Commit graph

275 commits

Author SHA1 Message Date
Austin Seipp 657998dbcb kernel/common-config: Another optional option
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-05-17 19:44:03 -05:00
Austin Seipp b5b434c98a kernel: make some common-config options optional for grsec
Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-05-17 16:37:22 -05:00
Austin Seipp 4f27ad14a1 grsec: refactor grsecurity packages
This now provides a handful of different grsecurity kernels for slightly
different 'flavors' of packages. This doesn't change the grsecurity
module to use them just yet, however.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-05-17 14:09:43 -05:00
Austin Seipp 92abc4c610 kernel: enable AppArmor by default
AppArmor only requires a few patches to the 3.2 and 3.4 kernels in order
to work properly (with the minor catch grsecurity -stable includes the
3.2 patches.) This adds them to the kernel builds by default, removes
features.apparmor (since it's always true) and makes it the default MAC
system.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-05-17 14:09:09 -05:00
Ricardo M. Correia f0e3775f2e linux: Add support for zram 2014-04-24 23:47:08 +02:00
Eelco Dolstra 4e8c2f0ff9 Merge branch 'systemd-update' 2014-04-20 19:31:01 +02:00
Eelco Dolstra 5da309fcaa linux: Enable SND_DYNAMIC_MINORS
This is necessary if you get:

  kernel: Too many HDMI devices
  kernel: Consider building the kernel with CONFIG_SND_DYNAMIC_MINORS=y
2014-04-18 21:50:00 +02:00
Eelco Dolstra 3f01caa89f linux: Enable transparent hugepages 2014-04-16 22:40:07 +02:00
Austin Seipp acbf28145c nixos: make several kernel common-config options optional
Realistically, common-config is useful, but there are a lot of things in
there that are non-optionally specified that aren't always useful. For
example, when deploying grsecurity, I don't want the bluetooth,
wireless, or input joystick/extra filesystem stack (XFS, etc), nor the
staging drivers tree.

The problem is that if you specify this in your own kernel config in the
grsecurity module, by saying 'BT n' to turn off bluetooth,
common-config turns on 'BT_HCIUART_BCSP y', which then becomes unused
and errors out.

This is really just an arbitrary picking at the moment, but it should be
OK.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-04-11 22:39:29 -05:00
Shea Levy 0c66dbaee6 Enable CC_STACKPROTECTOR_REGULAR on linux 3.14+ 2014-04-02 17:58:54 -04:00
Shea Levy 2d4ce25b5b Add linux 3.14 2014-03-31 20:54:47 -04:00
Shea Levy 3ae5e801a5 Linux 3.13
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-19 22:35:24 -05:00
Eelco Dolstra 8a182718ca splashutils: Remove 2013-09-26 18:03:43 +02:00
aszlig 2e89b40634
Merge pull request #1010 from offlinehacker.
Although this is a release canidate version of kernel 3.12, there are
reasons for merging this anyway, as discussed in #1010 and #1006.

Thanks to @offlinehacker for this and the initial pull request.
2013-09-25 14:05:33 +02:00
Jaka Hudoklin 69f30432dd kernel: add linux 3.12-rc2 2013-09-25 12:49:49 +02:00
Eelco Dolstra 7856ba881a linux: Enable proper blkio controller support
Having BLK_CGROUP is not enough, you need BLK_DEV_THROTTLING or
CFQ_GROUP_IOSCHED to do anything useful.
2013-09-17 16:00:36 +02:00
Mathijs Kwik 27a810346a Revert "linux: really provide /proc/config.gz"
This reverts commit 68ce9e91e1.

/proc/config.gz is available after "modprobe configs"
and in
/run/booted-system/kernel-modules/config
2013-09-04 09:29:00 +02:00
Mathijs Kwik 03c9a1fb33 linux 3.11
works fine for me, but nvidia binary driver fails once again
2013-09-04 09:29:00 +02:00
Bjørn Forsman 68ce9e91e1 linux: really provide /proc/config.gz
Currently there is no /proc/config.gz, even though the configuration
indicates it. This fixes it.
2013-08-16 23:12:07 +02:00
Evgeny Egorochkin 339e1d94c6 Turning off PAE support which makes kernel unbootable on older hardware causes CRASH_DUMP option to
disappear, so make it optional.
2013-08-12 05:32:11 +03:00
Eelco Dolstra f155a35d7d Move kernelExtraConfig to common-config.nix (for x86)
It's bad to have the kernel config scattered across two places.  (This
should also be done for the other architectures.)

Also, restore Xen and KVM guest support in Linux 3.10.
2013-08-01 14:35:31 +02:00
Eelco Dolstra d1de0e2d6d linux: Enable detection of hung tasks 2013-08-01 01:40:41 +02:00
Eelco Dolstra f2f00c56e4 linux: Enable stack protector
This may prevent exploitation of buffer overflows.
2013-08-01 01:40:41 +02:00
Eelco Dolstra bc8186be1e linux: Disable /dev/kmem
See e.g.
  https://wiki.ubuntu.com/Security/Features#A.2BAC8-dev.2BAC8-kmem_disabled
2013-08-01 01:40:40 +02:00
Eelco Dolstra 7ce325f3e0 Unify the Linux kernel configurations
Having N different copies of the NixOS kernel configuration is bad
because these copies tend to diverge.  For instance, our 3.10 config
lacked some modules that were enabled in older configs, probably
because the 3.10 config had been copied off an earlier version of some
older kernel config.

So now there is a single kernel config in common-config.nix.  It has a
few conditionals to deal with new/removed kernel options, but
otherwise it's pretty straightforward.

Also, a lot of cut&paste boilerplate between the kernel Nix
expressions is gone (such as preConfigure).
2013-08-01 01:40:40 +02:00