From 8db1ad7850854beff268deaebaafe4e5867d76dc Mon Sep 17 00:00:00 2001 From: Nick Cao Date: Tue, 2 Aug 2022 15:03:56 +0800 Subject: [PATCH] linux: enable PERSISTENT_KEYRINGS and KEYS_REQUEST_CACHE PERSISTENT_KEYRINGS provides a register of persistent per-UID keyrings, useful for encrypting storage pools in stratis. KEYS_REQUEST_CACHE enable temporary caching of the last request_key() result. --- pkgs/os-specific/linux/kernel/common-config.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index 97bf388d46a6..a1fd6d755277 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -504,6 +504,11 @@ let # Depends on MODULE_SIG and only really helps when you sign your modules # and enforce signatures which we don't do by default. SECURITY_LOCKDOWN_LSM = option no; + + # provides a register of persistent per-UID keyrings, useful for encrypting storage pools in stratis + PERSISTENT_KEYRINGS = yes; + # enable temporary caching of the last request_key() result + KEYS_REQUEST_CACHE = whenAtLeast "5.3" yes; } // optionalAttrs (!stdenv.hostPlatform.isAarch32) { # Detect buffer overflows on the stack