Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improvements to the NixOS Hardened Profile #73763

wants to merge 2 commits into
base: master


Copy link

kmcopper commented Nov 19, 2019

Motivation for this change

Use scudo allocator for the hardened profile by default. Includes changes to compiler-rt to make it more compatible by default with things like man see #65000 for some details. Turning these two options off by default will prevent issues in programs from crashing the malloc, which is critical if we are replacing it as the system malloc. These options are all able to be overridden by simple environment variables even when compiled in so this should be a very safe change. I enabled the allocator zeroing by default in the hardened profile only. The buildSandbox option is currently incompatible with the hardened profile so it should be defaulted to off unless you manually re-enable both it and user namespaces.

I tested in a VM using the master branch. I used the hardened profile for the guest. I used both standard llvmPackages.compiler_rt and llvmPackages_9.compiler_rt for testing and both work. I mostly tested these options affects on programs by using man but I've also noticed needing these options as an environment variable for qemu to function well.

I feel like this should be backported to 19.09 so that the hardened profile can take advantage of it as was intended in #65000 for 19.09 (albeit with the graphene_malloc allocator). I feel the clang allocator has a much more stable history and should be the mkDefault here. I was unsure if and how to make the environment variable depend on the scudo allocator being the default but I do feel like it's safe to set in to profile anyway since it can be overridden easily.

I wasn't sure if maintainers wanted me to apply the compatibility all the way back to 4 which does still have scudo. I included 8 because I'm not sure what is going to land as the default for 20.03

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • [] Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits
Notify maintainers

cc @joachifm @lovek323 @dtzWill @7c6f434c

Disables the build sandbox by default to avoid incompatibility with
defaulting user namespaces to false. Ideally there would be some kind of
linux kernel feature that allows us to trust nix-daemon builders to
allow both nix sandbox builds and disabling untrusted naemspaces at the
same time.

This comment has been minimized.

Copy link

joachifm commented Nov 19, 2019

Hi, this LGTM

I think it's inappropriate to backport using scudo by default to 19.09. Non-essential changes that have some chance of producing observable side-effects violate the implied stable "contract", as I understand it.

If the other changes are deemed safe, we can backport those, however.

The compiler-rt changes should go via staging, due to the darwin mass rebuild.

@kmcopper kmcopper force-pushed the kmcopper:hardening-profile branch from 94d8f5c to c89d5b9 Nov 19, 2019
@kmcopper kmcopper mentioned this pull request Nov 19, 2019
0 of 10 tasks complete

This comment has been minimized.

Copy link
Contributor Author

kmcopper commented Nov 19, 2019

Depends on #73766 now as per comments.

@kmcopper kmcopper force-pushed the kmcopper:hardening-profile branch from c89d5b9 to 759968a Nov 26, 2019
@joachifm joachifm self-assigned this Nov 26, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet
2 participants
You can’t perform that action at this time.