Skip to content

Commit

Permalink
linux_*_hardened: don't set X86_X32
Browse files Browse the repository at this point in the history
As far as I can tell, this has never defaulted to on upstream, and our
common kernel configuration doesn't turn it on, so the attack surface
reduction here is somewhat homeopathic.
  • Loading branch information
emilazy committed Apr 17, 2020
1 parent 0d4f35e commit 7d5352d
Showing 1 changed file with 0 additions and 2 deletions.
2 changes: 0 additions & 2 deletions pkgs/os-specific/linux/kernel/hardened-config.nix
Expand Up @@ -19,8 +19,6 @@ assert (versionAtLeast version "4.9");
optionalAttrs (stdenv.hostPlatform.platform.kernelArch == "x86_64") {
DEFAULT_MMAP_MIN_ADDR = freeform "65536"; # Prevent allocation of first 64K of memory

# Reduce attack surface by disabling X32
X86_X32 = no;
# Note: this config depends on EXPERT y and so will not take effect, hence
# it is left "optional" for now.
MODIFY_LDT_SYSCALL = option no;
Expand Down

0 comments on commit 7d5352d

Please sign in to comment.