Skip to content

align kernel configs for 6.1 and 6.12 #216

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bcressey merged 3 commits into from
Jul 23, 2025
Merged

align kernel configs for 6.1 and 6.12 #216

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5370dab
kernel-6.1: switch to zboot kernel for aarch64
Jul 18, 2025
6bc4cfc
kernel-6.1: adjust zram config to prefer LZ4
Jul 18, 2025
f9058f4
kernel-6.1, -6.12: enable landlock LSM
Jul 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions packages/kernel-6.1/config-bottlerocket
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,9 @@
CONFIG_EXT4_FS=y
CONFIG_EROFS_FS=y

# compress arm64 kernels
CONFIG_EFI_ZBOOT=y

# btrfs support for compatibility
CONFIG_BTRFS_FS=m
CONFIG_BTRFS_FS_POSIX_ACL=y
Expand Down Expand Up @@ -116,6 +119,12 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
# Disable SafeSetID LSM
# CONFIG_SECURITY_SAFESETID is not set

# Enable landlock
CONFIG_SECURITY_LANDLOCK=y

# Add landlock to the list of LSMs.
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"

@bcressey bcressey Jul 22, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the upstream default for kernel 6.1: Kconfig.


# enable /proc/config.gz
CONFIG_IKCONFIG=y
CONFIG_IKCONFIG_PROC=y
Expand Down Expand Up @@ -155,6 +164,11 @@ CONFIG_FW_LOADER_COMPRESS=y
# CONFIG_FW_LOADER_COMPRESS_XZ is not set
CONFIG_FW_LOADER_COMPRESS_ZSTD=y

# Prefer LZ4 for zram compression
CONFIG_ZRAM_DEF_COMP="lz4"
CONFIG_ZRAM_DEF_COMP_LZ4=y
# CONFIG_ZRAM_DEF_COMP_LZO is not set

# Add virtio drivers for development setups running as guests in qemu
CONFIG_VIRTIO_CONSOLE=m
CONFIG_HW_RANDOM_VIRTIO=m
Expand Down
10 changes: 5 additions & 5 deletions packages/kernel-6.1/config-full-bottlerocket-aarch64
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2025,12 +2025,12 @@ CONFIG_BLK_DEV_NULL_BLK=m
CONFIG_CDROM=m
# CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set
CONFIG_ZRAM=m
CONFIG_ZRAM_DEF_COMP_LZORLE=y
# CONFIG_ZRAM_DEF_COMP_LZORLE is not set
# CONFIG_ZRAM_DEF_COMP_ZSTD is not set
# CONFIG_ZRAM_DEF_COMP_LZ4 is not set
CONFIG_ZRAM_DEF_COMP_LZ4=y
# CONFIG_ZRAM_DEF_COMP_LZO is not set
# CONFIG_ZRAM_DEF_COMP_LZ4HC is not set
CONFIG_ZRAM_DEF_COMP="lzo-rle"
CONFIG_ZRAM_DEF_COMP="lz4"
# CONFIG_ZRAM_WRITEBACK is not set
# CONFIG_ZRAM_MEMORY_TRACKING is not set
CONFIG_BLK_DEV_LOOP=m
Expand Down Expand Up @@ -5137,7 +5137,7 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
# CONFIG_SECURITY_LANDLOCK is not set
CONFIG_SECURITY_LANDLOCK=y
CONFIG_INTEGRITY=y
CONFIG_INTEGRITY_SIGNATURE=y
CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
Expand All @@ -5150,7 +5150,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_EVM is not set
CONFIG_DEFAULT_SECURITY_SELINUX=y
# CONFIG_DEFAULT_SECURITY_DAC is not set
CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"

#
# Kernel hardening options
Expand Down
10 changes: 5 additions & 5 deletions packages/kernel-6.1/config-full-bottlerocket-x86_64
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1987,12 +1987,12 @@ CONFIG_BLK_DEV_NULL_BLK=m
CONFIG_CDROM=m
# CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set
CONFIG_ZRAM=m
CONFIG_ZRAM_DEF_COMP_LZORLE=y
# CONFIG_ZRAM_DEF_COMP_LZORLE is not set
# CONFIG_ZRAM_DEF_COMP_ZSTD is not set
# CONFIG_ZRAM_DEF_COMP_LZ4 is not set
CONFIG_ZRAM_DEF_COMP_LZ4=y
# CONFIG_ZRAM_DEF_COMP_LZO is not set
# CONFIG_ZRAM_DEF_COMP_LZ4HC is not set
CONFIG_ZRAM_DEF_COMP="lzo-rle"
CONFIG_ZRAM_DEF_COMP="lz4"
# CONFIG_ZRAM_WRITEBACK is not set
# CONFIG_ZRAM_MEMORY_TRACKING is not set
CONFIG_BLK_DEV_LOOP=m
Expand Down Expand Up @@ -5062,7 +5062,7 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
# CONFIG_SECURITY_LANDLOCK is not set
CONFIG_SECURITY_LANDLOCK=y
CONFIG_INTEGRITY=y
CONFIG_INTEGRITY_SIGNATURE=y
CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
Expand All @@ -5075,7 +5075,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_EVM is not set
CONFIG_DEFAULT_SECURITY_SELINUX=y
# CONFIG_DEFAULT_SECURITY_DAC is not set
CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"

#
# Kernel hardening options
Expand Down
4 changes: 4 additions & 0 deletions packages/kernel-6.1/kernel-6.1.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,6 +182,10 @@ Conflicts: %{_cross_os}image-feature(no-fips)
%{summary}.

%prep
%if "%{_cross_arch}" == "aarch64"
%global _cross_kimage vmlinuz.efi
%endif

rpmkeys --import %{S:1} --dbpath "${PWD}/rpmdb"
rpmkeys --checksig %{S:0} --dbpath "${PWD}/rpmdb"
rm -rf "${PWD}/rpmdb"
Expand Down
3 changes: 3 additions & 0 deletions packages/kernel-6.12/config-bottlerocket
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,9 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
# Enable landlock
CONFIG_SECURITY_LANDLOCK=y

# Add landlock to the list of LSMs.
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf"

@bcressey bcressey Jul 22, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the upstream default for kernel 6.12: Kconfig.


# enable /proc/config.gz
CONFIG_IKCONFIG=y
CONFIG_IKCONFIG_PROC=y
Expand Down
2 changes: 1 addition & 1 deletion packages/kernel-6.12/config-full-bottlerocket-aarch64
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5399,7 +5399,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_EVM is not set
CONFIG_DEFAULT_SECURITY_SELINUX=y
# CONFIG_DEFAULT_SECURITY_DAC is not set
CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf"

#
# Kernel hardening options
Expand Down
2 changes: 1 addition & 1 deletion packages/kernel-6.12/config-full-bottlerocket-x86_64
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4960,7 +4960,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_EVM is not set
CONFIG_DEFAULT_SECURITY_SELINUX=y
# CONFIG_DEFAULT_SECURITY_DAC is not set
CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf"

#
# Kernel hardening options
Expand Down