MirrorHub/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-16 23:03:40 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

linux config: enable the Yama LSM (#14392)

Browse source 
The Yama Linux Security Module restricts the use of ptrace so that
processes cannot ptrace processes that are not their children. This
prevents attackers from compromising one user-level processes and
snooping on the memory and runtime state of other processes owned
by the same user.
This commit is contained in:
Aneesh Agrawal 2016-10-08 10:40:12 -04:00 committed by Franz Pletz
parent ce7739a4dd
commit a000ed181c
1 changed files with 1 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
pkgs/os-specific/linux/kernel/common-config.nix
View file

@ -284,6 +284,7 @@ with stdenv.lib;
RANDOMIZE_BASE? y
STRICT_DEVMEM y # Filter access to /dev/mem
SECURITY_SELINUX_BOOTPARAM_VALUE 0 # Disable SELinux by default
SECURITY_YAMA y # Prevent processes from ptracing non-children processes
DEVKMEM n # Disable /dev/kmem
${if versionOlder version "3.14" then ''
CC_STACKPROTECTOR? y # Detect buffer overflows on the stack