colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/security/misc: factor out protectKernelImage

Browse Source 
Introduces the option security.protectKernelImage that is intended to control
various mitigations to protect the integrity of the running kernel
image (i.e., prevent replacing it without rebooting).

This makes sense as a dedicated module as it is otherwise somewhat difficult
to override for hardened profile users who want e.g., hibernation to work.
This commit is contained in:
Joachim Fasting 2018-12-16 10:37:36 +01:00
parent 9db84f6fcd
commit 84fb8820db
No known key found for this signature in database
GPG Key ID: 5C204DF675C90294
3 changed files with 23 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
nixos/modules/profiles/hardened.nix
View File

@ -20,6 +20,8 @@ with lib;
security.allowUserNamespaces = mkDefault false;
security.protectKernelImage = mkDefault true;
security.apparmor.enable = mkDefault true;
boot.kernelParams = [
@ -28,9 +30,6 @@ with lib;
# Disable legacy virtual syscalls
"vsyscall=none"
# Disable hibernation (allows replacing the running kernel)
"nohibernate"
];
boot.blacklistedKernelModules = [
@ -44,9 +43,6 @@ with lib;
# (e.g., parent/child)
boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkOverride 500 1;
# Prevent replacing the running kernel image w/o reboot
boot.kernel.sysctl."kernel.kexec_load_disabled" = mkDefault true;
# Restrict access to kernel ring buffer (information leaks)
boot.kernel.sysctl."kernel.dmesg_restrict" = mkDefault true;

15
nixos/modules/security/misc.nix
View File

@ -22,6 +22,14 @@ with lib;
a user namespace fails with "no space left on device" (ENOSPC).
'';
};
security.protectKernelImage = mkOption {
type = types.bool;
default = false;
description = ''
Whether to prevent replacing the running kernel image.
'';
};
};
config = mkMerge [
@ -37,5 +45,12 @@ with lib;
}
];
})
(mkIf config.security.protectKernelImage {
# Disable hibernation (allows replacing the running kernel)
boot.kernelParams = [ "nohibernate" ];
# Prevent replacing the running kernel image w/o reboot
boot.kernel.sysctl."kernel.kexec_load_disabled" = mkDefault true;
})
];
}

6
nixos/tests/hardened.nix
View File

@ -70,5 +70,11 @@ import ./make-test.nix ({ pkgs, ...} : {
$machine->fail("su -l nobody -s /bin/sh -c 'nix ping-store'");
$machine->succeed("su -l alice -c 'nix ping-store'") =~ "OK";
};
# Test kernel image protection
subtest "kernelimage", sub {
$machine->fail("systemctl hibernate");
$machine->fail("systemctl kexec");
};
'';
})