From 743b310b329063653805cf2191f27bb2feb792c8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabi=C3=A1n=20Heredia=20Montiel?= Date: Wed, 25 Dec 2024 20:19:00 -0600 Subject: [PATCH] linux/{common-config,hardened-config}: restore DRM_PANIC_SCREEN_QR_CODE, RUST, SCHED_CLASS_EXT Had to disable LATENT_ENTROPY and RANDSTRUCT For more context check https://github.com/NixOS/nixpkgs/issues/365700 --- pkgs/os-specific/linux/kernel/common-config.nix | 6 +++--- pkgs/os-specific/linux/kernel/hardened/config.nix | 11 ----------- 2 files changed, 3 insertions(+), 14 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index 08b8456bf6e6..96b1e0afb324 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -533,14 +533,14 @@ let # Enable Rust and features that depend on it # Use a lower priority to allow these options to be overridden in hardened/config.nix rust = lib.optionalAttrs withRust { - RUST = lib.mkDefault yes; + RUST = yes; # These don't technically require Rust but we probably want to get some more testing # on the whole DRM panic setup before shipping it by default. DRM_PANIC = whenAtLeast "6.12" yes; DRM_PANIC_SCREEN = whenAtLeast "6.12" (freeform "kmsg"); - DRM_PANIC_SCREEN_QR_CODE = lib.mkDefault (whenAtLeast "6.12" yes); + DRM_PANIC_SCREEN_QR_CODE = whenAtLeast "6.12" yes; }; sound = @@ -1256,7 +1256,7 @@ let LIRC = yes; SCHED_CORE = whenAtLeast "5.14" yes; - SCHED_CLASS_EXT = lib.mkDefault (whenAtLeast "6.12" yes); + SCHED_CLASS_EXT = whenAtLeast "6.12" yes; LRU_GEN = whenAtLeast "6.1" yes; LRU_GEN_ENABLED = whenAtLeast "6.1" yes; diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix index f098cf375c9d..e04b6d878993 100644 --- a/pkgs/os-specific/linux/kernel/hardened/config.nix +++ b/pkgs/os-specific/linux/kernel/hardened/config.nix @@ -38,8 +38,6 @@ assert (lib.versionAtLeast version "4.9"); DEBUG_PLIST = whenAtLeast "5.2" yes; DEBUG_SG = yes; DEBUG_VIRTUAL = yes; - # Set in common config as whenAtLeast "6.12" yes; Currently errors during config - SCHED_CLASS_EXT = whenAtLeast "6.12" (option yes); SCHED_STACK_END_CHECK = yes; REFCOUNT_FULL = whenOlder "5.4.208" yes; @@ -68,8 +66,6 @@ assert (lib.versionAtLeast version "4.9"); PANIC_TIMEOUT = freeform "-1"; GCC_PLUGINS = yes; # Enable gcc plugin options - # Gather additional entropy at boot time for systems that may not have appropriate entropy sources. - GCC_PLUGIN_LATENT_ENTROPY = yes; GCC_PLUGIN_STRUCTLEAK = option yes; # A port of the PaX structleak plugin GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = option yes; # Also cover structs passed by address @@ -87,10 +83,6 @@ assert (lib.versionAtLeast version "4.9"); UBSAN_LOCAL_BOUNDS = option yes; # clang only CFI_CLANG = option yes; # clang only Control Flow Integrity since 6.1 - # Same as GCC_PLUGIN_RANDSTRUCT*, but has been renamed to `RANDSTRUCT*` in 5.19. - RANDSTRUCT = whenAtLeast "5.19" yes; - RANDSTRUCT_PERFORMANCE = whenAtLeast "5.19" yes; - # Disable various dangerous settings ACPI_CUSTOM_METHOD = whenOlder "6.9" no; # Allows writing directly to physical memory PROC_KCORE = no; # Exposes kernel text image layout @@ -118,7 +110,4 @@ assert (lib.versionAtLeast version "4.9"); # not needed for less than a decade old glibc versions LEGACY_VSYSCALL_NONE = yes; - - RUST = option yes; # Yes currently erros on 6.12 - DRM_PANIC_SCREEN_QR_CODE = whenAtLeast "6.12" (option yes); }