mirrors/nixpkgs
1
0
Fork 1
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-24 14:41:17 +00:00
Code Issues Wiki Activity

grsecurity module: remove requiredKernelConfig

Browse source 
Using a custom package set with the NixOS module is no longer
something I wish to support.  It's still *possible* but not
advertised.  Secondly, the requiredKernelConfig didn't really
do anything (setting kernelPackages to a non-grsec kernel would
just silently let the user boot into a non-grsec setup ...).
This commit is contained in:
Joachim Fasting 2016-11-20 21:54:38 +01:00
parent 5ad8a56d16
commit 98935c7103
No known key found for this signature in database
GPG key ID: 7544761007FE4E08
2 changed files with 3 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
nixos/modules/security/grsecurity.nix
View file

@ -65,20 +65,10 @@ in
config = mkIf cfg.enable {
# Allow the user to select a different package set, subject to the stated
# required kernel config
boot.kernelPackages = mkDefault pkgs.linuxPackages_grsec_nixos;
boot.kernelParams = optional cfg.disableEfiRuntimeServices "noefi";
system.requiredKernelConfig = with config.lib.kernelConfig;
[ (isEnabled "GRKERNSEC")
(isEnabled "PAX")
(isYes "GRKERNSEC_SYSCTL")
(isYes "GRKERNSEC_SYSCTL_DISTRO")
(isNo "GRKERNSEC_NO_RBAC")
];
nixpkgs.config.grsecurity = true;
# Install PaX related utillities into the system profile.

8
nixos/modules/security/grsecurity.xml
View file

@ -225,11 +225,9 @@
</para>
<para>
The NixOS module makes several assumptions about the kernel and so may be
incompatible with your customised kernel. Most of these assumptions are
encoded as assertions &#x2014; mismatches should ideally result in a build
failure. Currently, the only way to work around incompatibilities is to
eschew the NixOS module and do all configuration yourself.
The NixOS module makes several assumptions about the kernel and so
may be incompatible with your customised kernel. Currently, the only way
to work around incompatibilities is to eschew the NixOS module.
</para>
</sect1>