diff --git a/nixos/modules/config/sysctl.nix b/nixos/modules/config/sysctl.nix index 96bd0e961989..1d5a1487bb3d 100644 --- a/nixos/modules/config/sysctl.nix +++ b/nixos/modules/config/sysctl.nix @@ -66,11 +66,32 @@ in config = { - environment.etc."sysctl.d/60-nixos.conf".text = lib.concatStrings ( - lib.mapAttrsToList ( - n: v: lib.optionalString (v != null) "${n}=${if v == false then "0" else toString v}\n" - ) config.boot.kernel.sysctl - ); + environment.etc = { + "sysctl.d/55-nixos-aslr-entropy.conf".source = + pkgs.runCommand "55-nixos-aslr-entropy.conf" + { + inherit (config.boot.kernelPackages.kernel) configfile; + } + '' + mmap_rnd_bits_max=$(grep "^CONFIG_ARCH_MMAP_RND_BITS_MAX=" $configfile | grep --only-matching "[0-9]*$") + if [[ -z "$mmap_rnd_bits_max" ]]; then + echo "Unable to determine mmap_rnd_bits_max. Check your kernel configfile is valid." + exit 1 + fi + mmap_rnd_compat_bits_max=$(grep "^CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=" $configfile | grep --only-matching "[0-9]*$") + if [[ -z "$mmap_rnd_compat_bits_max" ]]; then + echo "Unable to determine mmap_rnd_compat_bits_max. Check your kernel configfile is valid." + exit 1 + fi + echo "vm.mmap_rnd_bits=$mmap_rnd_bits_max" >> $out + echo "vm.mmap_rnd_compat_bits=$mmap_rnd_compat_bits_max" >> $out + ''; + "sysctl.d/60-nixos.conf".text = lib.concatStrings ( + lib.mapAttrsToList ( + n: v: lib.optionalString (v != null) "${n}=${if v == false then "0" else toString v}\n" + ) config.boot.kernel.sysctl + ); + }; systemd.services.systemd-sysctl = { wantedBy = [ "multi-user.target" ]; @@ -92,20 +113,6 @@ in # the value below is used by default on several other distros. "fs.inotify.max_user_instances" = lib.mkDefault 524288; "fs.inotify.max_user_watches" = lib.mkDefault 524288; - - # Maximise address space randomisation. - "vm.mmap_rnd_bits" = lib.mkMerge [ - (lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 ( - # Ideally, we'd want to set this to 33 on 4K pagesize - # kernels, but some vendor kernels e.g. linux_rpi can - # do a maximum of 24. - lib.mkDefault 24 - )) - (lib.mkIf pkgs.stdenv.hostPlatform.isx86_64 (lib.mkDefault 32)) - ]; - "vm.mmap_rnd_compat_bits" = lib.mkIf ( - pkgs.stdenv.hostPlatform.isx86_64 || pkgs.stdenv.hostPlatform.isAarch64 - ) (lib.mkDefault 16); }; }; } diff --git a/nixos/modules/services/ttys/getty.nix b/nixos/modules/services/ttys/getty.nix index f33a4edd2d66..35759716e08b 100644 --- a/nixos/modules/services/ttys/getty.nix +++ b/nixos/modules/services/ttys/getty.nix @@ -13,6 +13,8 @@ let baseArgs = [ "--login-program" "${cfg.loginProgram}" + "--issue-file" + "/etc/issue:/etc/issue.d:/run/issue:/run/issue.d" ] ++ optionals (cfg.autologinUser != null && !cfg.autologinOnce) [ "--autologin" diff --git a/pkgs/by-name/li/libblake3/package.nix b/pkgs/by-name/li/libblake3/package.nix index d2d392071d73..08740597b3a3 100644 --- a/pkgs/by-name/li/libblake3/package.nix +++ b/pkgs/by-name/li/libblake3/package.nix @@ -10,7 +10,7 @@ stdenv.mkDerivation (finalAttrs: { pname = "libblake3"; - version = "1.8.4"; + version = "1.8.5"; outputs = [ "out" @@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: { owner = "BLAKE3-team"; repo = "BLAKE3"; tag = finalAttrs.version; - hash = "sha256-Xz0LH0YpUjDishvXsW6VNK8msFlPXg08wFoSfbgws0g="; + hash = "sha256-4Oany3uk0759YIZgD1gsONSFU1Mn/GAMvsSeP33J9Ts="; }; sourceRoot = finalAttrs.src.name + "/c"; diff --git a/pkgs/by-name/na/nano/package.nix b/pkgs/by-name/na/nano/package.nix index 6d043d70ea06..e4a2d0b1ea96 100644 --- a/pkgs/by-name/na/nano/package.nix +++ b/pkgs/by-name/na/nano/package.nix @@ -31,11 +31,11 @@ let in stdenv.mkDerivation rec { pname = "nano"; - version = "8.7.1"; + version = "9.0"; src = fetchurl { url = "mirror://gnu/nano/${pname}-${version}.tar.xz"; - hash = "sha256-dvDcskjy4vElHU7NIP0w+0AKNgo6N8bDQOClLC0c3t8="; + hash = "sha256-nzhDdLSWEQoltzrVpf67OEeDxuMYizcGP2d6yQgBP94="; }; nativeBuildInputs = [ texinfo ] ++ lib.optional enableNls gettext; diff --git a/pkgs/by-name/st/strace/package.nix b/pkgs/by-name/st/strace/package.nix index 9820ae631ab2..86f8b0fa4c42 100644 --- a/pkgs/by-name/st/strace/package.nix +++ b/pkgs/by-name/st/strace/package.nix @@ -11,11 +11,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "strace"; - version = "6.19"; + version = "7.0"; src = fetchurl { url = "https://strace.io/files/${finalAttrs.version}/strace-${finalAttrs.version}.tar.xz"; - hash = "sha256-4HbIUe7AlySG7IQhZP3FRUf50Xq9PRRJ3osSD10pkUM="; + hash = "sha256-bJJBm+Py7FYLMXKKRlIhfFmGTIZCunsbN3GxsBOtB0s="; }; separateDebugInfo = true; diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix index cab90cffbd0d..a8653f65abb9 100644 --- a/pkgs/by-name/ty/ty/package.nix +++ b/pkgs/by-name/ty/ty/package.nix @@ -14,14 +14,14 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "ty"; - version = "0.0.32"; + version = "0.0.33"; src = fetchFromGitHub { owner = "astral-sh"; repo = "ty"; tag = finalAttrs.version; fetchSubmodules = true; - hash = "sha256-534/xT6JfbgEboH1q4R4JTl2/gLKKs1wU9eqoZf0Asw="; + hash = "sha256-cc/1piasUlv3wwYsXdJaKc8Ck9KF1/FjAjHv6XL6E7o="; }; # For Darwin platforms, remove the integration test for file notifications, @@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: { cargoBuildFlags = [ "--package=ty" ]; - cargoHash = "sha256-uQkrvSmvQXJj+WlGLI+2fHNQeCd1eYJrJJ1z3OZSHbA="; + cargoHash = "sha256-8DaJWHFBoVzpbkd9QmJ72a5NeKuX99lfDq3uUp+wd5I="; nativeBuildInputs = [ installShellFiles ]; diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index 4761cdda962c..b35c04259335 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -866,6 +866,14 @@ let INIT_ON_ALLOC_DEFAULT_ON = yes; + # Randomize kernel stack offset on syscall entry to make stack address dependent + # attacks harder, supported since 5.13. + # Only default enabled on AArch64 from 7.1 due to perf issues prior to that release + # that were resolved in "randomize_kstack: Maintain kstack_offset per task" + RANDOMIZE_KSTACK_OFFSET_DEFAULT = whenAtLeast ( + if stdenv.hostPlatform.isAarch64 then "7.1" else "5.13" + ) yes; + # Enable stack smashing protections in schedule() # See: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v4.8&id=0d9e26329b0c9263d4d9e0422d80a0e73268c52f SCHED_STACK_END_CHECK = yes; @@ -1237,6 +1245,7 @@ let EFI = lib.mkIf stdenv.hostPlatform.isEfi yes; EFI_STUB = yes; # EFI bootloader in the bzImage itself EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER = whenOlder "6.2" yes; # initrd kernel parameter for EFI + PSTORE = yes; EFI_VARS_PSTORE = lib.mkIf (!stdenv.hostPlatform.isLoongArch64) yes; # Generic compression support for EFI payloads diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 2a0c297414e2..37d28a722904 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -5,38 +5,38 @@ "lts": false }, "6.1": { - "version": "6.1.169", - "hash": "sha256:0b7g7awbn1zryrh0pnjsh00d7j7ivda8i380jddhfj8ph1sfdjz0", + "version": "6.1.170", + "hash": "sha256:0i29gilsvl7vx7p6vqg0bc0d40ir1b968hyfjhdfms55g4pr2y5m", "lts": true }, "5.15": { - "version": "5.15.203", - "hash": "sha256:0r6w6glfpzp6qz0kbxzpmabxwgw1y5k9a407lj98gsap5bcfgsqb", + "version": "5.15.204", + "hash": "sha256:1kfvfvzhdgjcj1pa2aqks3iah00ilfpp1i9bmbwjr3na0crlrzcv", "lts": true }, "5.10": { - "version": "5.10.253", - "hash": "sha256:1j2sszv8j9s6qlrvbnyj1qf9aapl0srbps3g4bvf5s2hh29281zc", + "version": "5.10.254", + "hash": "sha256:17c63anhn63n2qki4n92xdr3cij6n3wmfa4sqai87kd1jyjkqivm", "lts": true }, "6.6": { - "version": "6.6.136", - "hash": "sha256:0wglpjmrwdghbdh3rs3qw5kyacrcdw77cqzwwmp7h798k0dd5ckg", + "version": "6.6.137", + "hash": "sha256:1i2npnsnhk41a88vimr521rxg77kljbkqmlyk1zrv7z4ic6ykwcj", "lts": true }, "6.12": { - "version": "6.12.84", - "hash": "sha256:1pajzxxp2jpjzjav4inbz58hm4xdacj10fp899wmalqzgcx4cvnm", + "version": "6.12.85", + "hash": "sha256:1v8a0z6znmr2m26l4744wndaimsh24zz6q4d7m4p8s0ayjcwjnp3", "lts": true }, "6.18": { - "version": "6.18.25", - "hash": "sha256:160qplwzx48rcvh53wz60c7xdnw11sdhfs6fysd2c2s3sh3hls19", + "version": "6.18.26", + "hash": "sha256:1v5h0w3s8p5m22jxg992x1jfpwyi80ia70cdgiv47q3n6xfjyxsk", "lts": true }, "7.0": { - "version": "7.0.2", - "hash": "sha256:0qknrb9539vwh8314nklaj2s7y1djag5b7hbrf6a89s5541ilnak", + "version": "7.0.3", + "hash": "sha256:074zjl0v901a9hafgpcxyyd395qs7y4kr4fcpgg3ssc8ayzsvv8b", "lts": false } } diff --git a/pkgs/tools/package-management/nix/modular/src/libutil-tests/package.nix b/pkgs/tools/package-management/nix/modular/src/libutil-tests/package.nix index 5bd2fd66542e..33880fc37e4f 100644 --- a/pkgs/tools/package-management/nix/modular/src/libutil-tests/package.nix +++ b/pkgs/tools/package-management/nix/modular/src/libutil-tests/package.nix @@ -35,6 +35,10 @@ mkMesonExecutable (finalAttrs: { mesonFlags = [ ]; + excludedTestPatterns = lib.optionals (lib.versions.majorMinor version == "2.34") [ + "fchmodatTryNoFollow.fallbackWithoutProc" + ]; + passthru = { tests = { run = @@ -49,7 +53,8 @@ mkMesonExecutable (finalAttrs: { '' + '' export _NIX_TEST_UNIT_DATA=${resolvePath ./data} - ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage} + ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage} \ + --gtest_filter=-${lib.concatStringsSep ":" finalAttrs.excludedTestPatterns} touch $out '' );