From 7c49efdd2a6b4f4860ccc67cfdca16f0d525b868 Mon Sep 17 00:00:00 2001 From: Andrew Marshall Date: Sat, 27 Aug 2022 11:40:23 -0400 Subject: [PATCH] linux: Enable HARDENED_USERCOPY Enabled in [Arch][1], [Debian][2], [Fedora][3]. Recommended by [Kernel Self Protection Project][4]. Originally [reported to have no noticeable performance impact][5]. [1]: https://github.com/archlinux/svntogit-packages/blob/66d72ee54afc604391b618fc3eecc43f29e479e8/trunk/config#L10252 [2]: https://salsa.debian.org/kernel-team/linux/-/blob/07731f5956cf29876a7abc13f4ecbdf4d9459592/debian/config/config#L7710 [3]: https://src.fedoraproject.org/rpms/kernel/blob/6d6ad72f0ccfe72146f2876f90fe609548caa349/f/kernel-x86_64-fedora.config#_2202 [4]: https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings [5]: https://lwn.net/Articles/695991/ --- pkgs/os-specific/linux/kernel/common-config.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index 97bf388d46a6..3a71563593ef 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -481,6 +481,7 @@ let DEBUG_LIST = yes; # Detect writes to read-only module pages DEBUG_SET_MODULE_RONX = whenOlder "4.11" (option yes); + HARDENED_USERCOPY = yes; RANDOMIZE_BASE = option yes; STRICT_DEVMEM = mkDefault yes; # Filter access to /dev/mem IO_STRICT_DEVMEM = mkDefault yes;