From 5f36161ae19fc226b7b2797cd3ba38794dc0bc37 Mon Sep 17 00:00:00 2001 From: Bernardo Meurer Date: Mon, 10 Jan 2022 17:45:21 -0300 Subject: linuxKernel.kernels: mark {IO_,}STRICT_DEVMEM optional to unbreak hardened kernels --- pkgs/os-specific/linux/kernel/common-config.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'pkgs/os-specific/linux/kernel/common-config.nix') diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index 347f7b2802e..14afc85aa7c 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -457,8 +457,8 @@ let # Detect writes to read-only module pages DEBUG_SET_MODULE_RONX = { optional = true; tristate = whenOlder "4.11" "y"; }; RANDOMIZE_BASE = option yes; - STRICT_DEVMEM = yes; # Filter access to /dev/mem - IO_STRICT_DEVMEM = whenAtLeast "4.5" yes; + STRICT_DEVMEM = mkDefault yes; # Filter access to /dev/mem + IO_STRICT_DEVMEM = whenAtLeast "4.5" (mkDefault yes); SECURITY_SELINUX_BOOTPARAM_VALUE = whenOlder "5.1" (freeform "0"); # Disable SELinux by default # Prevent processes from ptracing non-children processes SECURITY_YAMA = option yes; -- cgit 1.4.1