Merge pull request #60187 from joachifm/feat/configurable-malloc
nixos: configurable system-wide malloc
This commit is contained in:
commit
b4a43a278b
91
nixos/modules/config/malloc.nix
Normal file
91
nixos/modules/config/malloc.nix
Normal file
@ -0,0 +1,91 @@
|
|||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
let
|
||||||
|
cfg = config.environment.memoryAllocator;
|
||||||
|
|
||||||
|
# The set of alternative malloc(3) providers.
|
||||||
|
providers = {
|
||||||
|
"graphene-hardened" = rec {
|
||||||
|
libPath = "${pkgs.graphene-hardened-malloc}/lib/libhardened_malloc.so";
|
||||||
|
description = ''
|
||||||
|
An allocator designed to mitigate memory corruption attacks, such as
|
||||||
|
those caused by use-after-free bugs.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
"jemalloc" = {
|
||||||
|
libPath = "${pkgs.jemalloc}/lib/libjemalloc.so";
|
||||||
|
description = ''
|
||||||
|
A general purpose allocator that emphasizes fragmentation avoidance
|
||||||
|
and scalable concurrency support.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
providerConf = providers."${cfg.provider}";
|
||||||
|
|
||||||
|
# An output that contains only the shared library, to avoid
|
||||||
|
# needlessly bloating the system closure
|
||||||
|
mallocLib = pkgs.runCommand "malloc-provider-${cfg.provider}"
|
||||||
|
rec {
|
||||||
|
preferLocalBuild = true;
|
||||||
|
allowSubstitutes = false;
|
||||||
|
origLibPath = providerConf.libPath;
|
||||||
|
libName = baseNameOf origLibPath;
|
||||||
|
}
|
||||||
|
''
|
||||||
|
mkdir -p $out/lib
|
||||||
|
cp -L $origLibPath $out/lib/$libName
|
||||||
|
'';
|
||||||
|
|
||||||
|
# The full path to the selected provider shlib.
|
||||||
|
providerLibPath = "${mallocLib}/lib/${mallocLib.libName}";
|
||||||
|
in
|
||||||
|
|
||||||
|
{
|
||||||
|
meta = {
|
||||||
|
maintainers = [ maintainers.joachifm ];
|
||||||
|
};
|
||||||
|
|
||||||
|
options = {
|
||||||
|
environment.memoryAllocator.provider = mkOption {
|
||||||
|
type = types.enum ([ "libc" ] ++ attrNames providers);
|
||||||
|
default = "libc";
|
||||||
|
description = ''
|
||||||
|
The system-wide memory allocator.
|
||||||
|
</para>
|
||||||
|
|
||||||
|
<para>
|
||||||
|
Briefly, the system-wide memory allocator providers are:
|
||||||
|
<itemizedlist>
|
||||||
|
<listitem><para><literal>libc</literal>: the standard allocator provided by libc</para></listitem>
|
||||||
|
${toString (mapAttrsToList
|
||||||
|
(name: value: "<listitem><para><literal>${name}</literal>: ${value.description}</para></listitem>")
|
||||||
|
providers)}
|
||||||
|
</itemizedlist>
|
||||||
|
</para>
|
||||||
|
|
||||||
|
<warning>
|
||||||
|
<para>
|
||||||
|
Selecting an alternative allocator (i.e., anything other than
|
||||||
|
<literal>libc</literal>) may result in instability, data loss,
|
||||||
|
and/or service failure.
|
||||||
|
</para>
|
||||||
|
</warning>
|
||||||
|
|
||||||
|
<note>
|
||||||
|
<para>
|
||||||
|
Changing this option does not affect the current session.
|
||||||
|
</para>
|
||||||
|
</note>
|
||||||
|
|
||||||
|
<para>
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = mkIf (cfg.provider != "libc") {
|
||||||
|
environment.variables.LD_PRELOAD = providerLibPath;
|
||||||
|
};
|
||||||
|
}
|
@ -19,6 +19,7 @@
|
|||||||
./config/iproute2.nix
|
./config/iproute2.nix
|
||||||
./config/krb5/default.nix
|
./config/krb5/default.nix
|
||||||
./config/ldap.nix
|
./config/ldap.nix
|
||||||
|
./config/malloc.nix
|
||||||
./config/networking.nix
|
./config/networking.nix
|
||||||
./config/no-x-libs.nix
|
./config/no-x-libs.nix
|
||||||
./config/nsswitch.nix
|
./config/nsswitch.nix
|
||||||
|
@ -14,6 +14,8 @@ with lib;
|
|||||||
|
|
||||||
nix.allowedUsers = mkDefault [ "@users" ];
|
nix.allowedUsers = mkDefault [ "@users" ];
|
||||||
|
|
||||||
|
environment.memoryAllocator.provider = mkDefault "graphene-hardened";
|
||||||
|
|
||||||
security.hideProcessInformation = mkDefault true;
|
security.hideProcessInformation = mkDefault true;
|
||||||
|
|
||||||
security.lockKernelModules = mkDefault true;
|
security.lockKernelModules = mkDefault true;
|
||||||
|
@ -27,6 +27,20 @@ import ./make-test.nix ({ pkgs, ...} : {
|
|||||||
};
|
};
|
||||||
|
|
||||||
testScript =
|
testScript =
|
||||||
|
let
|
||||||
|
hardened-malloc-tests = pkgs.stdenv.mkDerivation rec {
|
||||||
|
name = "hardened-malloc-tests-${pkgs.graphene-hardened-malloc.version}";
|
||||||
|
src = pkgs.graphene-hardened-malloc.src;
|
||||||
|
buildPhase = ''
|
||||||
|
cd test/simple-memory-corruption
|
||||||
|
make -j4
|
||||||
|
'';
|
||||||
|
|
||||||
|
installPhase = ''
|
||||||
|
find . -type f -executable -exec install -Dt $out/bin '{}' +
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
in
|
||||||
''
|
''
|
||||||
$machine->waitForUnit("multi-user.target");
|
$machine->waitForUnit("multi-user.target");
|
||||||
|
|
||||||
@ -93,5 +107,18 @@ import ./make-test.nix ({ pkgs, ...} : {
|
|||||||
$machine->fail("systemctl hibernate");
|
$machine->fail("systemctl hibernate");
|
||||||
$machine->fail("systemctl kexec");
|
$machine->fail("systemctl kexec");
|
||||||
};
|
};
|
||||||
|
|
||||||
|
# Test hardened memory allocator
|
||||||
|
sub runMallocTestProg {
|
||||||
|
my ($progName, $errorText) = @_;
|
||||||
|
my $text = "fatal allocator error: " . $errorText;
|
||||||
|
$machine->fail("${hardened-malloc-tests}/bin/" . $progName) =~ $text;
|
||||||
|
};
|
||||||
|
|
||||||
|
subtest "hardenedmalloc", sub {
|
||||||
|
runMallocTestProg("double_free_large", "invalid free");
|
||||||
|
runMallocTestProg("unaligned_free_small", "invalid unaligned free");
|
||||||
|
runMallocTestProg("write_after_free_small", "detected write after free");
|
||||||
|
};
|
||||||
'';
|
'';
|
||||||
})
|
})
|
||||||
|
Loading…
Reference in New Issue
Block a user