From dd666b86ad8921528d8dbb05ea2cae20d2b04bfb Mon Sep 17 00:00:00 2001 From: Andrew Marshall Date: Mon, 1 Apr 2024 11:37:34 -0400 Subject: [PATCH] linux: enable STRICT_KERNEL_RWX & STRICT_MODULE_RWX MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Enabled in [Arch][1], [Debian][2], [Fedora][3]. Recommended by [Kernel Self Protection Project][4]. As it is now in common-config, remove from hardened’s extra config. [1]: https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/blob/6392fb2bed1453e2f02e21e0bf3d07dfc713e79f/config#L914-917 [2]: https://salsa.debian.org/kernel-team/linux/-/blob/5f6aa5cb48d261cef1f31ec18f969c986fd3bd77/debian/config/config#L11-12 [3]: https://src.fedoraproject.org/rpms/kernel/blob/e8025dc0fba7e18c74f529a93d653c71d16e5a56/f/kernel-x86_64-fedora.config#_7449 [4]: https://kernsec.org/wiki/index.php?title=Kernel_Self_Protection_Project/Recommended_Settings&oldid=4078 --- pkgs/os-specific/linux/kernel/common-config.nix | 2 ++ pkgs/os-specific/linux/kernel/hardened/config.nix | 2 -- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index 831f55d5982f..80bbdc2a23b1 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -674,6 +674,8 @@ let HARDENED_USERCOPY = yes; RANDOMIZE_BASE = option yes; + STRICT_KERNEL_RWX = yes; + STRICT_MODULE_RWX = yes; STRICT_DEVMEM = mkDefault yes; # Filter access to /dev/mem IO_STRICT_DEVMEM = mkDefault yes; SECURITY_SELINUX_BOOTPARAM_VALUE = whenOlder "5.1" (freeform "0"); # Disable SELinux by default diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix index 77cf87001c6b..08bfd74c61a1 100644 --- a/pkgs/os-specific/linux/kernel/hardened/config.nix +++ b/pkgs/os-specific/linux/kernel/hardened/config.nix @@ -31,8 +31,6 @@ assert (versionAtLeast version "4.9"); SECURITY_SELINUX_DISABLE = whenOlder "6.4" no; # On 6.4: error: unused option: SECURITY_SELINUX_DISABLE SECURITY_WRITABLE_HOOKS = option no; - STRICT_KERNEL_RWX = yes; - # Perform additional validation of commonly targeted structures. DEBUG_CREDENTIALS = whenOlder "6.6" yes; DEBUG_NOTIFIERS = yes;