linux: convert hardened-config to a structured one

This commit is contained in:
Matthieu Coudron 2018-10-03 18:53:23 +09:00
parent 3bb7b3f02e
commit 7aacbdb898
5 changed files with 83 additions and 111 deletions

View file

@ -32,7 +32,6 @@ let
modules = callLibs ./modules.nix; modules = callLibs ./modules.nix;
options = callLibs ./options.nix; options = callLibs ./options.nix;
types = callLibs ./types.nix; types = callLibs ./types.nix;
kernel = callLibs ./kernel.nix;
# constants # constants
licenses = callLibs ./licenses.nix; licenses = callLibs ./licenses.nix;

View file

@ -1,7 +1,12 @@
{ lib }: { lib, version }:
with lib; with lib;
rec { rec {
# Common patterns/legacy
whenAtLeast = ver: mkIf (versionAtLeast version ver);
whenOlder = ver: mkIf (versionOlder version ver);
# range is (inclusive, exclusive)
whenBetween = verLow: verHigh: mkIf (versionAtLeast version verLow && versionOlder version verHigh);
# Keeping these around in case we decide to change this horrible implementation :) # Keeping these around in case we decide to change this horrible implementation :)

View file

@ -17,14 +17,9 @@
with stdenv.lib; with stdenv.lib;
with import ../../../../lib/kernel.nix { inherit (stdenv) lib; }; with import ../../../../lib/kernel.nix { inherit (stdenv) lib; inherit version; };
let let
# Common patterns/legacy
when = cond: opt: if cond then opt else null;
whenAtLeast = ver: mkIf (versionAtLeast version ver);
whenOlder = ver: mkIf (versionOlder version ver);
whenBetween = verLow: verHigh: mkIf (versionAtLeast version verLow && versionOlder version verHigh);
# configuration items have to be part of a subattrs # configuration items have to be part of a subattrs
flattenKConf = nested: mapAttrs (_: head) (zipAttrs (attrValues nested)); flattenKConf = nested: mapAttrs (_: head) (zipAttrs (attrValues nested));
@ -420,7 +415,7 @@ let
KVM_COMPAT = { optional = true; tristate = whenBetween "4.0" "4.12" "y"; }; KVM_COMPAT = { optional = true; tristate = whenBetween "4.0" "4.12" "y"; };
KVM_DEVICE_ASSIGNMENT = { optional = true; tristate = whenBetween "3.10" "4.12" "y"; }; KVM_DEVICE_ASSIGNMENT = { optional = true; tristate = whenBetween "3.10" "4.12" "y"; };
KVM_GENERIC_DIRTYLOG_READ_PROTECT = whenAtLeast "4.0" yes; KVM_GENERIC_DIRTYLOG_READ_PROTECT = whenAtLeast "4.0" yes;
KVM_GUEST = when (!features.grsecurity) yes; KVM_GUEST = mkIf (!features.grsecurity) yes;
KVM_MMIO = yes; KVM_MMIO = yes;
KVM_VFIO = yes; KVM_VFIO = yes;
KSM = yes; KSM = yes;

View file

@ -11,138 +11,110 @@
{ stdenv, version }: { stdenv, version }:
with stdenv.lib; with stdenv.lib;
with import ../../../../lib/kernel.nix { inherit (stdenv) lib; inherit version; };
assert (versionAtLeast version "4.9"); assert (versionAtLeast version "4.9");
'' optionalAttrs (stdenv.hostPlatform.platform.kernelArch == "x86_64") {
# Report BUG() conditions and kill the offending process. DEFAULT_MMAP_MIN_ADDR = freeform "65536"; # Prevent allocation of first 64K of memory
BUG y
${optionalString (versionAtLeast version "4.10") ''
BUG_ON_DATA_CORRUPTION y
''}
${optionalString (stdenv.hostPlatform.platform.kernelArch == "x86_64") ''
DEFAULT_MMAP_MIN_ADDR 65536 # Prevent allocation of first 64K of memory
# Reduce attack surface by disabling various emulations # Reduce attack surface by disabling various emulations
IA32_EMULATION n IA32_EMULATION = no;
X86_X32 n X86_X32 = no;
# Note: this config depends on EXPERT y and so will not take effect, hence # Note: this config depends on EXPERT y and so will not take effect, hence
# it is left "optional" for now. # it is left "optional" for now.
MODIFY_LDT_SYSCALL? n MODIFY_LDT_SYSCALL = option no;
VMAP_STACK = yes; # Catch kernel stack overflows
VMAP_STACK y # Catch kernel stack overflows
# Randomize position of kernel and memory. # Randomize position of kernel and memory.
RANDOMIZE_BASE y RANDOMIZE_BASE = yes;
RANDOMIZE_MEMORY y RANDOMIZE_MEMORY = yes;
# Disable legacy virtual syscalls by default (modern glibc use vDSO instead). # Disable legacy virtual syscalls by default (modern glibc use vDSO instead).
# #
# Note that the vanilla default is to *emulate* the legacy vsyscall mechanism, # Note that the vanilla default is to *emulate* the legacy vsyscall mechanism,
# which is supposed to be safer than the native variant (wrt. ret2libc), so # which is supposed to be safer than the native variant (wrt. ret2libc), so
# disabling it mainly helps reduce surface. # disabling it mainly helps reduce surface.
LEGACY_VSYSCALL_NONE y LEGACY_VSYSCALL_NONE = yes;
''} } // {
# Report BUG() conditions and kill the offending process.
BUG = yes;
# Safer page access permissions (wrt. code injection). Default on >=4.11. BUG_ON_DATA_CORRUPTION = whenAtLeast "4.10" yes;
${optionalString (versionOlder version "4.11") ''
DEBUG_RODATA y
DEBUG_SET_MODULE_RONX y
''}
# Mark LSM hooks read-only after init. SECURITY_WRITABLE_HOOKS n # Safer page access permissions (wrt. code injection). Default on >=4.11.
# conflicts with SECURITY_SELINUX_DISABLE y; disabling the latter DEBUG_RODATA = whenOlder "4.11" yes;
# implicitly marks LSM hooks read-only after init. DEBUG_SET_MODULE_RONX = whenOlder "4.11" yes;
#
# SELinux can only be disabled at boot via selinux=0
#
# We set SECURITY_WRITABLE_HOOKS n primarily for documentation purposes; the
# config builder fails to detect that it has indeed been unset.
${optionalString (versionAtLeast version "4.12") ''
SECURITY_SELINUX_DISABLE n
SECURITY_WRITABLE_HOOKS? n
''}
DEBUG_WX y # boot-time warning on RWX mappings # Mark LSM hooks read-only after init. SECURITY_WRITABLE_HOOKS n
${optionalString (versionAtLeast version "4.11") '' # conflicts with SECURITY_SELINUX_DISABLE y; disabling the latter
STRICT_KERNEL_RWX y # implicitly marks LSM hooks read-only after init.
''} #
# SELinux can only be disabled at boot via selinux=0
#
# We set SECURITY_WRITABLE_HOOKS n primarily for documentation purposes; the
# config builder fails to detect that it has indeed been unset.
SECURITY_SELINUX_DISABLE = whenAtLeast "4.12" no;
SECURITY_WRITABLE_HOOKS = whenAtLeast "4.12" (option no);
# Stricter /dev/mem DEBUG_WX = yes; # boot-time warning on RWX mappings
STRICT_DEVMEM? y STRICT_KERNEL_RWX = whenAtLeast "4.11" yes;
IO_STRICT_DEVMEM? y
# Perform additional validation of commonly targeted structures. # Stricter /dev/mem
DEBUG_CREDENTIALS y STRICT_DEVMEM = option yes;
DEBUG_NOTIFIERS y IO_STRICT_DEVMEM = option yes;
DEBUG_LIST y
DEBUG_PI_LIST y # doesn't BUG()
DEBUG_SG y
SCHED_STACK_END_CHECK y
${optionalString (versionAtLeast version "4.13") '' # Perform additional validation of commonly targeted structures.
REFCOUNT_FULL y DEBUG_CREDENTIALS = yes;
''} DEBUG_NOTIFIERS = yes;
DEBUG_LIST = yes;
DEBUG_PI_LIST = yes; # doesn't BUG()
DEBUG_SG = yes;
SCHED_STACK_END_CHECK = yes;
# Perform usercopy bounds checking. REFCOUNT_FULL = whenAtLeast "4.13" yes;
HARDENED_USERCOPY y
${optionalString (versionAtLeast version "4.16") ''
HARDENED_USERCOPY_FALLBACK n # for full whitelist enforcement
''}
# Randomize allocator freelists. # Perform usercopy bounds checking.
SLAB_FREELIST_RANDOM y HARDENED_USERCOPY = yes;
HARDENED_USERCOPY_FALLBACK = whenAtLeast "4.16" no; # for full whitelist enforcement
${optionalString (versionAtLeast version "4.14") '' # Randomize allocator freelists.
SLAB_FREELIST_HARDENED y SLAB_FREELIST_RANDOM = yes;
''}
# Allow enabling slub/slab free poisoning with slub_debug=P SLAB_FREELIST_HARDENED = whenAtLeast "4.14" yes;
SLUB_DEBUG y
# Wipe higher-level memory allocations on free() with page_poison=1 # Allow enabling slub/slab free poisoning with slub_debug=P
PAGE_POISONING y SLUB_DEBUG = yes;
PAGE_POISONING_NO_SANITY y
PAGE_POISONING_ZERO y
# Reboot devices immediately if kernel experiences an Oops. # Wipe higher-level memory allocations on free() with page_poison=1
PANIC_ON_OOPS y PAGE_POISONING = yes;
PANIC_TIMEOUT -1 PAGE_POISONING_NO_SANITY = yes;
PAGE_POISONING_ZERO = yes;
GCC_PLUGINS y # Enable gcc plugin options # Reboot devices immediately if kernel experiences an Oops.
# Gather additional entropy at boot time for systems that may not have appropriate entropy sources. PANIC_ON_OOPS = yes;
GCC_PLUGIN_LATENT_ENTROPY y PANIC_TIMEOUT = freeform "-1";
${optionalString (versionAtLeast version "4.11") '' GCC_PLUGINS = yes; # Enable gcc plugin options
GCC_PLUGIN_STRUCTLEAK y # A port of the PaX structleak plugin # Gather additional entropy at boot time for systems that may = no;ot have appropriate entropy sources.
''} GCC_PLUGIN_LATENT_ENTROPY = yes;
${optionalString (versionAtLeast version "4.14") ''
GCC_PLUGIN_STRUCTLEAK_BYREF_ALL y # Also cover structs passed by address
''}
${optionalString (versionAtLeast version "4.20") ''
GCC_PLUGIN_STACKLEAK y # A port of the PaX stackleak plugin
''}
${optionalString (versionAtLeast version "4.13") '' GCC_PLUGIN_STRUCTLEAK = whenAtLeast "4.11" yes; # A port of the PaX structleak plugin
GCC_PLUGIN_RANDSTRUCT y # A port of the PaX randstruct plugin GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = whenAtLeast "4.14" yes; # Also cover structs passed by address
GCC_PLUGIN_RANDSTRUCT_PERFORMANCE y GCC_PLUGIN_STACKLEAK = whenAtLeast "4.20" yes; # A port of the PaX stackleak plugin
''} GCC_PLUGIN_RANDSTRUCT = whenAtLeast "4.13" yes; # A port of the PaX randstruct plugin
GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenAtLeast "4.13" yes;
# Disable various dangerous settings # Disable various dangerous settings
ACPI_CUSTOM_METHOD n # Allows writing directly to physical memory ACPI_CUSTOM_METHOD = no; # Allows writing directly to physical memory
PROC_KCORE n # Exposes kernel text image layout PROC_KCORE = no; # Exposes kernel text image layout
INET_DIAG n # Has been used for heap based attacks in the past INET_DIAG = no; # Has been used for heap based attacks in the past
# Use -fstack-protector-strong (gcc 4.9+) for best stack canary coverage. # Use -fstack-protector-strong (gcc 4.9+) for best stack canary coverage.
${optionalString (versionOlder version "4.18") '' CC_STACKPROTECTOR_REGULAR = whenOlder "4.18" no;
CC_STACKPROTECTOR_REGULAR n CC_STACKPROTECTOR_STRONG = whenOlder "4.18" yes;
CC_STACKPROTECTOR_STRONG y
''}
# Enable compile/run-time buffer overflow detection ala glibc's _FORTIFY_SOURCE # Enable compile/run-time buffer overflow detection ala glibc's _FORTIFY_SOURCE
${optionalString (versionAtLeast version "4.13") '' FORTIFY_SOURCE = whenAtLeast "4.13" yes;
FORTIFY_SOURCE y
''} }
''

View file

@ -14757,6 +14757,7 @@ in
hardenedLinuxPackagesFor = kernel: linuxPackagesFor (kernel.override { hardenedLinuxPackagesFor = kernel: linuxPackagesFor (kernel.override {
features.ia32Emulation = false; features.ia32Emulation = false;
extraConfig = import ../os-specific/linux/kernel/hardened-config.nix { extraConfig = import ../os-specific/linux/kernel/hardened-config.nix {
structuredExtraConfig = import ../os-specific/linux/kernel/hardened-config.nix {
inherit stdenv; inherit stdenv;
inherit (kernel) version; inherit (kernel) version;
}; };