diff --git a/.reuse/dep5 b/.reuse/dep5 index 6dfb6e43a..dbf91775b 100644 --- a/.reuse/dep5 +++ b/.reuse/dep5 @@ -7,5 +7,5 @@ Copyright: 2022-2024 Technology Innovation Institute (TII) modprobe: FATAL: Module uas not found ... - > modprobe: FATAL: Module nvme not found ... - ... < many packages enabled as M, - others allowMissing = true with overlay - - see implementation below under cfg.enable - - also see https://github.com/NixOS/nixpkgs/issues/109280 - for the context > - */ - - configfile = ./ghaf_host_hardened_baseline; - allowImportFromDerivation = true; - }; - - pkvm_patch = lib.mkIf config.ghaf.hardware.x86_64.common.enable [ - { - name = "pkvm-patch"; - patch = ../virtualization/pkvm/0001-pkvm-enable-pkvm-on-intel-x86-6.1-lts.patch; - structuredExtraConfig = with lib.kernel; { - KVM_INTEL = yes; - KSM = no; - PKVM_INTEL = yes; - PKVM_INTEL_DEBUG = yes; - PKVM_GUEST = yes; - EARLY_PRINTK_USB_XDBC = yes; - RETPOLINE = yes; - }; - } - ]; - - kern_cfg = config.ghaf.host.kernel_hardening; - hyp_cfg = config.ghaf.host.hypervisor_hardening; -in - with lib; { - options.ghaf.host.kernel_hardening = { - enable = mkEnableOption "Host kernel hardening"; - }; - - options.ghaf.host.hypervisor_hardening = { - enable = mkEnableOption "Hypervisor hardening"; - }; - - config = mkIf kern_cfg.enable { - boot.kernelPackages = pkgs.linuxPackagesFor hardened_kernel; - boot.kernelPatches = mkIf (hyp_cfg.enable && "${baseKernel.version}" == "6.1.55") pkvm_patch; - # https://github.com/NixOS/nixpkgs/issues/109280#issuecomment-973636212 - nixpkgs.overlays = [ - (_final: prev: { - makeModulesClosure = x: - prev.makeModulesClosure (x // {allowMissing = true;}); - }) - ]; - }; - } diff --git a/modules/module-list.nix b/modules/module-list.nix index 5df5ba60f..a585301ba 100644 --- a/modules/module-list.nix +++ b/modules/module-list.nix @@ -11,6 +11,7 @@ ./hardware/definition.nix ./hardware/nvidia-jetson-orin/optee.nix ./hardware/x86_64-linux.nix + ./hardware/x86_64-generic/kernel/hardening.nix ./profiles/applications.nix ./profiles/debug.nix ./profiles/graphics.nix diff --git a/modules/virtualization/microvm/guivm.nix b/modules/virtualization/microvm/guivm.nix index a2deb1086..6fe45c9ff 100644 --- a/modules/virtualization/microvm/guivm.nix +++ b/modules/virtualization/microvm/guivm.nix @@ -118,6 +118,11 @@ }; cfg = config.ghaf.virtualization.microvm.guivm; vsockproxy = pkgs.callPackage ../../../packages/vsockproxy {}; + + # Importing kernel builder function and building guest_graphics_hardened_kernel + buildKernel = import ../../../packages/kernel {inherit config pkgs lib;}; + config_baseline = ../../hardware/x86_64-generic/kernel/configs/ghaf_host_hardened_baseline-x86; + guest_graphics_hardened_kernel = buildKernel {inherit config_baseline;}; in { options.ghaf.virtualization.microvm.guivm = { enable = lib.mkEnableOption "GUIVM"; @@ -159,6 +164,10 @@ in { config = guivmBaseConfiguration // { + boot.kernelPackages = + lib.mkIf config.ghaf.guest.kernel.hardening.graphics.enable + (pkgs.linuxPackagesFor guest_graphics_hardened_kernel); + imports = guivmBaseConfiguration.imports ++ cfg.extraModules; diff --git a/nix/checks.nix b/nix/checks.nix index 4515c5cba..767058c14 100644 --- a/nix/checks.nix +++ b/nix/checks.nix @@ -16,6 +16,12 @@ reuse lint touch $out ''; + module-test-hardened-generic-host-kernel = + pkgs.callPackage ../modules/hardware/x86_64-generic/kernel/host/test {inherit pkgs;}; + module-test-hardened-lenovo-x1-guest-guivm-kernel = + pkgs.callPackage ../modules/hardware/lenovo-x1/kernel/guest/test {inherit pkgs;}; + module-test-hardened-pkvm-kernel = + pkgs.callPackage ../modules/hardware/x86_64-generic/kernel/host/pkvm/test {inherit pkgs;}; } // (lib.mapAttrs' (n: lib.nameValuePair "package-${n}") self'.packages); }; diff --git a/nix/devshell/kernel.nix b/nix/devshell/kernel.nix index 66157a260..8702c0d3d 100644 --- a/nix/devshell/kernel.nix +++ b/nix/devshell/kernel.nix @@ -9,6 +9,7 @@ }: let mkKernelShell = { platform, + arch ? "", linux, extraPackages ? [], shellHook ? "", @@ -44,11 +45,12 @@ export PS1="[ghaf-kernel-${platform}-devshell:\w]$ " ''; # use "eval $checkPhase" - see https://discourse.nixos.org/t/nix-develop-and-checkphase/25707 - checkPhase = "cp ../modules/host/ghaf_host_hardened_baseline-${platform} ./.config && make -j$(nproc)"; + checkPhase = "cp ../modules/hardware/${platform}/kernel/configs/ghaf_host_hardened_baseline-${arch} ./.config && make -j$(nproc)"; }; in { devShells.kernel-x86 = mkKernelShell { - platform = "x86"; + platform = "x86_64-generic"; + arch = "x86"; linux = pkgs.linux_latest; }; devShells.kernel-jetson-orin = mkKernelShell { diff --git a/packages/kernel/default.nix b/packages/kernel/default.nix new file mode 100644 index 000000000..eef8a3500 --- /dev/null +++ b/packages/kernel/default.nix @@ -0,0 +1,81 @@ +# Copyright 2022-2024 TII (SSRC) and the Ghaf contributors +# SPDX-License-Identifier: CC-BY-SA-4.0 +{ + config, + pkgs, + lib, +}: { + kernelPatches ? [], + config_baseline, + host_build ? false, +}: let + kernel_package = pkgs.linux_latest; + version = "${kernel_package.version}-ghaf-hardened"; + modDirVersion = version; + base_kernel = + pkgs.linuxManualConfig rec + { + inherit (kernel_package) src; + inherit version modDirVersion kernelPatches; + /* + NixOS required (asserted) kernel features + to comply with no import from derivation. + For the actual kernel build these config + options must come via the kernel + config_baseline argument + */ + config = { + CONFIG_DEVTMPFS = "y"; + CONFIG_CGROUPS = "y"; + CONFIG_INOTIFY_USER = "y"; + CONFIG_SIGNALFD = "y"; + CONFIG_TIMERFD = "y"; + CONFIG_EPOLL = "y"; + CONFIG_NET = "y"; + CONFIG_SYSFS = "y"; + CONFIG_PROC_FS = "y"; + CONFIG_FHANDLE = "y"; + CONFIG_CRYPTO_USER_API_HASH = "y"; + CONFIG_CRYPTO_HMAC = "y"; + CONFIG_CRYPTO_SHA256 = "y"; + CONFIG_DMIID = "y"; + CONFIG_AUTOFS_FS = "y"; + CONFIG_TMPFS_POSIX_ACL = "y"; + CONFIG_TMPFS_XATTR = "y"; + CONFIG_SECCOMP = "y"; + CONFIG_TMPFS = "y"; + CONFIG_BLK_DEV_INITRD = "y"; + CONFIG_EFI_STUB = "y"; + CONFIG_MODULES = "y"; + CONFIG_BINFMT_ELF = "y"; + CONFIG_UNIX = "y"; + }; + configfile = config_baseline; + }; + + generic_host_configs = ../../modules/hardware/x86_64-generic/kernel/host/configs; + generic_guest_configs = ../../modules/hardware/x86_64-generic/kernel/guest/configs; + # TODO: refactor - do we yet have any X1 specific host kernel configuration options? + # - we could add a configuration fragment for host debug via usb-ethernet-adapter(s) + + kernel_features = + lib.optionals config.ghaf.host.kernel.hardening.virtualization.enable ["${generic_host_configs}/virtualization.config"] + ++ lib.optionals config.ghaf.host.kernel.hardening.networking.enable ["${generic_host_configs}/networking.config"] + ++ lib.optionals config.ghaf.host.kernel.hardening.usb.enable ["${generic_host_configs}/usb.config"] + ++ lib.optionals config.ghaf.host.kernel.hardening.inputdevices.enable ["${generic_host_configs}/user-input-devices.config"] + ++ lib.optionals config.ghaf.host.kernel.hardening.debug.enable ["${generic_host_configs}/debug.config"] + ++ lib.optionals (config.ghaf.guest.kernel.hardening.enable && !host_build) ["${generic_guest_configs}/guest.config"] + ++ lib.optionals (config.ghaf.guest.kernel.hardening.graphics.enable && !host_build) ["${generic_guest_configs}/display-gpu.config"]; + + kernel = + if lib.length kernel_features > 0 + then + base_kernel.overrideAttrs (_old: { + inherit kernel_features; + postConfigure = '' + ./scripts/kconfig/merge_config.sh -O $buildRoot $buildRoot/.config $kernel_features; + ''; + }) + else base_kernel; +in + kernel diff --git a/targets/lenovo-x1-carbon.nix b/targets/lenovo-x1-carbon.nix index 1b7a8a0c2..a920897ec 100644 --- a/targets/lenovo-x1-carbon.nix +++ b/targets/lenovo-x1-carbon.nix @@ -320,9 +320,16 @@ ghaf = { hardware.definition = hwDefinition; - host.kernel_hardening.enable = false; + # To enable guest hardening enable host hardening first + host.kernel.hardening.enable = false; + host.kernel.hardening.virtualization.enable = false; + host.kernel.hardening.networking.enable = false; + host.kernel.hardening.inputdevices.enable = false; - host.hypervisor_hardening.enable = false; + guest.kernel.hardening.enable = false; + guest.kernel.hardening.graphics.enable = false; + + host.kernel.hardening.hypervisor.enable = false; hardware.x86_64.common.enable = true; @@ -521,6 +528,11 @@ { ghaf.host.secureboot.enable = false; } + ../modules/hardware/x86_64-generic/kernel/host + { + ghaf.host.kernel.hardening.usb.enable = false; + ghaf.host.kernel.hardening.debug.enable = false; + } ]; releaseModules = [ {