Skip to content

Commit f9058f4

Browse files
author
Ben Cressey
committed
kernel-6.1, -6.12: enable landlock LSM
Build the kernel with support for the Landlock LSM, and include it in the list of LSMs that will be enabled during boot. Signed-off-by: Ben Cressey <bcressey@amazon.com>
1 parent 6bc4cfc commit f9058f4

6 files changed

Lines changed: 15 additions & 6 deletions

‎packages/kernel-6.1/config-bottlerocket‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,12 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
119119
# Disable SafeSetID LSM
120120
# CONFIG_SECURITY_SAFESETID is not set
121121

122+
# Enable landlock
123+
CONFIG_SECURITY_LANDLOCK=y
124+
125+
# Add landlock to the list of LSMs.
126+
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
127+
122128
# enable /proc/config.gz
123129
CONFIG_IKCONFIG=y
124130
CONFIG_IKCONFIG_PROC=y

‎packages/kernel-6.1/config-full-bottlerocket-aarch64‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5137,7 +5137,7 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
51375137
CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
51385138
# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
51395139
# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
5140-
# CONFIG_SECURITY_LANDLOCK is not set
5140+
CONFIG_SECURITY_LANDLOCK=y
51415141
CONFIG_INTEGRITY=y
51425142
CONFIG_INTEGRITY_SIGNATURE=y
51435143
CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
@@ -5150,7 +5150,7 @@ CONFIG_INTEGRITY_AUDIT=y
51505150
# CONFIG_EVM is not set
51515151
CONFIG_DEFAULT_SECURITY_SELINUX=y
51525152
# CONFIG_DEFAULT_SECURITY_DAC is not set
5153-
CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
5153+
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
51545154

51555155
#
51565156
# Kernel hardening options

‎packages/kernel-6.1/config-full-bottlerocket-x86_64‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5062,7 +5062,7 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
50625062
CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
50635063
# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
50645064
# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
5065-
# CONFIG_SECURITY_LANDLOCK is not set
5065+
CONFIG_SECURITY_LANDLOCK=y
50665066
CONFIG_INTEGRITY=y
50675067
CONFIG_INTEGRITY_SIGNATURE=y
50685068
CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
@@ -5075,7 +5075,7 @@ CONFIG_INTEGRITY_AUDIT=y
50755075
# CONFIG_EVM is not set
50765076
CONFIG_DEFAULT_SECURITY_SELINUX=y
50775077
# CONFIG_DEFAULT_SECURITY_DAC is not set
5078-
CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
5078+
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
50795079

50805080
#
50815081
# Kernel hardening options

‎packages/kernel-6.12/config-bottlerocket‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,9 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
108108
# Enable landlock
109109
CONFIG_SECURITY_LANDLOCK=y
110110

111+
# Add landlock to the list of LSMs.
112+
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf"
113+
111114
# enable /proc/config.gz
112115
CONFIG_IKCONFIG=y
113116
CONFIG_IKCONFIG_PROC=y

‎packages/kernel-6.12/config-full-bottlerocket-aarch64‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5399,7 +5399,7 @@ CONFIG_INTEGRITY_AUDIT=y
53995399
# CONFIG_EVM is not set
54005400
CONFIG_DEFAULT_SECURITY_SELINUX=y
54015401
# CONFIG_DEFAULT_SECURITY_DAC is not set
5402-
CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
5402+
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf"
54035403

54045404
#
54055405
# Kernel hardening options

‎packages/kernel-6.12/config-full-bottlerocket-x86_64‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4960,7 +4960,7 @@ CONFIG_INTEGRITY_AUDIT=y
49604960
# CONFIG_EVM is not set
49614961
CONFIG_DEFAULT_SECURITY_SELINUX=y
49624962
# CONFIG_DEFAULT_SECURITY_DAC is not set
4963-
CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
4963+
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf"
49644964

49654965
#
49664966
# Kernel hardening options

0 commit comments

Comments
 (0)