linux_hardened_copperhead: init at 4.11.6.c

pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix

@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub, perl, buildLinux, ... } @ args:
+
+let
+  version = "4.11.6";
+  revision = "c";
+  sha256 = "1n1j1y5g5fcvgpqjfq14fbg4cm32k420kbazipqbi84h9zwifa69";
+in
+
+import ./generic.nix (args // {
+  version = "${version}-${revision}";
+  extraMeta.branch = "4.11";
+  modDirVersion = version;
+
+  src = fetchFromGitHub {
+    inherit sha256;
+    owner = "copperhead";
+    repo = "linux-hardened";
+    rev = "${version}.${revision}";
+  };
+
+  kernelPatches = args.kernelPatches;
+
+  features.iwlwifi = true;
+  features.efiBootStub = true;
+  features.needsCifsUtils = true;
+  features.netfilterRPFilter = true;
+} // (args.argsOverride or {}))

pkgs/top-level/all-packages.nix

@@ -11841,6 +11841,17 @@ with pkgs;
 
   klibcShrunk = lowPrio (callPackage ../os-specific/linux/klibc/shrunk.nix { });
 
+  linux_hardened_copperhead = callPackage ../os-specific/linux/kernel/linux-hardened-copperhead.nix {
+    kernelPatches = with kernelPatches; [
+      kernelPatches.bridge_stp_helper
+      kernelPatches.p9_fixes
+    ];
+    extraConfig = import ../os-specific/linux/kernel/hardened-config.nix {
+      inherit stdenv;
+      inherit (linux) version;
+    };
+  };
+
   linux_mptcp = callPackage ../os-specific/linux/kernel/linux-mptcp.nix {
     kernelPatches =
       [ kernelPatches.bridge_stp_helper
@@ -12092,6 +12103,7 @@ with pkgs;
   linux_latest = linuxPackages_latest.kernel;
 
   # Build the kernel modules for the some of the kernels.
+  linuxPackages_hardened_copperhead = linuxPackagesFor pkgs.linux_hardened_copperhead;
   linuxPackages_mptcp = linuxPackagesFor pkgs.linux_mptcp;
   linuxPackages_rpi = linuxPackagesFor pkgs.linux_rpi;
   linuxPackages_3_10 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_3_10);