Branch: refs/heads/master
Home: https://github.com/NixOS/nixpkgs
Commit: 64efd184ed389527bcfbe2f71c312546431f0261
https://github.com/NixOS/nixpkgs/commit/64efd184ed389527bcfbe2f71c312546431f0261
Author: Austin Seipp <[email protected]>
Date: 2014-04-12 (Sat, 12 Apr 2014)
Changed paths:
M nixos/modules/security/grsecurity.nix
Log Message:
-----------
grsecurity: Fix GRKERNSEC_PROC restrictions
Previously we were setting GRKERNSEC_PROC_USER y, which was a little bit
too strict. It doesn't allow a special group (e.g. the grsecurity group
users) to access /proc information - this requires
GRKERNSEC_PROC_USERGROUP y, and the two are mutually exclusive.
This was also not in line with the default automatic grsecurity
configuration - it actually defaults to USERGROUP (although it has a
default GID of 1001 instead of ours), not USER.
This introduces a new option restrictProcWithGroup - enabled by default
- which turns on GRKERNSEC_PROC_USERGROUP instead. It also turns off
restrictProc by default and makes sure both cannot be enabled.
Signed-off-by: Austin Seipp <[email protected]>
_______________________________________________
nix-commits mailing list
[email protected]
http://lists.science.uu.nl/mailman/listinfo/nix-commits
