From c789f642f02d8bab42bca6c1bf920e2d916389c7 Mon Sep 17 00:00:00 2001 From: Pierre Bourdon Date: Fri, 4 Jan 2019 02:07:17 +0100 Subject: [PATCH 1/3] kernel/generic.nix: provide required dependencies for GCC plugins builds --- pkgs/os-specific/linux/kernel/generic.nix | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix index e424dff596d..3f6479c572b 100644 --- a/pkgs/os-specific/linux/kernel/generic.nix +++ b/pkgs/os-specific/linux/kernel/generic.nix @@ -4,6 +4,9 @@ , perl , bison ? null , flex ? null +, gmp ? null +, libmpc ? null +, mpfr ? null , stdenv , # The kernel source tarball. @@ -89,7 +92,7 @@ let passAsFile = [ "kernelConfig" ]; depsBuildBuild = [ buildPackages.stdenv.cc ]; - nativeBuildInputs = [ perl ] + nativeBuildInputs = [ perl gmp libmpc mpfr ] ++ lib.optionals (stdenv.lib.versionAtLeast version "4.16") [ bison flex ]; platformName = stdenv.hostPlatform.platform.name; @@ -112,7 +115,10 @@ let export buildRoot="''${buildRoot:-build}" # Get a basic config file for later refinement with $generateConfig. - make HOSTCC=${buildPackages.stdenv.cc.targetPrefix}gcc -C . O="$buildRoot" $kernelBaseConfig ARCH=$kernelArch + make -C . O="$buildRoot" $kernelBaseConfig \ + ARCH=$kernelArch \ + HOSTCC=${buildPackages.stdenv.cc.targetPrefix}gcc \ + HOSTCXX=${buildPackages.stdenv.cc.targetPrefix}g++ # Create the config file. echo "generating kernel configuration..." From 9dc0d948965ecfa8bae20de5699f7d32cc6707a6 Mon Sep 17 00:00:00 2001 From: Pierre Bourdon Date: Fri, 4 Jan 2019 02:07:53 +0100 Subject: [PATCH 2/3] kernel/hardened-config.nix: re-enable GCC plugins --- .../linux/kernel/hardened-config.nix | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/hardened-config.nix b/pkgs/os-specific/linux/kernel/hardened-config.nix index 84d1dd8a378..2454ecd0b05 100644 --- a/pkgs/os-specific/linux/kernel/hardened-config.nix +++ b/pkgs/os-specific/linux/kernel/hardened-config.nix @@ -103,17 +103,15 @@ PAGE_POISONING_ZERO y PANIC_ON_OOPS y PANIC_TIMEOUT -1 -${optionalString (versionOlder version "4.18") '' - GCC_PLUGINS y # Enable gcc plugin options - # Gather additional entropy at boot time for systems that may not have appropriate entropy sources. - GCC_PLUGIN_LATENT_ENTROPY y +GCC_PLUGINS y # Enable gcc plugin options +# Gather additional entropy at boot time for systems that may not have appropriate entropy sources. +GCC_PLUGIN_LATENT_ENTROPY y - ${optionalString (versionAtLeast version "4.11") '' - GCC_PLUGIN_STRUCTLEAK y # A port of the PaX structleak plugin - ''} - ${optionalString (versionAtLeast version "4.14") '' - GCC_PLUGIN_STRUCTLEAK_BYREF_ALL y # Also cover structs passed by address - ''} +${optionalString (versionAtLeast version "4.11") '' + GCC_PLUGIN_STRUCTLEAK y # A port of the PaX structleak plugin +''} +${optionalString (versionAtLeast version "4.14") '' + GCC_PLUGIN_STRUCTLEAK_BYREF_ALL y # Also cover structs passed by address ''} # Disable various dangerous settings From 0f7ca26a48389bf9133573f5eaf2d7b30cf51625 Mon Sep 17 00:00:00 2001 From: Pierre Bourdon Date: Fri, 4 Jan 2019 02:08:49 +0100 Subject: [PATCH 3/3] kernel/hardened-config.nix: add STACKLEAK plugin on 4.20+ --- pkgs/os-specific/linux/kernel/hardened-config.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/os-specific/linux/kernel/hardened-config.nix b/pkgs/os-specific/linux/kernel/hardened-config.nix index 2454ecd0b05..9d28b3edf85 100644 --- a/pkgs/os-specific/linux/kernel/hardened-config.nix +++ b/pkgs/os-specific/linux/kernel/hardened-config.nix @@ -113,6 +113,9 @@ ${optionalString (versionAtLeast version "4.11") '' ${optionalString (versionAtLeast version "4.14") '' GCC_PLUGIN_STRUCTLEAK_BYREF_ALL y # Also cover structs passed by address ''} +${optionalString (versionAtLeast version "4.20") '' + GCC_PLUGIN_STACKLEAK y # A port of the PaX stackleak plugin +''} # Disable various dangerous settings ACPI_CUSTOM_METHOD n # Allows writing directly to physical memory