movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 21:50:33 +03:00
Code Activity

grsecurity: add option to disable chroot caps restriction

Browse source 
The chroot caps restriction disallows chroot'ed processes from running
any command that requires `CAP_SYS_ADMIN`, breaking `nixos-rebuild`. See
e.g., https://github.com/NixOS/nixpkgs/issues/15293

This significantly weakens chroot protections, but to break
nixos-rebuild out of the box is too severe.
This commit is contained in:
Joachim Fasting 2016-05-08 08:32:28 +02:00
parent 8ca190c496
commit d4d7bfe07b
No known key found for this signature in database
GPG key ID: 4330820E1E04DCF4
2 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nixos/modules/security/grsecurity.nix
View file

@ -126,6 +126,19 @@ in
'';
};
denyChrootCaps = mkOption {
type = types.bool;
default = false;
description = ''
Whether to lower capabilities of all processes within a chroot,
preventing commands that require <literal>CAP_SYS_ADMIN</literal>.
This protection is disabled by default because it breaks
<literal>nixos-rebuild</literal>. Whenever possible, it is
highly recommended to enable this protection.
'';
};
denyUSB = mkOption {
type = types.bool;
default = false;