philipp
/
nixpkgs
1
0
Fork 0
Code Issues Pull Requests Projects Releases Activity

linux: build hardened kernel with matching releases 

Until now we merged kernel updates even if no hardened versions were
available yet. On one hand we don't want to delay patch-level updates,
on the other hand users of hardened kernels have frequent breakage now[1].

This change aims to provide a solution this issue:

* The hardened patchset now references the kernel version it's released
  for (including a sha256 hash for the fixed-output path of the source
  tarball).
* The `hardenedKernelFor`-function doesn't just append hardened patches
  now, but also overrides version & src to match the kernel version the
  patch was built & tested for.

Refs #140281

[1] https://hydra.nixos.org/job/nixos/trunk-combined/nixpkgs.linuxPackages_hardened.kernel.x86_64-linux/all
conduit-nginx
Maximilian Bosch 2021-10-09 14:48:27 +02:00
parent 65930caffe
commit bb5aa0109b
No known key found for this signature in database
GPG Key ID: 091DBF4D1FC46B8E
4 changed files with 74 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
pkgs/os-specific/linux/kernel/hardened/patches.json
View File

@ -1,32 +1,52 @@
{
"4.14": {
"extra": "-hardened1",
"name": "linux-hardened-4.14.251-hardened1.patch",
"sha256": "1yv4b10w1psaj4m4r9jicf6c3wkyvb040p7gbdf1455nrcxnxr06",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.251-hardened1/linux-hardened-4.14.251-hardened1.patch"
"patch": {
"extra": "-hardened1",
"name": "linux-hardened-4.14.252-hardened1.patch",
"sha256": "1isqlqg4diz0i3f77rigvb07fs2p1v9w2h5165l0rnkb6h26i1gn",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.252-hardened1/linux-hardened-4.14.252-hardened1.patch"
},
"sha256": "022rw51s8fzz6wcxa9xq6h60fglfx0hq7bmqgs5dlrci6plv4fwk",
"version": "4.14.252"
},
"4.19": {
"extra": "-hardened1",
"name": "linux-hardened-4.19.212-hardened1.patch",
"sha256": "1ildbzxzvkaziqiqlvw92pjmkd64hxdd9sn3fdq88q1pdw5x2jb3",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.212-hardened1/linux-hardened-4.19.212-hardened1.patch"
"patch": {
"extra": "-hardened1",
"name": "linux-hardened-4.19.213-hardened1.patch",
"sha256": "03lk4m6sm3545s0xxx0w4sqgrsvrxqm8qg7swn05s36jj20viprm",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.213-hardened1/linux-hardened-4.19.213-hardened1.patch"
},
"sha256": "162f5y3jplql3ca5xy889mq6izjinryx2kx16zp582yvsqf8rwiq",
"version": "4.19.213"
},
"5.10": {
"extra": "-hardened1",
"name": "linux-hardened-5.10.74-hardened1.patch",
"sha256": "0prcrifz1zmjxv492dgd78h8bdsx4bh92dsbnp01nn1wmwbajp8p",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.74-hardened1/linux-hardened-5.10.74-hardened1.patch"
"patch": {
"extra": "-hardened1",
"name": "linux-hardened-5.10.75-hardened1.patch",
"sha256": "17gm50aislxihfnmr4vi0p0gpg13m2pbldjpi81clnx93a7rrfw2",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.75-hardened1/linux-hardened-5.10.75-hardened1.patch"
},
"sha256": "0jrhhk89587caw54nhnwms93kq33qdm75x5f18cp61xrxxgjyaqa",
"version": "5.10.75"
},
"5.14": {
"extra": "-hardened1",
"name": "linux-hardened-5.14.13-hardened1.patch",
"sha256": "01kxjn1sndby3fjfq3g7z0ydrk8nv62bvpvprddqqc3bypk9q7m2",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.14.13-hardened1/linux-hardened-5.14.13-hardened1.patch"
"patch": {
"extra": "-hardened1",
"name": "linux-hardened-5.14.14-hardened1.patch",
"sha256": "1hx5yal8jqnxr9c9ikvc6d0xp99kqjarj67720v9d4wvlmgsfabj",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.14.14-hardened1/linux-hardened-5.14.14-hardened1.patch"
},
"sha256": "0snh17ah49wmfmazy6x42rhvl484h657y0iq4l09a885sjb4xzsd",
"version": "5.14.14"
},
"5.4": {
"extra": "-hardened1",
"name": "linux-hardened-5.4.154-hardened1.patch",
"sha256": "0d7w27n3wq9jaq0wbf3iv2f0jb1y2v4k0c87rb6sakivwajxn1aw",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.154-hardened1/linux-hardened-5.4.154-hardened1.patch"
"patch": {
"extra": "-hardened1",
"name": "linux-hardened-5.4.155-hardened1.patch",
"sha256": "0l8h9i6asiypgbxl90370kzfsyyc3f4vwl2r191arvrsgw863bid",
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.155-hardened1/linux-hardened-5.4.155-hardened1.patch"
},
"sha256": "0f2hfz76rnhmv99zhbh7n1z48316ilxrxrnh4b5m3lj84y80y36c",
"version": "5.4.155"
}
}

19
pkgs/os-specific/linux/kernel/hardened/update.py
View File

@ -31,7 +31,12 @@ VersionComponent = Union[int, str]
Version = List[VersionComponent]
Patch = TypedDict("Patch", {"name": str, "url": str, "sha256": str, "extra": str})
PatchData = TypedDict("PatchData", {"name": str, "url": str, "sha256": str, "extra": str})
Patch = TypedDict("Patch", {
"patch": PatchData,
"version": str,
"sha256": str,
})
@dataclass
@ -133,7 +138,15 @@ def fetch_patch(*, name: str, release_info: ReleaseInfo) -> Optional[Patch]:
if not sig_ok:
return None
return Patch(name=patch_filename, url=patch_url, sha256=sha256, extra=extra)
kernel_ver = release_info.release.tag_name.replace("-hardened1", "")
major = kernel_ver.split('.')[0]
sha256_kernel, _ = nix_prefetch_url(f"mirror://kernel/linux/kernel/v{major}.x/linux-{kernel_ver}.tar.xz")
return Patch(
patch=PatchData(name=patch_filename, url=patch_url, sha256=sha256, extra=extra),
version=kernel_ver,
sha256=sha256_kernel
)
def parse_version(version_str: str) -> Version:
@ -249,7 +262,7 @@ for kernel_key in sorted(releases.keys()):
old_version_str: Optional[str] = None
update: bool
try:
old_filename = patches[kernel_key]["name"]
old_filename = patches[kernel_key]["patch"]["name"]
old_version_str = old_filename.replace("linux-hardened-", "").replace(
".patch", ""
)

3
pkgs/os-specific/linux/kernel/patches.nix
View File

@ -47,10 +47,11 @@
cpu-cgroup-v2 = import ./cpu-cgroup-v2-patches;
hardened = let
mkPatch = kernelVersion: src: {
mkPatch = kernelVersion: { version, sha256, patch }: let src = patch; in {
name = lib.removeSuffix ".patch" src.name;
patch = fetchurl (lib.filterAttrs (k: v: k != "extra") src);
extra = src.extra;
inherit version sha256;
};
patches = builtins.fromJSON (builtins.readFile ./hardened/patches.json);
in lib.mapAttrs mkPatch patches;

20
pkgs/top-level/linux-kernels.nix
View File

@ -10,6 +10,7 @@
, stdenvNoCC
, newScope
, lib
, fetchurl
}:
# When adding a kernel:
@ -26,16 +27,27 @@ let
# Hardened Linux
hardenedKernelFor = kernel': overrides:
let kernel = kernel'.override overrides;
let
kernel = kernel'.override overrides;
version = kernelPatches.hardened.${kernel.meta.branch}.version;
major = lib.versions.major version;
sha256 = kernelPatches.hardened.${kernel.meta.branch}.sha256;
modDirVersion' = builtins.replaceStrings [ kernel.version ] [ version ] kernel.modDirVersion;
in kernel.override {
structuredExtraConfig = import ../os-specific/linux/kernel/hardened/config.nix {
inherit lib;
inherit (kernel) version;
inherit lib version;
};
argsOverride = {
inherit version;
src = fetchurl {
url = "mirror://kernel/linux/kernel/v${major}.x/linux-${version}.tar.xz";
inherit sha256;
};
};
kernelPatches = kernel.kernelPatches ++ [
kernelPatches.hardened.${kernel.meta.branch}
];
modDirVersionArg = kernel.modDirVersion + (kernelPatches.hardened.${kernel.meta.branch}).extra;
modDirVersionArg = modDirVersion' + (kernelPatches.hardened.${kernel.meta.branch}).extra;
isHardened = true;
};
in {