NixOS/nixpkgs — pull request #1875 by thoughtpolice (2014-03-04 00:33:28+00:00)
Title: nixos: add grsecurity module (RFC)

This module is a work-in-progress which refactors grsecurity support into a module, which can be easily enabled from a users `configuration.nix`.

There are a few reasons for doing this: the current way of enabling grsec support is incredibly un-nix like, as it requires choosing a kernel package and then appropriate options. This is error prone, and requires a lot of work for users when they really want an easy way to do it.

Second, grsec naturally encompasses some other things that can only be handled by a module, that are beyond the kernel package: in particular, mutable files must be installed appropriately into `/etc/grsec` (as `gradm` will use/update the policy files). There are also needed udev rules for `/dev/grsec`. Furthermore, some options like `GRKERNSEC_CHROOT_CHMOD` are extremely incompatible with Nix, and make it impossible to install software. So by default, the module disables this (although it works great if you deploy with NixOps).

Also, some options are incompatible in other ways: for example, `GRKERNSEC_RANDSTRUCT` breaks the virtualbox guest networking drivers (a bug I need to send to grsec upstream), and `GRKERNSEC_LINK` breaks on the 3.13.5 testing kernel (but not the 3.2 stable kernel). Also, if you disable `sysctl` support, things like `systemd-sysctl` must be disabled as they won't work.

Overall, having a module take care of this means there's a lot less pain. This module naturally takes control of `boot.kernelPackages` - I'm not sure how much precedent there is for that, but I think it's reasonable given the purpose.

This also moves the grsecurity overrides out of the kernel package and into the module itself, leaving only the patches in `pkgs`, which I think is probably where it belongs anyway.

Finally, as the grsecurity patches imply `config.apparmor=true`, the module also turns apparmor on as the patches are included (which is easily overlooked).

This is my first 'big' NixOS module that's not simply a service, so I'd appreciate input. If we can land this in some form, more exciting work can happen soon, including enforcement/management of RBAC policies and userspace hardening.

Here's an example of enabling the configuration:

```
security.grsecurity.enable = true;
#security.grsecurity.stable = true; # enable stable 3.2.55 kernel
security.grsecurity.testing = true; # enable testing 3.13.5 kernel
security.grsecurity.config = {
mode = "auto";
priority = "security";
system = "server";
virt = "host";
hwvirt = true;
virtsw = "kvm";

# Extra protection options
denyChrootChmod = true;

# Extra kernel options
kernelExtraConfig = ''
DEVKMEM? n
HIBERNATION? n
XEN? n
HYPERVISOR_GUEST? n
KVM_GUEST? n
PARAVIRT? n
'';
};
```

I'm using this configuration with NixOps, and am successfully deploying Linux 3.13.5-grsec onto Hetzner with this module.

There are some things left **TODO**:

- [x] Enable AppArmor support by default
- [ ] When first deployed with NixOps, `systemd.services.systemd-sysctl.enable` gets shadowed rather than cleanly disabled it appears, meaning I probably got this wrong somehow.
- [ ] I'm not sure the kernel configuration is overridden properly - I need to closely test this with some of my packages like `ktap` which had problems, I believe.

/cc @wizeman