alioth/nixpkgs
3
0
Fork 0
forked from mirrors/nixpkgs
Code Releases Activity

grsecurity: Fix GRKERNSEC_PROC restrictions

Browse source 
Previously we were setting GRKERNSEC_PROC_USER y, which was a little bit
too strict. It doesn't allow a special group (e.g. the grsecurity group
users) to access /proc information - this requires
GRKERNSEC_PROC_USERGROUP y, and the two are mutually exclusive.

This was also not in line with the default automatic grsecurity
configuration - it actually defaults to USERGROUP (although it has a
default GID of 1001 instead of ours), not USER.

This introduces a new option restrictProcWithGroup - enabled by default
- which turns on GRKERNSEC_PROC_USERGROUP instead. It also turns off
restrictProc by default and makes sure both cannot be enabled.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
This commit is contained in:
Austin Seipp 2014-04-12 11:16:03 -05:00
parent b296895abe
commit 64efd184ed
1 changed files with 32 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
nixos/modules/security/grsecurity.nix
View file

@ -78,9 +78,14 @@ let
GRKERNSEC y GRKERNSEC y
${grsecMainConfig} ${grsecMainConfig}
GRKERNSEC_PROC_USER ${boolToKernOpt cfg.config.restrictProc} ${if cfg.config.restrictProc then
${if !cfg.config.restrictProc then "" "GRKERNSEC_PROC_USER y"
else "GRKERNSEC_PROC_GID "+(toString cfg.config.unrestrictProcGid)} else
optionalString cfg.config.restrictProcWithGroup ''
GRKERNSEC_PROC_USERGROUP y
GRKERNSEC_PROC_GID ${toString cfg.config.unrestrictProcGid}
''
}
GRKERNSEC_SYSCTL ${boolToKernOpt cfg.config.sysctl} GRKERNSEC_SYSCTL ${boolToKernOpt cfg.config.sysctl}
GRKERNSEC_CHROOT_CHMOD ${boolToKernOpt cfg.config.denyChrootChmod} GRKERNSEC_CHROOT_CHMOD ${boolToKernOpt cfg.config.denyChrootChmod}
@ -278,7 +283,7 @@ in
restrictProc = mkOption { restrictProc = mkOption {
type = types.bool; type = types.bool;
default = true; default = false;
description = '' description = ''
If true, then set <literal>GRKERN_PROC_USER If true, then set <literal>GRKERN_PROC_USER
y</literal>. This restricts non-root users to only viewing y</literal>. This restricts non-root users to only viewing
@ -287,18 +292,31 @@ in
''; '';
}; };
restrictProcWithGroup = mkOption {
type = types.bool;
default = true;
description = ''
If true, then set <literal>GRKERN_PROC_USERGROUP
y</literal>. This is similar to
<literal>restrictProc</literal> except it allows a special
group (specified by <literal>unrestrictProcGid</literal>)
to still access otherwise classified information in
<literal>/proc</literal>.
'';
};
unrestrictProcGid = mkOption { unrestrictProcGid = mkOption {
type = types.int; type = types.int;
default = config.ids.gids.grsecurity; default = config.ids.gids.grsecurity;
description = '' description = ''
If set, specifies a GID which is exempt from If set, specifies a GID which is exempt from
<literal>/proc</literal> restrictions (set by <literal>/proc</literal> restrictions (set by
<literal>GRKERN_PROC_USER</literal>). By default, this is <literal>GRKERN_PROC_USERGROUP</literal>). By default,
set to the GID for <literal>grsecurity</literal>, a this is set to the GID for <literal>grsecurity</literal>,
predefined NixOS group, which the <literal>root</literal> a predefined NixOS group, which the
account is a member of. You may conveniently add other <literal>root</literal> account is a member of. You may
users to this group if you need access to conveniently add other users to this group if you need
<literal>/proc</literal> access to <literal>/proc</literal>
''; '';
}; };
@ -346,6 +364,10 @@ in
{ assertion = (cfg.testing -> !cfg.vserver); { assertion = (cfg.testing -> !cfg.vserver);
message = "The vserver patches are only supported in the stable kernel."; message = "The vserver patches are only supported in the stable kernel.";
} }
{ assertion = (cfg.config.restrictProc -> !cfg.config.restrictProcWithGroup) ||
(cfg.config.restrictProcWithGroup -> !cfg.config.restrictProc);
message = "You cannot enable both restrictProc and restrictProcWithGroup";
}
{ assertion = config.boot.kernelPackages.kernel.features ? grsecurity { assertion = config.boot.kernelPackages.kernel.features ? grsecurity
&& config.boot.kernelPackages.kernel.features.grsecurity; && config.boot.kernelPackages.kernel.features.grsecurity;
message = "grsecurity enabled, but kernel doesn't have grsec support"; message = "grsecurity enabled, but kernel doesn't have grsec support";