linuxPackages_{,_latest,_testing}_hardened: enable 32-bit emulation
Per discussion in #81943. Resolves #79798.
This commit is contained in:
parent
82b54d4906
commit
b628400f5e
|
@ -18,8 +18,7 @@ assert (versionAtLeast version "4.9");
|
||||||
optionalAttrs (stdenv.hostPlatform.platform.kernelArch == "x86_64") {
|
optionalAttrs (stdenv.hostPlatform.platform.kernelArch == "x86_64") {
|
||||||
DEFAULT_MMAP_MIN_ADDR = freeform "65536"; # Prevent allocation of first 64K of memory
|
DEFAULT_MMAP_MIN_ADDR = freeform "65536"; # Prevent allocation of first 64K of memory
|
||||||
|
|
||||||
# Reduce attack surface by disabling various emulations
|
# Reduce attack surface by disabling X32
|
||||||
IA32_EMULATION = no;
|
|
||||||
X86_X32 = no;
|
X86_X32 = no;
|
||||||
# Note: this config depends on EXPERT y and so will not take effect, hence
|
# Note: this config depends on EXPERT y and so will not take effect, hence
|
||||||
# it is left "optional" for now.
|
# it is left "optional" for now.
|
||||||
|
|
|
@ -16828,7 +16828,6 @@ in
|
||||||
|
|
||||||
# Hardened linux
|
# Hardened linux
|
||||||
hardenedLinuxPackagesFor = kernel: linuxPackagesFor (kernel.override {
|
hardenedLinuxPackagesFor = kernel: linuxPackagesFor (kernel.override {
|
||||||
features.ia32Emulation = false;
|
|
||||||
structuredExtraConfig = import ../os-specific/linux/kernel/hardened-config.nix {
|
structuredExtraConfig = import ../os-specific/linux/kernel/hardened-config.nix {
|
||||||
inherit stdenv;
|
inherit stdenv;
|
||||||
inherit (kernel) version;
|
inherit (kernel) version;
|
||||||
|
|
Loading…
Reference in a new issue