Skip to content

Commit fe1b156

Browse files
author
Ben Cressey
authored
Merge pull request #216 from bcressey/align-kernel-configs
align kernel configs for 6.1 and 6.12
2 parents b124046 + f9058f4 commit fe1b156

7 files changed

Lines changed: 33 additions & 12 deletions

‎packages/kernel-6.1/config-bottlerocket‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@
55
CONFIG_EXT4_FS=y
66
CONFIG_EROFS_FS=y
77

8+
# compress arm64 kernels
9+
CONFIG_EFI_ZBOOT=y
10+
811
# btrfs support for compatibility
912
CONFIG_BTRFS_FS=m
1013
CONFIG_BTRFS_FS_POSIX_ACL=y
@@ -116,6 +119,12 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
116119
# Disable SafeSetID LSM
117120
# CONFIG_SECURITY_SAFESETID is not set
118121

122+
# Enable landlock
123+
CONFIG_SECURITY_LANDLOCK=y
124+
125+
# Add landlock to the list of LSMs.
126+
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
127+
119128
# enable /proc/config.gz
120129
CONFIG_IKCONFIG=y
121130
CONFIG_IKCONFIG_PROC=y
@@ -155,6 +164,11 @@ CONFIG_FW_LOADER_COMPRESS=y
155164
# CONFIG_FW_LOADER_COMPRESS_XZ is not set
156165
CONFIG_FW_LOADER_COMPRESS_ZSTD=y
157166

167+
# Prefer LZ4 for zram compression
168+
CONFIG_ZRAM_DEF_COMP="lz4"
169+
CONFIG_ZRAM_DEF_COMP_LZ4=y
170+
# CONFIG_ZRAM_DEF_COMP_LZO is not set
171+
158172
# Add virtio drivers for development setups running as guests in qemu
159173
CONFIG_VIRTIO_CONSOLE=m
160174
CONFIG_HW_RANDOM_VIRTIO=m

‎packages/kernel-6.1/config-full-bottlerocket-aarch64‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2027,12 +2027,12 @@ CONFIG_BLK_DEV_NULL_BLK=m
20272027
CONFIG_CDROM=m
20282028
# CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set
20292029
CONFIG_ZRAM=m
2030-
CONFIG_ZRAM_DEF_COMP_LZORLE=y
2030+
# CONFIG_ZRAM_DEF_COMP_LZORLE is not set
20312031
# CONFIG_ZRAM_DEF_COMP_ZSTD is not set
2032-
# CONFIG_ZRAM_DEF_COMP_LZ4 is not set
2032+
CONFIG_ZRAM_DEF_COMP_LZ4=y
20332033
# CONFIG_ZRAM_DEF_COMP_LZO is not set
20342034
# CONFIG_ZRAM_DEF_COMP_LZ4HC is not set
2035-
CONFIG_ZRAM_DEF_COMP="lzo-rle"
2035+
CONFIG_ZRAM_DEF_COMP="lz4"
20362036
# CONFIG_ZRAM_WRITEBACK is not set
20372037
# CONFIG_ZRAM_MEMORY_TRACKING is not set
20382038
CONFIG_BLK_DEV_LOOP=m
@@ -5139,7 +5139,7 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
51395139
CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
51405140
# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
51415141
# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
5142-
# CONFIG_SECURITY_LANDLOCK is not set
5142+
CONFIG_SECURITY_LANDLOCK=y
51435143
CONFIG_INTEGRITY=y
51445144
CONFIG_INTEGRITY_SIGNATURE=y
51455145
CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
@@ -5152,7 +5152,7 @@ CONFIG_INTEGRITY_AUDIT=y
51525152
# CONFIG_EVM is not set
51535153
CONFIG_DEFAULT_SECURITY_SELINUX=y
51545154
# CONFIG_DEFAULT_SECURITY_DAC is not set
5155-
CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
5155+
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
51565156

51575157
#
51585158
# Kernel hardening options

‎packages/kernel-6.1/config-full-bottlerocket-x86_64‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1991,12 +1991,12 @@ CONFIG_BLK_DEV_NULL_BLK=m
19911991
CONFIG_CDROM=m
19921992
# CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set
19931993
CONFIG_ZRAM=m
1994-
CONFIG_ZRAM_DEF_COMP_LZORLE=y
1994+
# CONFIG_ZRAM_DEF_COMP_LZORLE is not set
19951995
# CONFIG_ZRAM_DEF_COMP_ZSTD is not set
1996-
# CONFIG_ZRAM_DEF_COMP_LZ4 is not set
1996+
CONFIG_ZRAM_DEF_COMP_LZ4=y
19971997
# CONFIG_ZRAM_DEF_COMP_LZO is not set
19981998
# CONFIG_ZRAM_DEF_COMP_LZ4HC is not set
1999-
CONFIG_ZRAM_DEF_COMP="lzo-rle"
1999+
CONFIG_ZRAM_DEF_COMP="lz4"
20002000
# CONFIG_ZRAM_WRITEBACK is not set
20012001
# CONFIG_ZRAM_MEMORY_TRACKING is not set
20022002
CONFIG_BLK_DEV_LOOP=m
@@ -5068,7 +5068,7 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
50685068
CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
50695069
# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
50705070
# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
5071-
# CONFIG_SECURITY_LANDLOCK is not set
5071+
CONFIG_SECURITY_LANDLOCK=y
50725072
CONFIG_INTEGRITY=y
50735073
CONFIG_INTEGRITY_SIGNATURE=y
50745074
CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
@@ -5081,7 +5081,7 @@ CONFIG_INTEGRITY_AUDIT=y
50815081
# CONFIG_EVM is not set
50825082
CONFIG_DEFAULT_SECURITY_SELINUX=y
50835083
# CONFIG_DEFAULT_SECURITY_DAC is not set
5084-
CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
5084+
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
50855085

50865086
#
50875087
# Kernel hardening options

‎packages/kernel-6.1/kernel-6.1.spec‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,10 @@ Conflicts: %{_cross_os}image-feature(no-fips)
182182
%{summary}.
183183

184184
%prep
185+
%if "%{_cross_arch}" == "aarch64"
186+
%global _cross_kimage vmlinuz.efi
187+
%endif
188+
185189
rpmkeys --import %{S:1} --dbpath "${PWD}/rpmdb"
186190
rpmkeys --checksig %{S:0} --dbpath "${PWD}/rpmdb"
187191
rm -rf "${PWD}/rpmdb"

‎packages/kernel-6.12/config-bottlerocket‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,9 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
108108
# Enable landlock
109109
CONFIG_SECURITY_LANDLOCK=y
110110

111+
# Add landlock to the list of LSMs.
112+
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf"
113+
111114
# enable /proc/config.gz
112115
CONFIG_IKCONFIG=y
113116
CONFIG_IKCONFIG_PROC=y

‎packages/kernel-6.12/config-full-bottlerocket-aarch64‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5402,7 +5402,7 @@ CONFIG_INTEGRITY_AUDIT=y
54025402
# CONFIG_EVM is not set
54035403
CONFIG_DEFAULT_SECURITY_SELINUX=y
54045404
# CONFIG_DEFAULT_SECURITY_DAC is not set
5405-
CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
5405+
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf"
54065406

54075407
#
54085408
# Kernel hardening options

‎packages/kernel-6.12/config-full-bottlerocket-x86_64‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4966,7 +4966,7 @@ CONFIG_INTEGRITY_AUDIT=y
49664966
# CONFIG_EVM is not set
49674967
CONFIG_DEFAULT_SECURITY_SELINUX=y
49684968
# CONFIG_DEFAULT_SECURITY_DAC is not set
4969-
CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
4969+
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf"
49704970

49714971
#
49724972
# Kernel hardening options

0 commit comments

Comments
 (0)