Change:
I'm one of the folks who are currently testing/merging/backporting Linux kernel updates. All in all, this is quite a smooth process thanks to who tirelessly files update PRs in the first place and an existing updater-script. However there are a few minor issues I have that I'd like to discuss here before submitting any code. We have all active Kernel releases packaged and - if available - also which provides a few additional security properties. However these releases lag behind the upstream Kernel usually, on a few occasions we had to wait for about a week[1][2]. However, Kernel updates are quite relevant usually, either because of important bugfixes or because of CVEs to be fixed. Because of that, we decided to ignore outdated hardened patches at some point[3] and right now the hardened kernel is broken rather regularly[4]. Another issue is what's supposed to happen if a kernel minor-release gets EOL and no hardened patches are available for the next higher minor release (that's also )[5]. IMHO neither the "old" approach (awaiting hardened patches and thus delaying kernel updates for everyone) nor the current one (ignoring build failures) is optimal. Current ideas I have are: Drop all hardened kernels. With Nix it isn't very hard to re-add packages via an overlay. Use older versions of a Kernel for hardened variants (i.e. let's say we are at Linux and want to upgrade to , but no hardened patch is available yet. Now we upgrade to , but use continue to use for the hardened kernel). This is a rather trivial one :sweatsmile: I noticed that I get pinged rather inconsistently on Kernel PRs which is totally understandable, I also wouldn't want to keep track of everyone I have to ping for each PR I open, especially because this is automatable. Currently we seem to have a single person listed as maintainer for Kernels: My suggestion is rather simple - we should for a maintainer team with both a team in the NixOS GH org and an entry in . I'd nominate myself - if everyone's OK with that and make sure the members are requested for a review on each Kernel bump. [1] [2] [3] [4] [5]
Since we are using the hardened kernels on our infrastructure, I'm a big fan of changing the way it currently works. I don't know how many people other than us use the hardened kernels, but I don't think it's fesible for everybody to overlay in the hardened kernel and keep it up to date, especially for new users who are switching from other Distros and want to keep their kernels. For this reason, I tend to prefer your second idea. I did this for OpenSSH in as well and I think most of the user base who are using the stock ssh benefit from this change with the others having to accept the less maintained packages.
Just one more detail. For zfs, there is the to track the latest kernel version compatible with zfs. It would be really nice to have something like . I don't use hardened yet, but I am interested in it, the second choice would be amazing.
Yeah, I'm aware of that, but I don't think this is useful here. isn't a good idea because this can lead to "silent" downgrades as mentioned in the OP. Also, this doesn't help when trying to update the "latest compatible version" in question, if no hardened patch is available for a new patch-release we can either delay the upgrade or ignore the hardened kernel.
I have not had as much time to do this maintenance as I used to. I would go with the "keep a specific version for the hardened kernels"-approach.
To chime in, I support decoupling hardened kernel bumps from vanilla kernel bumps. Adopting the the hardening patches takes time and testing, so hardened kernels will often be delayed by a few days. For minor version bumps the upgrade script should attempt to apply the patchset from the previous version, if no matching patchset is available. If it applies cleanly and compiles, fine. If not: simply delay the Kernel update. Another thing that we should take care of before 21.11 are the other Kernel flavours, e.g. Xanmod. While the version in unstable is pretty up-to-date, 21.05 is currently stuck with 5.12.13-xanmod. Maybe the update-script can be extended to ensure that backports are taken care of and we should provide and . ping for their view on this
If someone who uses wants to take up the maintenance of xanmod backports I'll happily help merge PRs. I live on in all my systems, so I don't have time or a host to test the backports properly.
I've been switching around Kernel versions on a lot lately (because of issues with nouveau, not NixOS specific) and it always worked like a charm. Given that Xanmod is targeted towards desktop use, where a rollback is just a reboot away I think we are fine with a "no guarantees" approach. The user base on stable seems to be rather small, given that no one noticed the outdated kernel for quite some time.
I'm fine with a stable version of xanmod if there's enough demand of it, personally I use the latest available, as I don't use ZFS and the like.
I use xanmod latest and zfs
Hardened plan sounds fine to me. I'm happy to be in the maintainer team so I get pinged if I'm around, as long as everybody has the expectation going in that I don't often find the time to do kernel patch releases.
Splendid! I'll file PRs for both the hardening topic and the maintainer team during one fo the next days :)
Can XanMod be to
I (evidently ) use the hardened kernel so would prefer the second approach. Do you believe this will be a significant maintenance burden?
there's already doing exactly that :)

Discussion:
scope = "Maintain Kodi and related packages."; }; <ins> linux-kernel = { members = [ TredwellGit ma27 nequissimus qyliss ]; scope = "Maintain the Linux kernel."; }; </ins> mate = { members = [ j03

{ "4.14": { <del> "extra": "-hardened1", "name": "linux-hardened-4.14.251-hardened1.patch", "sha256": "1yv4b10w1psaj4m4r9jicf6c3wkyvb040p7gbdf1455nrcxnxr06", "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.251-hardened1/linux-hardened-4.14.251-hardened1.patch" </del> <ins> "patch": { "extra": "-hardened1", "name": "linux-hardened-4.14.252-hardened1.patch", "sha256": "1isqlqg4diz0i3f77rigvb07fs2p1v9w2h5165l0rnkb6h26i1gn", "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.252-hardened1/linux-hardened-4.14.252-hardened1.patch" }, "sha256": "022rw51s8fzz6wcxa9xq6h60fglfx0hq7bmqgs5dlrci6plv4fwk", "version": "4.14.252" </ins> }, "4.19": { <del> "extra": "-hardened1", "name": "linux-hardened-4.19.212-hardened1.patch", "sha256": "1ildbzxzvkaziqiqlvw92pjmkd64hxdd9sn3fdq88q1pdw5x2jb3", "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.212-hardened1/linux-hardened-4.19.212-hardened1.patch" </del> <ins> "patch": { "extra": "-hardened1", "name": "linux-hardened-4.19.213-hardened1.patch", "sha256": "03lk4m6sm3545s0xxx0w4sqgrsvrxqm8qg7swn05s36jj20viprm", "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.213-hardened1/linux-hardened-4.19.213-hardened1.patch" }, "sha256": "162f5y3jplql3ca5xy889mq6izjinryx2kx16zp582yvsqf8rwiq", "version": "4.19.213" </ins> }, "5.10": { <del> "extra": "-hardened1", "name": "linux-hardened-5.10.74-hardened1.patch", "sha256": "0prcrifz1zmjxv492dgd78h8bdsx4bh92dsbnp01nn1wmwbajp8p", "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.74-hardened1/linux-hardened-5.10.74-hardened1.patch" </del> <ins> "patch": { "extra": "-hardened1", "name": "linux-hardened-5.10.75-hardened1.patch", "sha256": "17gm50aislxihfnmr4vi0p0gpg13m2pbldjpi81clnx93a7rrfw2", "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.75-hardened1/linux-hardened-5.10.75-hardened1.patch" }, "sha256": "0jrhhk89587caw54nhnwms93kq33qdm75x5f18cp61xrxxgjyaqa", "version": "5.10.75" </ins> }, "5.14": { <del> "extra": "-hardened1", "name": "linux-hardened-5.14.13-hardened1.patch", "sha256": "01kxjn1sndby3fjfq3g7z0ydrk8nv62bvpvprddqqc3bypk9q7m2", "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.14.13-hardened1/linux-hardened-5.14.13-hardened1.patch" </del> <ins> "patch": { "extra": "-hardened1", "name": "linux-hardened-5.14.14-hardened1.patch", "sha256": "1hx5yal8jqnxr9c9ikvc6d0xp99kqjarj67720v9d4wvlmgsfabj", "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.14.14-hardened1/linux-hardened-5.14.14-hardened1.patch" }, "sha256": "0snh17ah49wmfmazy6x42rhvl484h657y0iq4l09a885sjb4xzsd", "version": "5.14.14" </ins> }, "5.4": { <del> "extra": "-hardened1", "name": "linux-hardened-5.4.154-hardened1.patch", "sha256": "0d7w27n3wq9jaq0wbf3iv2f0jb1y2v4k0c87rb6sakivwajxn1aw", "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.154-hardened1/linux-hardened-5.4.154-hardened1.patch" </del> <ins> "patch": { "extra": "-hardened1", "name": "linux-hardened-5.4.155-hardened1.patch", "sha256": "0l8h9i6asiypgbxl90370kzfsyyc3f4vwl2r191arvrsgw863bid", "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.155-hardened1/linux-hardened-5.4.155-hardened1.patch" }, "sha256": "0f2hfz76rnhmv99zhbh7n1z48316ilxrxrnh4b5m3lj84y80y36c", "version": "5.4.155" </ins> } }

Version = List[VersionComponent] <del> Patch = TypedDict("Patch", {"name": str, "url": str, "sha256": str, "extra": str}) </del> <ins> PatchData = TypedDict("PatchData", {"name": str, "url": str, "sha256": str, "extra": str}) Patch = TypedDict("Patch", { "patch": PatchData, "version": str, "sha256": str, }) </ins> @dataclass

if not sig_ok: return None <del> return Patch(name=patch_filename, url=patch_url, sha256=sha256, extra=extra) </del> <ins> kernel_ver = release_info.release.tag_name.replace("-hardened1", "") major = kernel_ver.split('.')[0] sha256_kernel, _ = nix_prefetch_url(f"mirror://kernel/linux/kernel/v{major}.x/linux-{kernel_ver}.tar.xz") return Patch( patch=PatchData(name=patch_filename, url=patch_url, sha256=sha256, extra=extra), version=kernel_ver, sha256=sha256_kernel ) </ins> def parse_version(version_str: str) -> Version:

old_version_str: Optional[str] = None update: bool try: <del> old_filename = patches[kernel_key]["name"] </del> <ins> old_filename = patches[kernel_key]["patch"]["name"] </ins> old_version_str = old_filename.replace("linux-hardened-", "").replace( ".patch", "" )

license = lib.licenses.gpl2Only; homepage = "https://www.kernel.org/"; repositories.git = "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git"; <del> maintainers = [ </del> <ins> maintainers = lib.teams.linux-kernel.members ++ [ </ins> maintainers.thoughtpolice ]; platforms = platforms.linux;

cpu-cgroup-v2 = import ./cpu-cgroup-v2-patches; hardened = let <del> mkPatch = kernelVersion: src: { </del> <ins> mkPatch = kernelVersion: { version, sha256, patch }: let src = patch; in { </ins> name = lib.removeSuffix ".patch" src.name; patch = fetchurl (lib.filterAttrs (k: v: k != "extra") src); extra = src.extra; <ins> inherit version sha256; </ins> }; patches = builtins.fromJSON (builtins.readFile ./hardened/patches.json); in lib.mapAttrs mkPatch patches;

, stdenvNoCC , newScope , lib <ins> , fetchurl </ins> }: # When adding a kernel:

# Hardened Linux hardenedKernelFor = kernel': overrides: <del> let kernel = kernel'.override overrides; </del> <ins> let kernel = kernel'.override overrides; version = kernelPatches.hardened.${kernel.meta.branch}.version; major = lib.versions.major version; sha256 = kernelPatches.hardened.${kernel.meta.branch}.sha256; modDirVersion' = builtins.replaceStrings [ kernel.version ] [ version ] kernel.modDirVersion; </ins> in kernel.override { structuredExtraConfig = import ../os-specific/linux/kernel/hardened/config.nix { <del> inherit lib; inherit (kernel) version; </del> <ins> inherit lib version; }; argsOverride = { inherit version; src = fetchurl { url = "mirror://kernel/linux/kernel/v${major}.x/linux-${version}.tar.xz"; inherit sha256; }; </ins> }; kernelPatches = kernel.kernelPatches ++ [ kernelPatches.hardened.${kernel.meta.branch} ]; <del> modDirVersionArg = kernel.modDirVersion + (kernelPatches.hardened.${kernel.meta.branch}).extra; </del> <ins> modDirVersionArg = modDirVersion' + (kernelPatches.hardened.${kernel.meta.branch}).extra; </ins> isHardened = true; }; in {