Commit graph

11285 commits

Author SHA1 Message Date
kraem e7a65e6c41 linux/hardened-patches/5.5.17: remove 2020-04-20 10:05:36 -04:00
kraem eb41f8122e linux/hardened-patches/5.6.4: remove 2020-04-20 10:05:36 -04:00
kraem 8879086cfc linux: 5.5.17 -> 5.5.18 2020-04-20 10:05:36 -04:00
kraem 4307923b86 linux: 5.6.4 -> 5.6.5 2020-04-20 10:05:36 -04:00
Yegor Timoshenko 6f1165a0cb
Merge pull request #84522 from emilazy/add-linux-hardened-patches
linux_*_hardened: use linux-hardened patch set
2020-04-19 20:01:35 +03:00
Peter Simons 00222dbb0e bbswitch: fix build with Linux kernel version >= 5.6.0
Fixes https://github.com/NixOS/nixpkgs/issues/85564.
2020-04-19 16:25:48 +02:00
Vladimír Čunát e233a9d4dd
Merge #84442: staging-next branch 2020-04-18 23:11:00 +02:00
Jan Tojnar 09c4736405
Merge pull request #83755 from jtojnar/jcat-0.1 2020-04-18 20:38:24 +02:00
Mario Rodas e5dd52b99d
Merge pull request #85422 from marsam/update-lxc
lxc: 4.0.1 -> 4.0.2
2020-04-18 13:24:22 -05:00
Jan Tojnar 06e5800a73
fwupd: 1.3.9 → 1.4.0
https://github.com/fwupd/fwupd/releases/tag/1.4.0
2020-04-18 19:51:08 +02:00
Pavol Rusnak fadcfc3ea4
treewide: per RFC45, remove more unquoted URLs 2020-04-18 14:04:37 +02:00
Vladimír Čunát d96487b9ca
Merge branch 'master' into staging-next
Hydra nixpkgs: ?compare=1582510
2020-04-18 07:42:26 +02:00
John Ericson e99a409065
Merge pull request #85190 from Ericson2314/fwupdate
fwupdate: Clean up -I flags
2020-04-17 18:50:22 -04:00
Emily 7fdfe5381d linux_*_hardened: don't set FORTIFY_SOURCE
Upstreamed in anthraxx/linux-hardened@d12c0d5f0c.
2020-04-17 16:13:39 +01:00
Emily ed89b5b3f1 linux_*_hardened: don't set PANIC_ON_OOPS
Upstreamed in anthraxx/linux-hardened@366e0216f1.
2020-04-17 16:13:39 +01:00
Emily 0d5f1697b7 linux_*_hardened: don't set SLAB_FREELIST_{RANDOM,HARDENED}
Upstreamed in anthraxx/linux-hardened@786126f177,
anthraxx/linux-hardened@44822ebeb7.
2020-04-17 16:13:39 +01:00
Emily 4fb796e341 linux_*_hardened: don't set HARDENED_USERCOPY_FALLBACK
Upstreamed in anthraxx/linux-hardened@c1fe7a68e3,
anthraxx/linux-hardened@2c553a2bb1.
2020-04-17 16:13:39 +01:00
Emily 3eeb5240ac linux_*_hardened: don't set DEBUG_LIST
Upstreamed in anthraxx/linux-hardened@6b20124185.
2020-04-17 16:13:39 +01:00
Emily 0611462e33 linux_*_hardened: don't set {,IO_}STRICT_DEVMEM
STRICT_DEVMEM is on by default in upstream 5.6.2; IO_STRICT_DEVMEM is
turned on by anthraxx/linux-hardened@103d23cb66.

Note that anthraxx/linux-hardened@db1d27e10e
disables DEVMEM by default, so this is only relevant if that default is
overridden to turn it back on.
2020-04-17 16:13:39 +01:00
Emily 303bb60fb1 linux_*_hardened: don't set DEBUG_WX
Upstreamed in anthraxx/linux-hardened@55ee7417f3.
2020-04-17 16:13:39 +01:00
Emily 33b94e5a44 linux_*_hardened: don't set BUG_ON_DATA_CORRUPTION
Upstreamed in anthraxx/linux-hardened@3fcd15014c.
2020-04-17 16:13:39 +01:00
Emily db6b327508 linux_*_hardened: don't set LEGACY_VSYSCALL_NONE
Upstreamed in anthraxx/linux-hardened@d300b0fdad.
2020-04-17 16:13:39 +01:00
Emily 130f6812be linux_*_hardened: don't set RANDOMIZE_{BASE,MEMORY}
These are on by default for x86 in upstream linux-5.6.2, and turned on
for arm64 by anthraxx/linux-hardened@90f9670bc3.
2020-04-17 16:13:39 +01:00
Emily 8c68055432 linux_*_hardened: don't set MODIFY_LDT_SYSCALL
Upstreamed in anthraxx/linux-hardened@05644876fa.
2020-04-17 16:13:39 +01:00
Emily 8efe83c22e linux_*_hardened: don't set DEFAULT_MMAP_MIN_ADDR
Upstreamed in anthraxx/linux-hardened@f1fe0a64dd.
2020-04-17 16:13:39 +01:00
Emily 3d4c8ae901 linux_*_hardened: don't set VMAP_STACK
This has been on by default upstream for as long as it's been an option.
2020-04-17 16:13:39 +01:00
Emily 7d5352df31 linux_*_hardened: don't set X86_X32
As far as I can tell, this has never defaulted to on upstream, and our
common kernel configuration doesn't turn it on, so the attack surface
reduction here is somewhat homeopathic.
2020-04-17 16:13:39 +01:00
Emily 0d4f35efd4 linux_*_hardened: use linux-hardened patch set
This is an updated version of the former upstream,
https://github.com/AndroidHardeningArchive/linux-hardened, and provides
a minimal set of additional hardening patches on top of upstream.

The patch already incorporates many of our hardened profile defaults,
and releases are timely (Linux 5.5.15 and 5.6.2 were released on
2020-04-02; linux-hardened patches for them came out on 2020-04-03 and
2020-04-04 respectively).
2020-04-17 16:13:39 +01:00
Emily 3d01e802bd linux: explicitly enable SYSVIPC
The linux-hardened patch set removes this default, probably because of
its original focus on Android kernel hardening.
2020-04-17 16:12:29 +01:00
Tim Steinbach e341107367
linux: 5.4.32 -> 5.4.33 2020-04-17 08:34:01 -04:00
Tim Steinbach d9258d33be
linux: 4.19.115 -> 4.19.116 2020-04-17 08:34:01 -04:00
Vladimír Čunát acb4710214
alsaTools: 1.1.7 -> 1.2.2
Fixes build regression (after alsa update, I assume).
Despite the version number change, the diff is trivial:
https://git.alsa-project.org/?p=alsa-tools.git;a=log;h=refs/tags/v1.2.2
2020-04-17 13:49:20 +02:00
Mario Rodas fc7efb2d49
lxc: 4.0.1 -> 4.0.2 2020-04-16 04:20:00 -05:00
Jan Tojnar 3d8e436917
Merge branch 'master' into staging-next 2020-04-16 10:09:43 +02:00
markuskowa 4289160b17
Merge pull request #85281 from r-ryantm/auto-update/rdma-core
rdma-core: 28.0 -> 29.0
2020-04-15 13:27:20 +02:00
R. RyanTM d6d2b1ee6d rdma-core: 28.0 -> 29.0 2020-04-15 07:31:00 +00:00
Maximilian Bosch 401e07d419
Merge pull request #84551 from gnprice/pr-stripDebugList
treewide: Fix types of stripDebugList attrs (and fix doc)
2020-04-14 15:54:52 +02:00
John Ericson 17f2cf93dc fwupdate: Clean up -I flags 2020-04-13 19:21:23 -04:00
Jan Tojnar a04625379a
Merge branch 'master' into staging-next 2020-04-13 18:50:35 +02:00
Matthew Bauer 156c67858f
Merge pull request #85017 from r-ryantm/auto-update/android-udev-rules
android-udev-rules: 20191103 -> 20200410
2020-04-13 11:11:25 -04:00
Tim Steinbach f6e64feb14
linux: 5.6.3 -> 5.6.4 2020-04-13 08:36:35 -04:00
Tim Steinbach bba4a30f8c
linux: 5.5.16 -> 5.5.17 2020-04-13 08:36:27 -04:00
Tim Steinbach 2b6e16abe0
linux: 5.4.31 -> 5.4.32 2020-04-13 08:36:19 -04:00
Tim Steinbach f47969645b
linux: 4.9.218 -> 4.9.219 2020-04-13 08:36:11 -04:00
Tim Steinbach e06d2a4682
linux: 4.19.114 -> 4.19.115 2020-04-13 08:36:04 -04:00
Tim Steinbach f717bfeedb
linux: 4.14.175 -> 4.14.176 2020-04-13 08:35:56 -04:00
Tim Steinbach 3a8f6159cb
linux: 4.4.218 -> 4.4.219 2020-04-13 08:35:32 -04:00
Maximilian Bosch 89d2967c9e
linuxPackages.bpftrace: 0.9.3 -> 0.9.4
https://github.com/iovisor/bpftrace/releases/tag/v0.9.4
2020-04-13 12:03:37 +02:00
R. RyanTM b1d4fdad19 pam_krb5: 4.8 -> 4.9 2020-04-12 17:43:53 -07:00
R. RyanTM 1c0b645d7b
earlyoom: 1.5 -> 1.6 2020-04-12 09:09:57 +00:00