52 Commits

Author	SHA1	Message	Date
Joachim Fasting	63433537ce	nixos/hardened profile: disable legacy virtual syscalls ... This eliminates a theoretical risk of ASLR bypass due to the fixed address mapping used by the legacy vsyscall mechanism. Modern glibc use vdso(7) instead so there is no loss of functionality, but some programs may fail to run in this configuration. Programs that fail to run because vsyscall has been disabled will be logged to dmesg. For background on virtual syscalls see https://lwn.net/Articles/446528/ Closes https://github.com/NixOS/nixpkgs/pull/25289	2017-04-29 17:27:11 +02:00
Joachim Fasting	063ac40304	nixos: add a "hardened" profile ... The idea is to provide a convenient way to enable most vanilla hardening features in one go. The hardened profile, then, will serve as a place for features that enhance security but cannot be enabled for all deployments because they interfere with legitimate use cases (e.g., using ptrace to debug problems in an already running process). Closes https://github.com/NixOS/nixpkgs/pull/24680	2017-04-23 11:00:52 +02:00