 +00:00
alsa-tools Fix sha256 for alsa-tools. 2016-02-18 06:41:40 -05:00
alsa-utils alsa : 1.0.9 -> 1.1.0 2016-02-13 19:04:41 +00:00
android-udev-rules android-udev-rules: 2016-03-03 -> 2016-04-26 2016-04-30 03:12:33 +03:00
apparmor apparmor: cleanups 2016-04-18 02:21:12 +02:00
ati-drivers Merge branch 'master' into staging 2016-05-23 09:02:10 +02:00
atop atop: update 2.1-1 -> 2.2-3 2015-07-05 00:32:53 +03:00
audit audit: 2.4.2 -> 2.4.4 2015-09-17 14:12:38 -07:00
autofs autofs: 5.0.8 -> 5.1.1 2015-09-18 05:02:02 +02:00
batman-adv batman-adv: 2016.0 -> 2016.1 2016-05-31 20:10:26 +02:00
bbswitch
bcc bcc: init at git-2016-05-18 2016-05-18 11:09:18 +01:00
blcr blcr: drop support for kernel 3.12 2015-09-12 13:17:01 +02:00
blktrace Adding blktrace 2016-05-03 00:26:27 +02:00
bluez bluez: 5.39 -> 5.40 2016-05-30 20:56:59 +02:00
bridge-utils
broadcom-sta broadcom-sta: fix build on kernel >= 4.2 (close #9953) 2015-09-20 08:01:37 +02:00
btfs btfs: 2.8 -> 2.9 2016-05-28 15:21:15 +02:00
busybox busybox: fix minimal build with musl libc 2015-10-25 10:20:08 +01:00
can-utils can-utils: updated homepage url (close #9425) 2015-08-24 18:55:55 +02:00
cgmanager cgmanager: 0.39 -> 0.41 2016-04-12 15:49:54 +02:00
checkpolicy selinux: Use fstack-protector=all 2015-07-31 17:11:11 -07:00
checksec treewide: Mass replace 'binutils}/bin' to refer to the correct outputs 2016-04-14 08:32:20 +03:00
cifs-utils cifs_utils: 6.4 -> 6.5; maintain 2016-05-25 02:06:47 +02:00
conky conky: 1.10.0 -> 1.10.1 2016-01-17 11:22:10 +01:00
conntrack-tools conntrack_tools: 1.4.2 -> 1.4.3; maintain 2015-09-10 23:01:30 +02:00
consoletools consoletools: copy utils to bin 2016-04-29 11:12:34 +08:00
conspy conspy: 1.13 -> 1.14 2016-04-13 14:47:04 +02:00
cpufrequtils glibc: Drop hurd support 2016-02-18 21:11:15 +01:00
cpupower cpupower: correct meta.homepage 2016-05-09 02:57:07 +02:00
cramfsswap Use mirror:// URIs for ftp.debian.org 2015-05-22 10:39:27 +02:00
crda Add version attribute where maintainers |= nckx 2016-01-25 17:35:21 +01:00
criu treewide: Make explicit that 'dev' output of libnl is used 2016-05-19 10:00:43 +02:00
cryopid
cryptodev
cryptsetup cryptsetup: 1.6.7 -> 1.7.0 2015-11-05 18:21:43 -08:00
directvnc directvnc: reimplement using mkDerivation 2015-11-24 14:45:15 +01:00
disk-indicator Fix lots of fetchgit hashes (fallout from #15469) 2016-06-03 17:17:08 +03:00
dmidecode dmidecode: 2.12 -> 3.0 2015-09-13 15:55:49 -07:00
dmraid
dmtcp
dpdk dpdk: make primary output usable as RTE_SDK 2016-06-02 02:12:06 -07:00
drbd Merge branch 'master' into closure-size 2016-02-14 08:33:51 +01:00
dstat Convert some *Flags from strings to lists 2015-11-26 23:45:31 +01:00
e1000e Version bump of e1000e driver (2.5.4 -> 3.3.1) 2016-01-23 21:17:56 +00:00
ebtables
edac-utils Fixed some descriptions 2015-06-29 16:20:58 +02:00
eudev eudev: 3.1.2 -> 3.1.5 2015-10-13 19:30:29 +03:00
eventstat eventstat: init at 0.02.02 2015-09-29 15:45:09 -04:00
facetimehd facetimehd, facetimehd-firmware: Add grahamc as a maintainer 2016-05-26 14:10:03 -05:00
fanctl replace makeSearchPath tree-wise to take care of possible multiple outputs 2016-04-13 22:09:41 +03:00
fatrace fatrace: 0.11 -> 0.12 2016-04-28 14:20:18 +02:00
fbterm
ffado Revert "Refactor mkFlag / shouldUsePkg into the nixpkgs libraries" 2015-06-04 14:54:48 +02:00
firejail firejail: 0.9.38 -> 0.9.40 2016-04-13 14:47:04 +02:00
firmware Fix lots of fetchgit hashes (fallout from #15469) 2016-06-03 17:17:08 +03:00
flashbench
forktty
frandom
freefall freefall: inherit kernel package from linuxPackages 2016-03-16 21:10:20 +01:00
fswebcam fswebcam: init 20140113 2016-03-30 09:48:11 +02:00
ftop Add version attribute where maintainers |= nckx 2016-01-25 17:35:21 +01:00
fuse fuse: 2.9.3 -> 2.9.5 2016-03-19 21:01:20 +01:00
fusionio fusionio: Use makeLibraryPath 2016-06-07 21:18:10 +03:00
fxload
gfxtablet Fix lots of fetchgit hashes (fallout from #15469) 2016-06-03 17:17:08 +03:00
gogoclient
google-authenticator
gradm treewide: Mass replace 'binutils}/bin' to refer to the correct outputs 2016-04-14 08:32:20 +03:00
guvcview guvcview: add pulseaudioSupport option (default true) 2016-01-05 11:54:47 +01:00
hal-flash Use common licence attributes from lib/licenses.nix 2015-05-27 22:00:06 +02:00
hdapsd New hdapsd module 2016-02-24 21:51:13 +01:00
hdparm hdparm: 9.45 -> 9.48 2015-07-09 17:30:35 -07:00
hibernate
hostapd
hwdata
i2c-tools i2c-tools: Fetch source from debian 2016-01-03 19:34:37 +02:00
i7z l7z: spaces 2016-04-20 18:55:54 +03:00
i810switch
ifenslave
ima-evm-utils Fix lots of fetchgit hashes (fallout from #15469) 2016-06-03 17:17:08 +03:00
iomelt
iotop buildPythonApplication: use new function for Python applications 2016-02-19 13:16:41 +01:00
iproute iproute2: 4.3.0 -> 4.5.0 (#15193) 2016-05-06 03:09:47 +02:00
ipsec-tools Bring my stdenv.lib.maintainers user name in line with my github nick. 2016-05-16 22:49:55 +02:00
ipset ipset: 6.26 -> 6.27 2015-11-07 16:28:14 -08:00
iptables Revert "iptables: add 1.6 branch (init 1.6.0). Not making it the default this time." 2016-05-03 20:29:52 +02:00
iputils iputils: drop dontGzipMan, as it's not needed anymore 2015-10-25 12:22:32 +01:00
irqbalance irqbalance: init at 1.1.0 2016-01-08 12:37:43 +01:00
iw iw: 4.1 -> 4.3 2016-05-03 16:15:20 +02:00
jfbview jfbview: split out jfbpdf (jfbview w/o imlib2) 2016-05-06 13:47:50 +02:00
jool jool: mark broken for kernel versions > 4.3 2016-03-26 20:23:48 +01:00
jujuutils
kbd kbd: Reference correct output of bzip2 2015-10-03 14:08:52 +02:00
kbdlight Add kbdlight package and setuid wrapper 2015-05-11 13:23:01 +08:00
kernel grsecurity: implement a single NixOS kernel 2016-06-14 00:08:20 +02:00
kernel-headers linuxHeaders_4_4: init at 4.4.10 2016-05-14 09:14:00 +02:00
kexectools kexectools: 2.0.11 -> 2.0.12 2016-03-23 14:37:08 +01:00
keyutils
klibc linuxPackages.klibc: use linuxHeaders 2016-04-19 14:45:36 +02:00
kmod linux: Compress kernel modules 2016-02-01 18:19:23 +01:00
kmod-blacklist-ubuntu Revert "kmod-blacklist-ubuntu: update to Vivid" 2015-06-08 12:34:24 +02:00
kmod-debian-aliases kmod-debian-aliases: init at 21-1 2015-09-13 10:55:44 +02:00
kmscon kmscon: Fix build against systemd 230 2016-05-26 21:05:55 +02:00
latencytop
ldm Fix lots of fetchgit hashes (fallout from #15469) 2016-06-03 17:17:08 +03:00
libaio
libatasmart
libcap libcap: replace old split with multi-output 2016-05-03 19:52:10 +02:00
libcap-ng libcap-ng: 0.7.3 -> 0.7.7 2015-09-23 20:49:19 -07:00
libcgroup
libnl libnl: 3.2.26 -> 3.2.27 2016-05-03 16:15:20 +02:00
libnscd
libselinux Remove no longer (or never) referenced patches 2016-01-24 02:02:21 +01:00
libsemanage selinux: Use fstack-protector=all 2015-07-31 17:11:11 -07:00
libsepol selinux: Use fstack-protector=all 2015-07-31 17:11:11 -07:00
libsmbios Bring my stdenv.lib.maintainers user name in line with my github nick. 2016-05-16 22:49:55 +02:00
libvolume_id
light
lightum Fix lots of fetchgit hashes (fallout from #15469) 2016-06-03 17:17:08 +03:00
lm-sensors lm_sensors: add Fedora mirror 2016-05-18 15:58:01 +02:00
lockdep nixpkgs: lockdep 3.19.1 -> 4.1.2 2015-07-20 13:52:33 -05:00
lsb-release lsb-release: init at 1.4 2016-04-22 14:03:27 -03:00
lsiutil
lsscsi lsscsi: 0.27 -> 0.28 2016-05-16 16:12:22 +02:00
lttng-modules lttng-modules: mark as broken on kernel version <3.18 2016-03-27 20:13:21 +02:00
lvm2 Adding libuuid (libblkid) to lvm2. 2016-05-06 15:09:49 +02:00
lxc lxc: 2.0.0 -> 2.0.1 2016-05-23 19:30:45 +02:00
macchanger macchanger: move build deps to nativeBuildInputs 2016-03-12 18:53:27 +01:00
mba6x_bl mba6x_bl: init at 2016-02-12 2016-03-07 19:01:55 +01:00
mbpfan mbpfan: 1.9.0 -> 1.9.1 2016-03-17 02:02:21 -04:00
mcelog mcelog: 137 -> 138 2016-06-07 12:49:26 +02:00
mdadm mdadm: call /var/setuid-wrappers/sendmail instead of /usr/sbin/sendmail 2016-05-04 15:27:53 +02:00
microcode
mingetty
miraclecast Revert "Revert "Merge pull request #9543 from NixOS/staging.post-15.06"" 2015-11-14 12:32:51 -08:00
mkinitcpio-nfs-utils mkinitcpio-nfs-utils: init at 0.3 2015-10-18 18:37:52 +03:00
mmc-utils Fix lots of fetchgit hashes (fallout from #15469) 2016-06-03 17:17:08 +03:00
mstpd
multipath-tools multipath_tools: Cleanup and update to v0.5.0 2016-01-21 16:18:13 +01:00
musl musl: pass the correct syslibdir 2016-03-03 14:46:44 +01:00
mxu11x0 mxu11x0: init at 1.3.11 2016-03-24 20:19:22 +05:00
ndiswrapper
net-tools update net-tools home page 2015-11-18 00:35:28 -05:00
netatop netatop: 0.3 -> 0.7 2016-01-07 16:25:02 +01:00
nfs-utils Merge recent 'staging' into closure-size 2016-02-03 16:57:19 +01:00
nftables nftables: 0.4 -> 0.5 2015-09-17 14:12:38 -07:00
nss_ldap
numactl Replace 'with plaforms; platform' with 'platforms.platform' 2015-11-17 21:30:43 +01:00
numad rename iElectric to domenkozar to match GitHub 2016-05-17 13:00:47 +01:00
nvidia-x11 nvidia-x11: 361.42 -> 361.45.11 2016-05-31 22:23:54 -05:00
nvidiabl Revert "Revert "Merge pull request #9543 from NixOS/staging.post-15.06"" 2015-11-14 12:32:51 -08:00
open-iscsi openiscsi: fix a file that was broken by upstream changing things to dynamic linking 2016-04-30 15:29:49 -03:00
open-isns open-isns: init at 0.95 2016-04-29 14:02:17 +02:00
opengl/xorg-sys xorg-sys-opengl: fix with multiple outputs 2016-04-14 13:43:08 +02:00
openvswitch openvswitch: 2.3.1 -> 2.5.0 (#15729) 2016-05-28 16:02:04 +02:00
otpw
pagemon pagemon: 0.01.07 -> 0.01.08 2016-02-08 21:06:08 +01:00
pam Merge commit staging+systemd into closure-size 2015-10-03 13:33:37 +02:00
pam_ccreds
pam_krb5
pam_ldap
pam_mount pam_mount: fix PATH issue 2015-07-04 16:36:47 +02:00
pam_pgsql pam_pgsql: init at 0.7.3.2 2015-10-19 13:30:28 +03:00
pam_ssh_agent_auth
pam_u2f pam_u2f: 1.0.1 -> 1.0.4 2016-01-29 20:49:29 +02:00
pam_usb
pax-utils pax-utils: https urls 2016-03-11 22:36:22 +01:00
paxctl gradm, paxctl, pax-utils: unmaintain 2015-10-05 11:19:13 +02:00
paxtest paxtest: refactoring 2016-05-24 16:14:41 +02:00
pcmciautils treewide: Replace module_init_tools -> kmod 2016-04-22 10:40:57 +03:00
perf-tools nixpkgs: perf-tools 20150704 -> 20150723 2015-07-24 00:31:45 -05:00
pflask pflask: use waf package 2016-02-10 20:34:28 +01:00
phc-intel More version attribute tidying where maintainers |= nckx 2016-01-25 20:08:34 +01:00
pipework replace makeSearchPath tree-wise to take care of possible multiple outputs 2016-04-13 22:09:41 +03:00
pktgen pktgen: build with the same CFLAGS as dpdk 2016-06-07 20:11:50 -07:00
plymouth
pm-utils makeSearchPathOutputs: refactor to makeSearchPathOutput 2016-04-25 13:24:39 +03:00
pmount
pmtools Bring my stdenv.lib.maintainers user name in line with my github nick. 2016-05-16 22:49:55 +02:00
policycoreutils policycoreutils: fix i686-linux compilation error, closes #9544 2015-08-31 09:39:07 +02:00
pommed pommed: mark as broken, src hash changed 2015-11-14 18:57:51 +01:00
powertop powertop: call "xset" from $PATH 2016-01-31 21:44:36 +01:00
prl-tools "Parallel Tools" -> Parallels Tools 2015-09-15 08:51:02 +02:00
procps Remove cruft 2016-04-26 17:31:54 +02:00
procps-ng procps-ng: 3.3.10 -> 3.3.11 2015-08-18 11:12:34 -07:00
psmisc
psmouse-alps
radeontools
radeontop Add version attribute where maintainers |= nckx 2016-01-25 17:35:21 +01:00
read-edid read-edid: New package at version 3.0.2 2015-06-15 17:49:35 +02:00
regionset regionset: 20030629 -> 0.2 2016-01-13 03:30:56 +01:00
reptyr reptyr: 0.5 -> 0.6.2 2015-08-27 10:11:11 +02:00
rewritefs rewritefs: init at 2016-02-08 2016-03-03 17:37:33 +01:00
rfkill
rtkit
rtl8723bs rtl8723bs: version bump 2016-04-25 00:41:25 -07:00
rtl8812au rtl8812au: mark as broken on grsec kernels 2016-03-27 01:39:07 +01:00
s6-linux-utils update skarnet.org packages 2016-04-01 10:38:58 -05:00
schedtool
sdparm sdparm: 1.09 -> 1.10 2016-04-29 21:42:35 +02:00
sepolgen sepolgen: 1.2.1 -> 1.2.2 2015-07-31 17:11:11 -07:00
setools setools: 3.3.8 -> 2015-02-12 2015-07-31 17:11:11 -07:00
seturgent fix: add missing versions 2015-06-04 23:34:14 +03:00
shadow
sinit
smem
spl spl: 0.6.5.6 -> 0.6.5.7 (#15669) 2016-05-24 16:24:17 +02:00
statifier Replace 'with plaforms; platform' with 'platforms.platform' 2015-11-17 21:30:43 +01:00
syscall_limiter syscall_limiter: init at b02c031 2016-01-05 15:37:17 +00:00
sysdig sysdig: 0.8.0 -> 0.9.0 2016-04-11 21:51:09 +02:00
sysfsutils
sysklogd
syslinux syslinux: fix missing mtools dependency 2015-12-09 03:17:08 +01:00
sysstat treewide: Mass replace 'bzip2}/bin' to refer the 'bin' output 2016-02-01 20:45:57 +02:00
systemd systemd: Disable systemd-boot on ARM 2016-06-02 14:54:44 +03:00
sysvinit
tcp-wrappers tcp_wrappers: Remove separate builder.sh and use standard stdenv phases 2016-05-14 21:05:58 +03:00
thin-provisioning-tools thin-provisioning-tools: init at 0.6.1 2016-02-15 12:57:15 +01:00
tomb tomb: init at version 2.2 2016-04-22 17:07:26 -04:00
tp_smapi tp-smapi: 0.41 -> 0.42 2016-05-24 13:26:47 +02:00
trace-cmd Fix lots of fetchgit hashes (fallout from #15469) 2016-06-03 17:17:08 +03:00
trinity trinity: 1.5 -> 1.6 2015-11-08 20:09:17 +02:00
ttysnoop
tunctl
uclibc uclibc: Provide a more stable location for source. 2015-08-19 18:43:24 +02:00
udev udev182: fix build against linux 4.4 headers 2016-05-16 01:35:57 +02:00
udisks Remove no longer (or never) referenced patches 2016-01-24 02:02:21 +01:00
udisks-glue
uksmtools Fix lots of fetchgit hashes (fallout from #15469) 2016-06-03 17:17:08 +03:00
untie Remove unneeded 'with's from meta.platforms 2015-11-25 23:06:09 +01:00
upower upower: 0.99.3 -> 0.99.4 2016-03-07 02:04:20 +00:00
upstart
usbutils Fix usbutils 2015-05-15 11:10:03 +02:00
usermount Fix lots of fetchgit hashes (fallout from #15469) 2016-06-03 17:17:08 +03:00
util-linux util-linux: use sha256 instead of sha512 again 2016-05-14 22:19:28 +02:00
v4l-utils v4l-utils: multiple outputs 2016-04-25 19:04:24 -05:00
v4l2loopback rename iElectric to domenkozar to match GitHub 2016-05-17 13:00:47 +01:00
v86d
wireless-tools
wpa_supplicant treewide: Make explicit that 'dev' output of libnl is used 2016-05-19 10:00:43 +02:00
wvdial
x86_energy_perf_policy x86_energy_perf_policy: correct meta.homepage 2016-05-08 19:42:49 +02:00
x86info
xf86-input-mtrack refactor to use autoreconfHook where possible 2016-01-18 10:45:31 +01:00
xf86-input-multitouch Fix lots of fetchgit hashes (fallout from #15469) 2016-06-03 17:17:08 +03:00
xf86-input-wacom xf86-input-wacom: 0.31.0 -> 0.32.0 2016-01-01 14:16:32 +01:00
xf86-video-nested Fix lots of fetchgit hashes (fallout from #15469) 2016-06-03 17:17:08 +03:00
xsensors xsensors: init at 0.70 2015-07-03 22:55:10 -04:00
zfs zfs: 0.6.5.6 -> 0.6.5.7 2016-05-24 12:36:08 +02:00