From f2f6a3228a02b31b3ca554e3ffcbd106c03f4eae Mon Sep 17 00:00:00 2001 From: Andrew Marshall Date: Mon, 1 Apr 2024 11:37:34 -0400 Subject: [PATCH] linux: enable BUG_ON_DATA_CORRUPTION Enabled in [Debian][1], [Fedora][2]; not in Arch. Recommended by [Kernel Self Protection Project][3]. [2]: https://salsa.debian.org/kernel-team/linux/-/blob/5f6aa5cb48d261cef1f31ec18f969c986fd3bd77/debian/config/config#L7719 [3]: https://src.fedoraproject.org/rpms/kernel/blob/e8025dc0fba7e18c74f529a93d653c71d16e5a56/f/kernel-x86_64-fedora.config#_789 [4]: https://kernsec.org/wiki/index.php?title=Kernel_Self_Protection_Project/Recommended_Settings&oldid=4078 --- pkgs/os-specific/linux/kernel/common-config.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index fd6313c52297..9f87ba187f73 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -669,6 +669,7 @@ let security = { # Report BUG() conditions and kill the offending process. BUG = yes; + BUG_ON_DATA_CORRUPTION = yes; FORTIFY_SOURCE = option yes;