Skip to content

Commit

Permalink
Revert "linux-hardened: Disable GCC_PLUGIN_RANDSTRUCT"
Browse files Browse the repository at this point in the history 
This reverts commit 5dda132.

Presumably this was done to work around build errors or something but it
works fine now.
  • Loading branch information
@joachifm
joachifm committed Jan 5, 2019
1 parent e36c93b commit c68e8b0
Showing 1 changed file with 5 additions and 0 deletions.
5 changes: 5 additions & 0 deletions pkgs/os-specific/linux/kernel/hardened-config.nix
View file
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,11 @@ ${optionalString (versionAtLeast version "4.20") ''
GCC_PLUGIN_STACKLEAK y # A port of the PaX stackleak plugin
''}
${optionalString (versionAtLeast version "4.13") ''
GCC_PLUGIN_RANDSTRUCT y # A port of the PaX randstruct plugin
GCC_PLUGIN_RANDSTRUCT_PERFORMANCE y
''}
# Disable various dangerous settings
ACPI_CUSTOM_METHOD n # Allows writing directly to physical memory
PROC_KCORE n # Exposes kernel text image layout
Expand Down

4 comments on commit c68e8b0

@ivan
Copy link
Member

@ivan ivan commented on c68e8b0 Jan 6, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@joachifm I think RANDSTRUCT is breaking wireguard here: https://gist.github.com/ivan/fd20f1573d402d55e04564702d633570 (this is after a reboot into the new kernel)

@joachifm
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In what context is this happening? When randstruct is enabled, loading a module into a kernel built with a different random seed is expected to fail; looks to me like this is what happened here (going by the modversion disagreement mentioned in the error message).

@joachifm
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you care to, please open an issue about this

@joachifm
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It occurs to me that the seed might not be carried over to out-of-tree builds ...

Please sign in to comment.