gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

linux/common-config: enable fs-verity and IPE LSM (#476974)

Browse Source
This commit is contained in:
Maximilian Bosch
2026-01-06 13:56:30 +00:00
committed by GitHub
parent c11d106f15 15ac0a5b9b
commit 403885759f
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/os-specific/linux/kernel/common-config.nix
+8
View File
@@ -684,6 +684,8 @@ let
TMPFS = yes;
TMPFS_POSIX_ACL = yes;
FS_ENCRYPTION = yes;
FS_VERITY = yes;
FS_VERITY_BUILTIN_SIGNATURES = yes;
EXT2_FS_XATTR = yes;
EXT2_FS_POSIX_ACL = yes;
@@ -796,6 +798,12 @@ let
# This does not have any effect if a program does not support it
SECURITY_LANDLOCK = whenAtLeast "5.13" yes;
# IPE (Integrity Policy Enforcement) - LSM that can enforce file integrity based on
# fs-verity measurements or dm-verity. Useful for verified boot and immutable /nix/store.
SECURITY_IPE = whenAtLeast "6.12" yes;
IPE_PROP_FS_VERITY = whenAtLeast "6.12" yes;
IPE_PROP_FS_VERITY_BUILTIN_SIG = whenAtLeast "6.12" yes;
DEVKMEM = lib.mkIf (!stdenv.hostPlatform.isAarch64) (whenOlder "5.13" no); # Disable /dev/kmem
USER_NS = yes; # Support for user namespaces