linuxPackages: various changes

[oxij]

Motivation for this change

• Setting features was broken. And nobody noticed for years.
• There were not enough of hardened kernels.

All the old hashes stay the same (not a mass rebuild, despite how it looks).

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option build-use-sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • Linux
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Some kernels do boot and work.
• Fits CONTRIBUTING.md.

---

[joachifm]

I'd merge the hardened-config stuff without much hesitation. Note that initially it was only meant as a sandbox for testing potentially controversial features, so I'm kind of meh on adding more hardened variants apart from latest, but if somebody wants it then I'm not against it.

The features stuff looks okay to me but it's outside my purview.

[joachifm]

Would you mind if I cherry-picked only the commits affecting hardened-config?

[oxij]

Note that initially it was only meant as a sandbox for testing potentially controversial features, so I'm kind of meh on adding more hardned variants apart from `latest`, but if somebody wants it then I'm not against it.

I didn't notice any slowdowns after booting into it and `dmesg` now clearly shows that I have some security problems, which has a nice motivating effect :) TBH, I think we shouldn't just enable most (except `PANIC_*` and `DEBUG_*`) of those options by default. Users that need to run legacy software can use an "insecure" kernel.

Would you mind if I cherry-picked only the commits affecting hardened-config?

Nah, feel free to pick whatever you like. But the last commit (xen) depends on the first, so they are not exactly independent. Also, the first commit, IMHO, needs to be merged to 17.09 too. I was really surprised `features` didn't actually do anything (they have no effect on `master`, `_xen_dom0` kernel has the same hash as the default).

[oxij]

TBH, I think we shouldn't just enable most (except `PANIC_*` and

Oops, I meant "I think we should".

[joachifm]

I agree some of the configs are "obviously good" and should be moved. I just find it tedious to do so (as it arguably should be, given the number of users affected compared to just the hardened-config).

[joachifm]

I've picked the hardened-config stuff. Will pick the features cleanup as well unless somebody objects.

[fpletz]

Looks fine to me. Thanks!

[grahamc]

@GrahamcOfBorg eval

[oxij]

@GrahamcOfBorg eval undefined variable ‘linuxPackages_hardened_copperhead’ at /home/grahamc/.nix-test-rs/repo/38dca4e3aa6bca43ea96d2fcc04e8229/mr-est/grahamc-laptop/pkgs/top-level/all-packages.nix:12829:31

Should I add an alias for that? Btw, not all the packages in those `linuxPackages` evaluate (same as before this patchset).

[oxij]

- [X] Automated checks pass. - [X] All kernels I touched compiled fine locally. Its perfect.

[oxij]

ping @grahamc and @joachifm

[oxij]

Rebased onto master (the 3rd time). Is there a problem with this? If you feel insecure about this, can't you just merge into staging or something?

[oxij]

ping!

[grahamc]

@GrahamcOfBorg eval