nixos/boot/systemd: enable tracefs#388751
Conversation
tracefs is a special-purpose filesystem in Linux used for tracing filesystem and kernel operations. This was added to the kernel back in 2015 to replace debugfs. For security reasons, some system do not mount debugfs at all. Tracefs reduces the attack surface by allowing to trace without mounting debugfs. Additionally it provides features not supported by debugfs (such as calls for mkdir and rmdir Debian and Arch Linux both enable this by default. RHEL 8 and later, they enable tracefs by default. Signed-off-by: John Titor <[email protected]>
JohnRTitor
added
the
1.severity: security
github-actions
bot
added
6.topic: nixos
nix-owners
bot
requested review from
ElvishJerricco,
aanderse,
arianvp and
flokli
|
Cool! Do you think we should also disable mounting debugfs, and document the "move to tracefs by default" in the release notes? |
github-actions
bot
added
10.rebuild-darwin: 1-10
|
@flokli If there's no harm in leaving debugfs around, we probably should. I think the |
|
|
Like I said, I don't think we'll need this because of the |
|
After a discussion on Matrix, we decided that it would be best to make it go through staging next, to avoid building tests again. As for disabling |
This was a workaround to begin with, as hardened kernel didn't support tracing. Back then kernel level tracing was only available through debugfs, and now that tracefs has been available on NixOS for a while now, enabled in Link: NixOS#388751 This workaround can be removed and bpf can be used with tracefs. Link: NixOS#360957 Signed-off-by: John Titor <[email protected]>
This was a workaround to begin with, as hardened kernel didn't support tracing. Back then kernel level tracing was only available through debugfs, and now that tracefs has been available on NixOS for a while now, enabled in Link: #388751 This workaround can be removed and bpf can be used with tracefs. Link: #360957 Signed-off-by: John Titor <[email protected]>
3 participants
tracefsis a special-purpose filesystem in Linux used for tracing filesystem and kernel operations.This was added to the kernel back in 2015 to replace debugfs. For security reasons, some system do not mount debugfs at all. Tracefs reduces the attack surface by allowing to trace without mounting debugfs. Additionally it provides features not supported by debugfs (such as calls for mkdir and rmdir
Debian and Arch Linux both enable this by default. RHEL 8 and later, they enable tracefs by default.
Closes #388743
Just enabling
tracefsshould be a non-breaking change.