linux: drop *_latest_hardened-attributes in favor of versioned attributes

The problem behind this is that the hardened patchset[1]. Quite recently
this led to a weird problem when Linux 5.12 was dropped (and thus had to
be removed from `nixpkgs`), there were no patches for 5.13, so
`linuxPackages_hardened_latest` had to be downgraded to 5.10 as base[2]
which may be rather unintuitive and unexpected.

To avoid these kind of "silent downgrades" in the future, it makes sense
to drop the attribute entirely. If somebody wants to use a hardened
kernel, it's better to explicitly pin it using the newly introduced
versioned attributes, e.g. `linuxPackages_4_14_hardened`.

[1] https://github.com/anthraxx/linux-hardened/
[2] https://github.com/NixOS/nixpkgs/pull/133587
This commit is contained in:
Maximilian Bosch 2021-08-16 11:31:42 +02:00
parent c6dc09c9e9
commit a5341beb78
No known key found for this signature in database
GPG Key ID: 091DBF4D1FC46B8E
5 changed files with 47 additions and 7 deletions

View File

@ -717,6 +717,16 @@
option was removed and HTTPS is always used.
</para>
</listitem>
<listitem>
<para>
The attribute <literal>linuxPackages_latest_hardened</literal>
was dropped because the hardened patches lag behind the
upstream kernel which made version bumps harder. If you want
to use a hardened kernel, please pin it explicitly with a
versioned attribute such as
<literal>linuxPackages_5_10_hardened</literal>.
</para>
</listitem>
</itemizedlist>
</section>
<section xml:id="sec-release-21.11-notable-changes">

View File

@ -183,6 +183,11 @@ To be able to access the web UI this port needs to be opened in the firewall.
- The `kubernetes` package was upgraded to 1.22. The `kubernetes.apiserver.kubeletHttps` option was removed and HTTPS is always used.
- The attribute `linuxPackages_latest_hardened` was dropped because the hardened patches
lag behind the upstream kernel which made version bumps harder. If you want to use
a hardened kernel, please pin it explicitly with a versioned attribute such as
`linuxPackages_5_10_hardened`.
## Other Notable Changes {#sec-release-21.11-notable-changes}
- The setting [`services.openssh.logLevel`](options.html#opt-services.openssh.logLevel) `"VERBOSE"` `"INFO"`. This brings NixOS in line with upstream and other Linux distributions, and reduces log spam on servers due to bruteforcing botnets.

View File

@ -33,5 +33,10 @@ with pkgs; {
linux_5_10 = makeKernelTest "5.10" linuxPackages_5_10;
linux_5_13 = makeKernelTest "5.13" linuxPackages_5_13;
linux_hardened_4_14 = makeKernelTest "4.14" linuxPackages_4_14_hardened;
linux_hardened_4_19 = makeKernelTest "4.19" linuxPackages_4_19_hardened;
linux_hardened_5_4 = makeKernelTest "5.4" linuxPackages_5_4_hardened;
linux_hardened_5_10 = makeKernelTest "5.10" linuxPackages_5_10_hardened;
linux_testing = makeKernelTest "testing" linuxPackages_testing;
}

View File

@ -448,6 +448,20 @@ mapAliases ({
linuxPackages_xen_dom0_hardened = linuxPackages_hardened;
linuxPackages_latest_xen_dom0_hardened = linuxPackages_latest_hardened;
# added 2021-08-16
linuxPackages_latest_hardened = throw ''
The attribute `linuxPackages_hardened_latest' was dropped because the hardened patches
frequently lag behind the upstream kernel. In some cases this meant that this attribute
had to refer to an older kernel[1] because the latest hardened kernel was EOL and
the latest supported kernel didn't have patches.
If you want to use a hardened kernel, please check which kernel minors are supported
and use a versioned attribute, e.g. `linuxPackages_5_10_hardened'.
[1] for more context: https://github.com/NixOS/nixpkgs/pull/133587
'';
linux_latest_hardened = linuxPackages_latest_hardened;
linux-steam-integration = throw "linux-steam-integration has been removed, as the upstream project has been abandoned"; # added 2020-05-22
loadcaffe = throw "loadcaffe has been removed, as the upstream project has been abandoned"; # added 2020-03-28
lobster-two = google-fonts; # added 2021-07-22

View File

@ -21553,11 +21553,8 @@ with pkgs;
linuxPackages_testing_bcachefs = recurseIntoAttrs (linuxPackagesFor pkgs.linux_testing_bcachefs);
# Hardened Linux
hardenedLinuxPackagesFor = kernel': overrides:
let # Note: We use this hack since the hardened patches can lag behind and we don't want to delay updates:
linux_latest_for_hardened = pkgs.linux_5_10;
kernel = (if kernel' == pkgs.linux_latest then linux_latest_for_hardened else kernel').override overrides;
in linuxPackagesFor (kernel.override {
hardenedLinuxPackagesFor = kernel: overrides:
linuxPackagesFor (kernel.override {
structuredExtraConfig = import ../os-specific/linux/kernel/hardened/config.nix {
inherit lib;
inherit (kernel) version;
@ -21572,8 +21569,17 @@ with pkgs;
linuxPackages_hardened = recurseIntoAttrs (hardenedLinuxPackagesFor pkgs.linux { });
linux_hardened = linuxPackages_hardened.kernel;
linuxPackages_latest_hardened = recurseIntoAttrs (hardenedLinuxPackagesFor pkgs.linux_latest { });
linux_latest_hardened = linuxPackages_latest_hardened.kernel;
linuxPackages_4_14_hardened = recurseIntoAttrs (hardenedLinuxPackagesFor pkgs.linux_4_14 { });
linux_4_14_hardened = linuxPackages_4_14_hardened.kernel;
linuxPackages_4_19_hardened = recurseIntoAttrs (hardenedLinuxPackagesFor pkgs.linux_4_19 { });
linux_4_19_hardened = linuxPackages_4_19_hardened.kernel;
linuxPackages_5_4_hardened = recurseIntoAttrs (hardenedLinuxPackagesFor pkgs.linux_5_4 { });
linux_5_4_hardened = linuxPackages_5_4_hardened.kernel;
linuxPackages_5_10_hardened = recurseIntoAttrs (hardenedLinuxPackagesFor pkgs.linux_5_10 { });
linux_5_10_hardened = linuxPackages_5_10_hardened.kernel;
# Hardkernel (Odroid) kernels.
linuxPackages_hardkernel_4_14 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_hardkernel_4_14);