ecc1ec2c72
Because llvmPackages_latest is used in Nixpkgs, by quite a few packages, it's difficult to keep it up to date, because updating it requires some level of confidence that every package that uses it is going to keep working after the update. The result of this is that llvmPackages_latest is not updated, and so we end up in the situation that "latest" is two versions older than the latest version we actually provide. This is confusing and unexpected. "But won't this end up fragmenting our LLVM versions, if every package previously using _latest is separately pinned to LLVM 14?", I hear you ask. No. That fragmentation is already happening, even with an llvmPackages_latest, because packages that actually require the _latest_ version of LLVM (15/16), have already been decoupled from llvmPackages_latest since it hasn't been upgraded. So like it or not, we can't escape packages depending on specific recent LLVMs. The only real fix is to get better at keeping the default LLVM up to date (which I'm reasonably confident we're getting into a better position to be feasibly better able to do). So, unless we want to double down on providing a confusingly named "llvmPackages_latest" attribute that refers to some arbitrary LLVM version that's probably not the latest one (or even the latest one available in Nixpkgs), we only have two options here: either we don't provide such an attribute at all, or we don't use it in Nixpkgs so we don't become scared to bump it as soon as we have a new LLVM available.
116 lines
3.4 KiB
Nix
116 lines
3.4 KiB
Nix
{ config, lib, pkgs, ... }:
|
||
with lib;
|
||
|
||
let
|
||
cfg = config.environment.memoryAllocator;
|
||
|
||
# The set of alternative malloc(3) providers.
|
||
providers = {
|
||
graphene-hardened = {
|
||
libPath = "${pkgs.graphene-hardened-malloc}/lib/libhardened_malloc.so";
|
||
description = ''
|
||
An allocator designed to mitigate memory corruption attacks, such as
|
||
those caused by use-after-free bugs.
|
||
'';
|
||
};
|
||
|
||
jemalloc = {
|
||
libPath = "${pkgs.jemalloc}/lib/libjemalloc.so";
|
||
description = ''
|
||
A general purpose allocator that emphasizes fragmentation avoidance
|
||
and scalable concurrency support.
|
||
'';
|
||
};
|
||
|
||
scudo = let
|
||
platformMap = {
|
||
aarch64-linux = "aarch64";
|
||
x86_64-linux = "x86_64";
|
||
};
|
||
|
||
systemPlatform = platformMap.${pkgs.stdenv.hostPlatform.system} or (throw "scudo not supported on ${pkgs.stdenv.hostPlatform.system}");
|
||
in {
|
||
libPath = "${pkgs.llvmPackages_14.compiler-rt}/lib/linux/libclang_rt.scudo-${systemPlatform}.so";
|
||
description = ''
|
||
A user-mode allocator based on LLVM Sanitizer’s CombinedAllocator,
|
||
which aims at providing additional mitigations against heap based
|
||
vulnerabilities, while maintaining good performance.
|
||
'';
|
||
};
|
||
|
||
mimalloc = {
|
||
libPath = "${pkgs.mimalloc}/lib/libmimalloc.so";
|
||
description = ''
|
||
A compact and fast general purpose allocator, which may
|
||
optionally be built with mitigations against various heap
|
||
vulnerabilities.
|
||
'';
|
||
};
|
||
};
|
||
|
||
providerConf = providers.${cfg.provider};
|
||
|
||
# An output that contains only the shared library, to avoid
|
||
# needlessly bloating the system closure
|
||
mallocLib = pkgs.runCommand "malloc-provider-${cfg.provider}"
|
||
rec {
|
||
preferLocalBuild = true;
|
||
allowSubstitutes = false;
|
||
origLibPath = providerConf.libPath;
|
||
libName = baseNameOf origLibPath;
|
||
}
|
||
''
|
||
mkdir -p $out/lib
|
||
cp -L $origLibPath $out/lib/$libName
|
||
'';
|
||
|
||
# The full path to the selected provider shlib.
|
||
providerLibPath = "${mallocLib}/lib/${mallocLib.libName}";
|
||
in
|
||
|
||
{
|
||
meta = {
|
||
maintainers = [ maintainers.joachifm ];
|
||
};
|
||
|
||
options = {
|
||
environment.memoryAllocator.provider = mkOption {
|
||
type = types.enum ([ "libc" ] ++ attrNames providers);
|
||
default = "libc";
|
||
description = lib.mdDoc ''
|
||
The system-wide memory allocator.
|
||
|
||
Briefly, the system-wide memory allocator providers are:
|
||
|
||
- `libc`: the standard allocator provided by libc
|
||
${concatStringsSep "\n" (mapAttrsToList
|
||
(name: value: "- `${name}`: ${replaceStrings [ "\n" ] [ " " ] value.description}")
|
||
providers)}
|
||
|
||
::: {.warning}
|
||
Selecting an alternative allocator (i.e., anything other than
|
||
`libc`) may result in instability, data loss,
|
||
and/or service failure.
|
||
:::
|
||
'';
|
||
};
|
||
};
|
||
|
||
config = mkIf (cfg.provider != "libc") {
|
||
boot.kernel.sysctl."vm.max_map_count" = mkIf (cfg.provider == "graphene-hardened") (mkDefault 1048576);
|
||
environment.etc."ld-nix.so.preload".text = ''
|
||
${providerLibPath}
|
||
'';
|
||
security.apparmor.includes = {
|
||
"abstractions/base" = ''
|
||
r /etc/ld-nix.so.preload,
|
||
r ${config.environment.etc."ld-nix.so.preload".source},
|
||
include "${pkgs.apparmorRulesFromClosure {
|
||
name = "mallocLib";
|
||
baseRules = ["mr $path/lib/**.so*"];
|
||
} [ mallocLib ] }"
|
||
'';
|
||
};
|
||
};
|
||
}
|