{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/25246","repository_url":"https://api.github.com/repos/NixOS/nixpkgs","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/25246/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/25246/comments","events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/25246/events","html_url":"https://github.com/NixOS/nixpkgs/issues/25246","id":224500155,"number":25246,"title":"mkForce for the kernel package in grsecurity.enable is a bit awkward","user":{"login":"copumpkin","id":2623,"avatar_url":"https://avatars2.githubusercontent.com/u/2623?v=3","gravatar_id":"","url":"https://api.github.com/users/copumpkin","html_url":"https://github.com/copumpkin","followers_url":"https://api.github.com/users/copumpkin/followers","following_url":"https://api.github.com/users/copumpkin/following{/other_user}","gists_url":"https://api.github.com/users/copumpkin/gists{/gist_id}","starred_url":"https://api.github.com/users/copumpkin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/copumpkin/subscriptions","organizations_url":"https://api.github.com/users/copumpkin/orgs","repos_url":"https://api.github.com/users/copumpkin/repos","events_url":"https://api.github.com/users/copumpkin/events{/privacy}","received_events_url":"https://api.github.com/users/copumpkin/received_events","type":"User","site_admin":false},"labels":[{"id":199624405,"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/6.topic:%20grsecurity","name":"6.topic: grsecurity","color":"fef2c0","default":false},{"id":60265212,"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/6.topic:%20nixos","name":"6.topic: nixos","color":"fef2c0","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2017-04-26T15:03:07Z","updated_at":"2017-04-26T15:54:00Z","closed_at":null,"body":"## Issue description\r\n\r\nI'm trying to create an Amazon EC2 image with `security.grsecurity.enable = true`. Unfortunately the default kernel it uses is incompatible with EC2 and doesn't boot (which is a pain to debug thanks to AWS not having a real console). Unfortunately, the design of the current `grsecurity` module uses `mkForce` on the `kernelPackages`, so even though we have an EC2-compatible grsecurity kernel in nixpkgs, I need to jump through a couple of hoops to use it easily.\r\n\r\nWhat I'd do instead is give the `grsecurity` NixOS module a `linuxPackages-grsec` option (I'm bad at naming, so pick something not awful) that defaults to the one you currently use `mkForce` on, then use that in the module config. Then in the `amazon-image.nix` module (and other virtualized systems like it), we'd also set `security.grsecurity.linuxPackages` to the suitable kernel. That wouldn't have any effect unless someone used `security.grsecurity.enable = true`, but would make things work sensibly out of the box for most users.\r\n\r\nDoes that make sense? It seems like an easy fix but I wanted to run it by folks first.\r\n\r\ncc @joachifm @jammerful"},"comment":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/comments/297456363","html_url":"https://github.com/NixOS/nixpkgs/issues/25246#issuecomment-297456363","issue_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/25246","id":297456363,"user":{"login":"joachifm","id":41977,"avatar_url":"https://avatars0.githubusercontent.com/u/41977?v=3","gravatar_id":"","url":"https://api.github.com/users/joachifm","html_url":"https://github.com/joachifm","followers_url":"https://api.github.com/users/joachifm/followers","following_url":"https://api.github.com/users/joachifm/following{/other_user}","gists_url":"https://api.github.com/users/joachifm/gists{/gist_id}","starred_url":"https://api.github.com/users/joachifm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joachifm/subscriptions","organizations_url":"https://api.github.com/users/joachifm/orgs","repos_url":"https://api.github.com/users/joachifm/repos","events_url":"https://api.github.com/users/joachifm/events{/privacy}","received_events_url":"https://api.github.com/users/joachifm/received_events","type":"User","site_admin":false},"created_at":"2017-04-26T15:54:00Z","updated_at":"2017-04-26T15:54:00Z","body":"AFAIK, the most pertinent differences between the stock and the xen variants are kernexec and uderef. The latter can be disabled at boot time, so if that's what keeping you from booting there is a way around it without switching kernels, fwiw."}}
{"actor":{"display_login":"joachifm"}}