diff options
| author | Joachim Fasting <joachifm@fastmail.fm> | 2016-08-01 15:36:03 +0200 |
|---|---|---|
| committer | Joachim Fasting <joachifm@fastmail.fm> | 2016-08-02 10:24:49 +0200 |
| commit | 43fc394a5cd06c38ed43e857ed14496cafdde0b5 (patch) | |
| tree | 1082538c1da93d58cd3e4c308d77d8e99ea88c96 /pkgs/development/python-modules/GitPython/hardcode-git-path.patch | |
| parent | 402a53736eab190dc08ea8c350568f0b16b8c9f8 (diff) | |
grsecurity module: disable EFI runtime services by default
Enabling EFI runtime services provides a venue for injecting code into
the kernel.
When grsecurity is enabled, we close this by default by disabling access
to EFI runtime services. The upshot of this is that
/sys/firmware/efi/efivars will be unavailable by default (and attempts
to mount it will fail).
This is not strictly a grsecurity related option, it could be made into
a general option, but it seems to be of particular interest to
grsecurity users (for non-grsecurity users, there are other, more
immediate kernel injection attack dangers to contend with anyway).
Diffstat (limited to 'pkgs/development/python-modules/GitPython/hardcode-git-path.patch')
0 files changed, 0 insertions, 0 deletions