Skip to content

Commit d66c938

Browse files
fabianhjrfabianhjr
authored
Hardened Kernel updates for 2024-09-22 (#343751)
2 parents 6c1d5c9 + 62c09a3 commit d66c938

File tree

4 files changed

+44
-69
lines changed

4 files changed

+44
-69
lines changed

‎pkgs/os-specific/linux/kernel/hardened/patches.json‎

Lines changed: 32 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -1,82 +1,62 @@
11
{
2-
"4.19": {
3-
"patch": {
4-
"extra": "-hardened1",
5-
"name": "linux-hardened-4.19.315-hardened1.patch",
6-
"sha256": "1w17mwsv618pw5bkahmz6in0i5zjjxd3d14gggafqdd3dgfr1h8q",
7-
"url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.315-hardened1/linux-hardened-4.19.315-hardened1.patch"
8-
},
9-
"sha256": "1j1j8awy0237jp2r211qpa305c10y7rlcbkxkzdvzbgyhwy4spkc",
10-
"version": "4.19.315"
11-
},
122
"5.10": {
133
"patch": {
144
"extra": "-hardened1",
15-
"name": "linux-hardened-5.10.218-hardened1.patch",
16-
"sha256": "1ah4pznha17ngg3w7l0j74h4910gjv8qj503adrap7plvapf82m4",
17-
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.218-hardened1/linux-hardened-5.10.218-hardened1.patch"
5+
"name": "linux-hardened-v5.10.226-hardened1.patch",
6+
"sha256": "1vxcr0f3ikkg10wcvq76djxzmhlc6h5fv34xf8vm48wfi7ryajbk",
7+
"url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.10.226-hardened1/linux-hardened-v5.10.226-hardened1.patch"
188
},
19-
"sha256": "1mmj5hwm5i16gc1y4nzr1cs882vi6vrihrincdcivv63x11v4dlw",
20-
"version": "5.10.218"
9+
"sha256": "19hwwl5sbya65mch7fwmji2cli9b8796zjqbmkybjrarg1j9m8gn",
10+
"version": "5.10.226"
2111
},
2212
"5.15": {
2313
"patch": {
2414
"extra": "-hardened1",
25-
"name": "linux-hardened-5.15.160-hardened1.patch",
26-
"sha256": "1r10ylx886rslsmrixlijjm4crhwzkl3wj6kpyn2344qik1gxpqr",
27-
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.160-hardened1/linux-hardened-5.15.160-hardened1.patch"
15+
"name": "linux-hardened-v5.15.167-hardened1.patch",
16+
"sha256": "1mwww490bf5i1njzyprnamfn8n471r94klgn7wghwi2f5vsn6j9g",
17+
"url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.15.167-hardened1/linux-hardened-v5.15.167-hardened1.patch"
2818
},
29-
"sha256": "018v19a7rhzc4szybzzn86jlnk42x7jm6xkadfd2d3xq6f7727pl",
30-
"version": "5.15.160"
19+
"sha256": "0c6s6l5sz9ibws7bymb393ww0z9i3amsk1yx0bahipz3xhc1yxdi",
20+
"version": "5.15.167"
3121
},
3222
"5.4": {
3323
"patch": {
3424
"extra": "-hardened1",
35-
"name": "linux-hardened-5.4.277-hardened1.patch",
36-
"sha256": "1zjw5wl8lj69j402qm8dg3m4dxgq3ppx2jyz8jks976vyhh8fsg4",
37-
"url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.277-hardened1/linux-hardened-5.4.277-hardened1.patch"
25+
"name": "linux-hardened-v5.4.284-hardened1.patch",
26+
"sha256": "1skqaq90bigrxg0w075nssqbdq868ii62r8asx0m6wcvd5cl50af",
27+
"url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.4.284-hardened1/linux-hardened-v5.4.284-hardened1.patch"
3828
},
39-
"sha256": "0l8zq3k07hdprfpvw69ykkf2pdg8wiv28xz733yxsjcfb0l5n7vy",
40-
"version": "5.4.277"
29+
"sha256": "0axkwfhvq3w2072xjqww476qa3rjglxyqmf72mlp9b5ymswil8kp",
30+
"version": "5.4.284"
4131
},
4232
"6.1": {
4333
"patch": {
4434
"extra": "-hardened1",
45-
"name": "linux-hardened-6.1.92-hardened1.patch",
46-
"sha256": "0cw87ygmisi823y3f7xrck12b6zh3mq1qmb7lcmr3hg6w3xskmn3",
47-
"url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.92-hardened1/linux-hardened-6.1.92-hardened1.patch"
48-
},
49-
"sha256": "1j9n8gk76nn4gw42iba5zgghr360gb9n1mslr5dyv76wpwkz86ch",
50-
"version": "6.1.92"
51-
},
52-
"6.6": {
53-
"patch": {
54-
"extra": "-hardened1",
55-
"name": "linux-hardened-6.6.32-hardened1.patch",
56-
"sha256": "19362a6lxs3cnaw19jvda7n791y95lfgn9ki4wmaxnw2qbpi0bgg",
57-
"url": "https://github.com/anthraxx/linux-hardened/releases/download/6.6.32-hardened1/linux-hardened-6.6.32-hardened1.patch"
35+
"name": "linux-hardened-v6.1.110-hardened1.patch",
36+
"sha256": "1v43n3h9d3y3xjjyf6r8n7a3fh3zpqw4f925bn2z5vwzblmg4bhf",
37+
"url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.1.110-hardened1/linux-hardened-v6.1.110-hardened1.patch"
5838
},
59-
"sha256": "1qbc8dqmk2xs1cz968rysw5xvhq3lj8g0pxp48fr2qbzy3m29a5a",
60-
"version": "6.6.32"
39+
"sha256": "0slgvwldjdyi5vzhgriamkmrj4p942yacclgcw29331gfjs39gly",
40+
"version": "6.1.110"
6141
},
62-
"6.8": {
42+
"6.10": {
6343
"patch": {
6444
"extra": "-hardened1",
65-
"name": "linux-hardened-6.8.11-hardened1.patch",
66-
"sha256": "08i03dmri9h6jxcjd9g6s7pv0spqi3f4fgch1ars68cgngikvbpq",
67-
"url": "https://github.com/anthraxx/linux-hardened/releases/download/6.8.11-hardened1/linux-hardened-6.8.11-hardened1.patch"
45+
"name": "linux-hardened-v6.10.10-hardened1.patch",
46+
"sha256": "13hlk1qd9inq711bz2sw4rq6r2lcagdl7mwxkx6rq8iimic758f2",
47+
"url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.10.10-hardened1/linux-hardened-v6.10.10-hardened1.patch"
6848
},
69-
"sha256": "1di8kr596sf68sm61kp5rz6bn3sb0q5ag1qc5hm8f9dpyq4wv3dp",
70-
"version": "6.8.11"
49+
"sha256": "1kcvh1g3p1sj4q34ylcmm43824f97z4k695lcxnzp7pbnlsyg1z6",
50+
"version": "6.10.10"
7151
},
72-
"6.9": {
52+
"6.6": {
7353
"patch": {
7454
"extra": "-hardened1",
75-
"name": "linux-hardened-6.9.2-hardened1.patch",
76-
"sha256": "0ph1m0pnlqrhvddz2mjgcwvs0ddcpzigz8kgi9zi063qinlfbm3q",
77-
"url": "https://github.com/anthraxx/linux-hardened/releases/download/6.9.2-hardened1/linux-hardened-6.9.2-hardened1.patch"
55+
"name": "linux-hardened-v6.6.51-hardened1.patch",
56+
"sha256": "03m82lylflnk466ixz3dywnj7scp6ynif4qhbx67ak3f0n44f738",
57+
"url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.6.51-hardened1/linux-hardened-v6.6.51-hardened1.patch"
7858
},
79-
"sha256": "1yg5j284y1gz7zwxjz2abvlnas259m1y1vzd9lmcqqar5kgmnv6l",
80-
"version": "6.9.2"
59+
"sha256": "1cq8l3n12gnk6kgms5c7v71l199ip8lc9fpx7s8w8y88cla9l30w",
60+
"version": "6.6.51"
8161
}
8262
}

‎pkgs/os-specific/linux/kernel/hardened/update.py‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,7 @@ def find_asset(filename: str) -> str:
145145
if not sig_ok:
146146
return None
147147

148-
kernel_ver = re.sub(r"(.*)(-hardened[\d]+)$", r'\1', release_info.release.tag_name)
148+
kernel_ver = re.sub(r"v?(.*)(-hardened[\d]+)$", r'\1', release_info.release.tag_name)
149149
major = kernel_ver.split('.')[0]
150150
sha256_kernel, _ = nix_prefetch_url(f"mirror://kernel/linux/kernel/v{major}.x/linux-{kernel_ver}.tar.xz")
151151

@@ -157,8 +157,11 @@ def find_asset(filename: str) -> str:
157157

158158

159159
def parse_version(version_str: str) -> Version:
160+
# There have been two variants v6.10[..] and 6.10[..], drop the v
161+
version_str_without_v = version_str[1:] if not version_str[0].isdigit() else version_str
160162
version: Version = []
161-
for component in re.split(r'\.|\-', version_str):
163+
164+
for component in re.split(r'\.|\-', version_str_without_v):
162165
try:
163166
version.append(int(component))
164167
except ValueError:
@@ -227,7 +230,7 @@ def commit_patches(*, kernel_key: str, message: str) -> None:
227230
# It's not reliable to exit earlier because not every kernel minor may
228231
# have hardened patches, hence the naive search below.
229232
i += 1
230-
if i > 500:
233+
if i > 100:
231234
break
232235

233236
version = parse_version(release.tag_name)

‎pkgs/os-specific/linux/kernel/kernels-org.json‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -19,22 +19,10 @@
1919
"version": "5.4.284",
2020
"hash": "sha256:0axkwfhvq3w2072xjqww476qa3rjglxyqmf72mlp9b5ymswil8kp"
2121
},
22-
"4.19": {
23-
"version": "4.19.322",
24-
"hash": "sha256:0qj106lj554y1kdqj8kwyf7pk9bvrrpgz6s8zyh7d61mk7wws9sf"
25-
},
2622
"6.6": {
2723
"version": "6.6.52",
2824
"hash": "sha256:1f5l6y7abscm01dr740fzvq8r756ar854n0i299smm4rhcsap48m"
2925
},
30-
"6.8": {
31-
"version": "6.8.12",
32-
"hash": "sha256:0fb0m0fv4521g63gq04d7lm6hy8169s1rykiav5bkd99s9b1kcqr"
33-
},
34-
"6.9": {
35-
"version": "6.9.12",
36-
"hash": "sha256:08ngskni7d9wi93vlwcmbdg7sb2jl1drhhzn62k9nsrg1r7crrss"
37-
},
3826
"6.10": {
3927
"version": "6.10.11",
4028
"hash": "sha256:15ihkbsj0idwzbvhynjm3kcnkk0alf3xipip8ngib1f1z13a0kgv"

‎pkgs/top-level/linux-kernels.nix‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@ let
2626
linux = kernel;
2727
};
2828

29+
markBroken = drv: drv.overrideAttrs ({ meta ? {}, ... }: {
30+
meta = meta // { broken = true; };
31+
});
32+
2933
# Hardened Linux
3034
hardenedKernelFor = kernel': overrides:
3135
let
@@ -259,10 +263,10 @@ in {
259263

260264
linux_hardened = hardenedKernelFor packageAliases.linux_default.kernel { };
261265

262-
linux_5_4_hardened = hardenedKernelFor kernels.linux_5_4 {
266+
linux_5_4_hardened = markBroken (hardenedKernelFor kernels.linux_5_4 {
263267
stdenv = gcc10Stdenv;
264268
buildPackages = buildPackages // { stdenv = buildPackages.gcc10Stdenv; };
265-
};
269+
});
266270
linux_5_10_hardened = hardenedKernelFor kernels.linux_5_10 { };
267271
linux_5_15_hardened = hardenedKernelFor kernels.linux_5_15 { };
268272
linux_6_1_hardened = hardenedKernelFor kernels.linux_6_1 { };

0 commit comments

Comments
 (0)