Commit 79081fda authored by Fabián Heredia Montiel's avatar Fabián Heredia Montiel
Browse files

linux/hardened/patches/6.9: init at 6.9.1-hardened1

- ACPI_CUSTOM_METHOD: dropped in 0cc46f1a52b4220ec11d98a01575909ca820a7b4
- UBSAN_SANITIZE_ALL: dropped in 918327e9b7ffb45321cbb4b9b86b58ec555fe6b3
parent 2da64127
Loading
Loading
Loading
Loading
+1 −0
Original line number Diff line number Diff line
@@ -32,6 +32,7 @@ let
      linux_6_1_hardened
      linux_6_6_hardened
      linux_6_8_hardened
      linux_6_9_hardened
      linux_rt_5_4
      linux_rt_5_10
      linux_rt_5_15
+2 −2
Original line number Diff line number Diff line
@@ -88,7 +88,7 @@ assert (versionAtLeast version "4.9");
  UBSAN      = yes;
  UBSAN_TRAP = whenAtLeast "5.7" yes;
  UBSAN_BOUNDS = whenAtLeast "5.7" yes;
  UBSAN_SANITIZE_ALL = yes;
  UBSAN_SANITIZE_ALL = whenOlder "6.9" yes;
  UBSAN_LOCAL_BOUNDS = option yes; # clang only
  CFI_CLANG = option yes; # clang only Control Flow Integrity since 6.1

@@ -97,7 +97,7 @@ assert (versionAtLeast version "4.9");
  RANDSTRUCT_PERFORMANCE = whenAtLeast "5.19" yes;

  # Disable various dangerous settings
  ACPI_CUSTOM_METHOD = no; # Allows writing directly to physical memory
  ACPI_CUSTOM_METHOD = whenOlder "6.9" no; # Allows writing directly to physical memory
  PROC_KCORE         = no; # Exposes kernel text image layout
  INET_DIAG          = no; # Has been used for heap based attacks in the past

+10 −0
Original line number Diff line number Diff line
@@ -68,5 +68,15 @@
        },
        "sha256": "0xjirg2w5fc2w2q6wr702akszq32m31lk4q5nbjq10zqhbcr5fxh",
        "version": "6.8.10"
    },
    "6.9": {
        "patch": {
            "extra": "-hardened1",
            "name": "linux-hardened-6.9.1-hardened1.patch",
            "sha256": "1zp0qwri43v4h234x1vqbwcbd50hryshi7i717xandzkpxvq72l2",
            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.9.1-hardened1/linux-hardened-6.9.1-hardened1.patch"
        },
        "sha256": "0jn0qp22vx7xf2mgaj7cwf8agqhahvrwlda4ak6rw67xk2x19d01",
        "version": "6.9.1"
    }
}
+2 −0
Original line number Diff line number Diff line
@@ -27330,6 +27330,8 @@ with pkgs;
  linux_6_6_hardened = linuxKernel.kernels.linux_6_6_hardened;
  linuxPackages_6_8_hardened = linuxKernel.packages.linux_6_8_hardened;
  linux_6_8_hardened = linuxKernel.kernels.linux_6_8_hardened;
  linuxPackages_6_9_hardened = linuxKernel.packages.linux_6_9_hardened;
  linux_6_9_hardened = linuxKernel.kernels.linux_6_9_hardened;
  # GNU Linux-libre kernels
  linuxPackages-libre = linuxKernel.packages.linux_libre;
+2 −0
Original line number Diff line number Diff line
@@ -270,6 +270,7 @@ in {
    linux_6_1_hardened = hardenedKernelFor kernels.linux_6_1 { };
    linux_6_6_hardened = hardenedKernelFor kernels.linux_6_6 { };
    linux_6_8_hardened = hardenedKernelFor kernels.linux_6_8 { };
    linux_6_9_hardened = hardenedKernelFor kernels.linux_6_9 { };

  } // lib.optionalAttrs config.allowAliases {
    linux_4_9 = throw "linux 4.9 was removed because it will reach its end of life within 22.11";
@@ -659,6 +660,7 @@ in {
    linux_6_1_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_1_hardened);
    linux_6_6_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_6_hardened);
    linux_6_8_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_8_hardened);
    linux_6_9_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_9_hardened);

    linux_zen = recurseIntoAttrs (packagesFor kernels.linux_zen);
    linux_lqx = recurseIntoAttrs (packagesFor kernels.linux_lqx);