3
0
Fork 0
forked from mirrors/nixpkgs
nixpkgs/nixos/modules/config
Austin Seipp 172dc1336f nixos: add grsecurity module (#1875)
This module implements a significant refactoring in grsecurity
configuration for NixOS, making it far more usable by default and much
easier to configure.

 - New security.grsecurity NixOS attributes.
   - All grsec kernels supported
   - Allows default 'auto' grsec configuration, or custom config
   - Supports custom kernel options through kernelExtraConfig
   - Defaults to high-security - user must choose kernel, server/desktop
     mode, and any virtualisation software. That's all.
   - kptr_restrict is fixed under grsecurity (it's unwriteable)
 - grsecurity patch creation is now significantly abstracted
   - only need revision, version, and SHA1
   - kernel version requirements are asserted for sanity
   - built kernels can have the uname specify the exact grsec version
     for development or bug reports. Off by default (requires
     `security.grsecurity.config.verboseVersion = true;`)
 - grsecurity sysctl support
   - By default, disabled.
   - For people who enable it, NixOS deploys a 'grsec-lock' systemd
     service which runs at startup. You are expected to configure sysctl
     through NixOS like you regularly would, which will occur before the
     service is started. As a result, changing sysctl settings requires
     a reboot.
 - New default group: 'grsecurity'
   - Root is a member by default
   - GRKERNSEC_PROC_GID is implicitly set to the 'grsecurity' GID,
     making it possible to easily add users to this group for /proc
     access
 - AppArmor is now automatically enabled where it wasn't before, despite
   implying features.apparmor = true

The most trivial example of enabling grsecurity in your kernel is by
specifying:

    security.grsecurity.enable          = true;
    security.grsecurity.testing         = true;      # testing 3.13 kernel
    security.grsecurity.config.system   = "desktop"; # or "server"

This specifies absolutely no virtualisation support. In general, you
probably at least want KVM host support, which is a little more work.
So:

    security.grsecurity.enable = true;
    security.grsecurity.stable = true; # enable stable 3.2 kernel
    security.grsecurity.config = {
      system   = "server";
      priority = "security";
      virtualisationConfig   = "host";
      virtualisationSoftware = "kvm";
      hardwareVirtualisation = true;
    }

This module has primarily been tested on Hetzner EX40 & VQ7 servers
using NixOps.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-04-11 22:43:51 -05:00
..
fonts Strictly check the arguments to mkOption 2013-10-30 15:35:09 +01:00
gnu.nix Add lots of missing option types 2013-10-30 18:47:43 +01:00
i18n.nix i18n.consoleKeyMap: Accept string or path. 2014-02-17 20:46:33 +01:00
krb5.nix Move all of NixOS to nixos/ in preparation of the repository merge 2013-10-10 13:28:20 +02:00
ldap.nix Move all of NixOS to nixos/ in preparation of the repository merge 2013-10-10 13:28:20 +02:00
networking.nix Add lots of missing option types 2013-10-30 18:47:43 +01:00
no-x-libs.nix Add lots of missing option types 2013-10-30 18:47:43 +01:00
nsswitch.nix Remove uses of the "merge" option attribute 2013-10-28 22:45:56 +01:00
power-management.nix power-management: Don't enable acpid. 2014-03-15 12:17:00 +01:00
pulseaudio.nix nixos: set all package options to have type package 2014-02-27 13:22:29 +01:00
shells-environment.nix Add some primops to lib 2013-11-12 13:48:30 +01:00
swap.nix Substitute "types.uniq types.string" -> "types.str" 2013-10-30 14:57:42 +01:00
sysctl.nix nixos: add grsecurity module (#1875) 2014-04-11 22:43:51 -05:00
system-path.nix su: Make the su package a provider of only the su binary 2014-04-05 16:01:52 -05:00
timezone.nix Don't set $TZ 2014-01-06 18:27:07 +01:00
unix-odbc-drivers.nix Move all of NixOS to nixos/ in preparation of the repository merge 2013-10-10 13:28:20 +02:00
users-groups.nix nixos: add grsecurity module (#1875) 2014-04-11 22:43:51 -05:00