gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

linux/{common-config,hardened-config}: restore DRM_PANIC_SCREEN_QR_CODE, RUST, SCHED_CLASS_EXT

Browse Source 
Had to disable LATENT_ENTROPY and RANDSTRUCT

For more context check https://github.com/NixOS/nixpkgs/issues/365700
This commit is contained in:
Fabián Heredia Montiel
2024-12-25 20:19:00 -06:00
parent bb881a68c1
commit 743b310b32
2 changed files with 3 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/os-specific/linux/kernel/common-config.nix
+3 -3
View File
@@ -533,14 +533,14 @@ let
# Enable Rust and features that depend on it
# Use a lower priority to allow these options to be overridden in hardened/config.nix
rust = lib.optionalAttrs withRust {
RUST = lib.mkDefault yes;
RUST = yes;
# These don't technically require Rust but we probably want to get some more testing
# on the whole DRM panic setup before shipping it by default.
DRM_PANIC = whenAtLeast "6.12" yes;
DRM_PANIC_SCREEN = whenAtLeast "6.12" (freeform "kmsg");
DRM_PANIC_SCREEN_QR_CODE = lib.mkDefault (whenAtLeast "6.12" yes);
DRM_PANIC_SCREEN_QR_CODE = whenAtLeast "6.12" yes;
};
sound =
@@ -1256,7 +1256,7 @@ let
LIRC = yes;
SCHED_CORE = whenAtLeast "5.14" yes;
SCHED_CLASS_EXT = lib.mkDefault (whenAtLeast "6.12" yes);
SCHED_CLASS_EXT = whenAtLeast "6.12" yes;
LRU_GEN = whenAtLeast "6.1" yes;
LRU_GEN_ENABLED = whenAtLeast "6.1" yes;
pkgs/os-specific/linux/kernel/hardened/config.nix
-11
View File
@@ -38,8 +38,6 @@ assert (lib.versionAtLeast version "4.9");
DEBUG_PLIST = whenAtLeast "5.2" yes;
DEBUG_SG = yes;
DEBUG_VIRTUAL = yes;
# Set in common config as whenAtLeast "6.12" yes; Currently errors during config
SCHED_CLASS_EXT = whenAtLeast "6.12" (option yes);
SCHED_STACK_END_CHECK = yes;
REFCOUNT_FULL = whenOlder "5.4.208" yes;
@@ -68,8 +66,6 @@ assert (lib.versionAtLeast version "4.9");
PANIC_TIMEOUT = freeform "-1";
GCC_PLUGINS = yes; # Enable gcc plugin options
# Gather additional entropy at boot time for systems that may not have appropriate entropy sources.
GCC_PLUGIN_LATENT_ENTROPY = yes;
GCC_PLUGIN_STRUCTLEAK = option yes; # A port of the PaX structleak plugin
GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = option yes; # Also cover structs passed by address
@@ -87,10 +83,6 @@ assert (lib.versionAtLeast version "4.9");
UBSAN_LOCAL_BOUNDS = option yes; # clang only
CFI_CLANG = option yes; # clang only Control Flow Integrity since 6.1
# Same as GCC_PLUGIN_RANDSTRUCT*, but has been renamed to `RANDSTRUCT*` in 5.19.
RANDSTRUCT = whenAtLeast "5.19" yes;
RANDSTRUCT_PERFORMANCE = whenAtLeast "5.19" yes;
# Disable various dangerous settings
ACPI_CUSTOM_METHOD = whenOlder "6.9" no; # Allows writing directly to physical memory
PROC_KCORE = no; # Exposes kernel text image layout
@@ -118,7 +110,4 @@ assert (lib.versionAtLeast version "4.9");
# not needed for less than a decade old glibc versions
LEGACY_VSYSCALL_NONE = yes;
RUST = option yes; # Yes currently erros on 6.12
DRM_PANIC_SCREEN_QR_CODE = whenAtLeast "6.12" (option yes);
}