From 51735b224741ecdc9ab2e5bb5b98b034705c4252 Mon Sep 17 00:00:00 2001 From: Alex James Date: Sat, 27 Dec 2025 20:29:23 -0600 Subject: [PATCH 1/2] linux/hardened: replace GCC_PLUGIN_STRUCTLEAK with INIT_STACK_ALL_ZERO Linux 5.9 added a config option (INIT_STACK_ALL_ZERO) to zero initialize stack variables by default with -ftrivial-auto-var-init=zero on supported compilers (GCC 12+ and Clang 15+) [1]. This is similar to the zero initialization done by the GCC structleak plugin, but it also works with Clang. The Kernel Self Protection Project recommends using INIT_STACK_ALL_ZERO over GCC_PLUGIN_STRUCTLEAK_BYREF_ALL on supported kernel versions and toolchains [2]. Kernel 6.16 also dropped support for the GCC structleak plugin, with INIT_STACK_ALL_ZERO being recommended as a replacement [3]. Update the hardened kernel config to use INIT_STACK_ALL_ZERO instead of GCC_PLUGIN_STRUCTLEAK_BYREF_ALL (as kernel 5.10 is the minimum supported version in Nixpkgs). This matches other distros, such as Arch Linux [4] and Fedora [5]. [1]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f0fe00d4972a8cd4b98cc2c29758615e4d51cdfe [2]: https://kspp.github.io/Recommended_Settings [3]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8530ea3c9b9747faba46ed3a59ad103b894f1189 [4]: https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/commit/231862cf72a926e62d5a02efd2b833f368b293b0 [5]: https://src.fedoraproject.org/rpms/kernel/blob/8ca58d5eff5c5c56e54e3ba64ffa887ead00a934/f/kernel-x86_64-fedora.config#_3189 --- pkgs/os-specific/linux/kernel/hardened/config.nix | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix index 85c5fb47191c..df86a9e8e7bc 100644 --- a/pkgs/os-specific/linux/kernel/hardened/config.nix +++ b/pkgs/os-specific/linux/kernel/hardened/config.nix @@ -1,5 +1,5 @@ # Based on recommendations from: -# http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project#Recommended_settings +# https://kspp.github.io/Recommended_Settings # https://wiki.gentoo.org/wiki/Hardened/Hardened_Kernel_Project # # Dangerous features that can be permanently (for the boot session) disabled at @@ -56,6 +56,9 @@ assert (lib.versionAtLeast version "4.9"); # Enable init_on_free by default INIT_ON_FREE_DEFAULT_ON = whenAtLeast "5.3" yes; + # Initialize all stack variables on function entry + INIT_STACK_ALL_ZERO = yes; + # Wipe all caller-used registers on exit from a function ZERO_CALL_USED_REGS = whenAtLeast "5.15" yes; @@ -67,8 +70,6 @@ assert (lib.versionAtLeast version "4.9"); GCC_PLUGINS = yes; # Enable gcc plugin options - GCC_PLUGIN_STRUCTLEAK = option yes; # A port of the PaX structleak plugin - GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = option yes; # Also cover structs passed by address GCC_PLUGIN_STACKLEAK = whenAtLeast "4.20" yes; # A port of the PaX stackleak plugin GCC_PLUGIN_RANDSTRUCT = whenOlder "5.19" yes; # A port of the PaX randstruct plugin GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenOlder "5.19" yes; From 9d114360bff60d977e5d14a27bd0f09313be197b Mon Sep 17 00:00:00 2001 From: Alex James Date: Sat, 27 Dec 2025 21:11:41 -0600 Subject: [PATCH 2/2] linux/hardened: limit SECURITY_WRITABLE_HOOKS to 6.3 and older kernels Linux 6.4 dropped support for disabling SELinux at runtime [1]. The SECURITY_WRITABLE_HOOKS config option was removed in this patch. Update the hardened config to only disable this option on supported kernel versions (6.3 and older). [1]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f22f9aaf6c3d92ebd5ad9e67acc03afebaaeb289 --- pkgs/os-specific/linux/kernel/hardened/config.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix index df86a9e8e7bc..beebef90db38 100644 --- a/pkgs/os-specific/linux/kernel/hardened/config.nix +++ b/pkgs/os-specific/linux/kernel/hardened/config.nix @@ -29,7 +29,7 @@ assert (lib.versionAtLeast version "4.9"); # We set SECURITY_WRITABLE_HOOKS n primarily for documentation purposes; the # config builder fails to detect that it has indeed been unset. SECURITY_SELINUX_DISABLE = whenOlder "6.4" no; # On 6.4: error: unused option: SECURITY_SELINUX_DISABLE - SECURITY_WRITABLE_HOOKS = option no; + SECURITY_WRITABLE_HOOKS = whenOlder "6.4" no; # Perform additional validation of commonly targeted structures. DEBUG_CREDENTIALS = whenOlder "6.6" yes;