From 4a9ea1cae7c45a84685fdadb80d2d929a6c3330b Mon Sep 17 00:00:00 2001 From: Aelin Date: Mon, 13 Jul 2026 02:11:51 +0200 Subject: [PATCH] linux-postmarketos-mainline: Upgrade to 7.2_rc3 Part-of: --- .../main/linux-postmarketos-mainline/APKBUILD | 21 +++++----- .../config-mainline.aarch64 | 26 ++++++++++-- .../config-mainline.armv7 | 26 ++++++++++-- .../config-mainline.loongarch64 | 26 ++++++++++-- .../config-mainline.ppc64le | 7 ++-- .../config-mainline.riscv64 | 40 ++++++++++++++++--- .../config-mainline.x86 | 27 +++++++++++-- .../config-mainline.x86_64 | 27 +++++++++++-- .../pmos.aarch64.config | 9 ++++- .../pmos.armv7.config | 9 ++++- .../pmos.loongarch64.config | 9 ++++- .../pmos.ppc64le.config | 9 ++++- .../pmos.riscv64.config | 9 ++++- .../pmos.x86.config | 9 ++++- .../pmos.x86_64.config | 9 ++++- 15 files changed, 216 insertions(+), 47 deletions(-) diff --git a/device/main/linux-postmarketos-mainline/APKBUILD b/device/main/linux-postmarketos-mainline/APKBUILD index b01f327b7..2b61eeefb 100644 --- a/device/main/linux-postmarketos-mainline/APKBUILD +++ b/device/main/linux-postmarketos-mainline/APKBUILD @@ -1,7 +1,7 @@ # Co-Maintainer: Achill Gilgenast maintainer="Aelin " pkgname=linux-postmarketos-mainline -pkgver=7.2_rc2 +pkgver=7.2_rc3 pkgrel=0 _rel=${pkgver#*_p} _kver=${pkgver%_p*} @@ -21,6 +21,7 @@ options=" pmb:generic-kernel pmb:kconfigcheck-community pmb:kconfigcheck-immutable + pmb:kconfigcheck-lockdown pmb:kconfigcheck-rust pmb:kconfigcheck-selinux pmb:kconfigcheck-uefi @@ -113,18 +114,18 @@ package() { rm -f "$pkgdir"/usr/lib/modules/*/build "$pkgdir"/usr/lib/modules/*/source install -D "$builddir"/include/config/kernel.release \ - "$pkgdir"/usr/share/kernel/$_flavor/kernel.release + "$pkgdir"/usr/share/kernel/"$_flavor"/kernel.release } sha512sums=" -89042c909cbba5b3c1a084ce4451e6bfcb79e121df6aa2928d7bc6b5da17a403e2706f5c26e705574f17afdcea0a2d6c69799a7984cc69710aad768449aca8d6 linux-postmarketos-mainline-7.2_rc2.tar.gz +3a065b9006efbf42aca12defd9206496581964a7e841f77564d2bf2bea40b0908cca75e00eb229ff9a7405b8da28ac7590f9d2e95d7f2d235120bc7220df4355 linux-postmarketos-mainline-7.2_rc3.tar.gz 1f11df2480e9f691573283597160b4c806e492cdca4825f3acb3afb70bde43abfab487bcde1f5553b431a702a0039479d041b0ce7859970e706b5a51d2ad8fb0 0001-WIP-arch-powerpc-boot-Support-LLVM-1-in-wrapper-scri.patch 302c20c85559fc9b3b2420ed25be1bfbb76c87f2a470e4141c32e9542cf1f5c6b3b5a7847231a3eaa0f6bc0e5942d0c1599e807175dcf5e63469704c3d6adde3 0002-WIP-arch-powerpc-boot-Add-z-norelro.patch -cfde7a2bb7f1d8783cacd78d9c29e03eb3ad96393b4c74ee8d0a067857d70683dbe629993573fb1e8a29dcf5a6c40ae19abc0a2952804cf9f77527916afbff25 config-mainline.aarch64 -1f82fa9358c5265dc666044e5de1623e01348cbc72656027ff397be145df36c32a9381ace4be33db9f97f92a586d318efaa49d8f59b2ab98331db9a422a81764 config-mainline.armv7 -23562f0b02de3441cd0af007d254bb6d04ed027059be64b1969ad1c15e0b1b0aef62c2866c63c35fc573c7871cf3c0c94477c1a23e3bdd5ce51fd698512683e0 config-mainline.loongarch64 -4f9eb4c6153a8ec150892558647e4fc19e893716208fe1156e7395b415ca4977262bf3de7452b42dcde8ba996377ec2035d58a7eedb29359830d251700966af5 config-mainline.ppc64le -0ff70251ca9805f08adb3ad11e76e9d0954244dea5e8e03adc4b29c03d5d6e20fd8f7ec5476d0b3c1c6a40f99b274e36c2d6a5c431e072cc4f92db3905d6c725 config-mainline.riscv64 -0aede005f49a4eec2c59336fee7ca1048d2f3849ed2b3b62a42556be65373d44e87879fa8c4ae49933b7fbcd2851ab53f0052364f30eb610c87b83849ab9cfa5 config-mainline.x86 -73672c59062e370ed455dd14b0c0736dc28613e7cf61769d52e3daabc7e3d6a1f85aa543a0dc4db7618d299948adadf0a173dddd6166594b76c42715ff46fcf2 config-mainline.x86_64 +720d681f4a0bb7430c89b3e1c7c061ef722dc636000cdb9b2bc1b4af9108a4ee4473ca8a1fad759c423a3fc7a3f1104031f24881092fdf3d535340e9a7a0e94b config-mainline.aarch64 +62459d6c6acd2fa0e2328d1767998f86a4c06f53faff6bdd7f7ce133fae2311e1b18517283de2eb7cc32d1abb009a7decc795f850b26f84667aa7392175225c9 config-mainline.armv7 +d31008935161f660e367a27bdf72643e3380ddb7f7045f8ee2c08116a6872ff44df3247285bc211c039b306035bea4eacd4547ce732444b5a2e144f0d9f550cf config-mainline.loongarch64 +a6dc8df8802cf1d177ba88889a26fcf4c507d4d45eb7eefa8bf50a854d30d445cbd68b519b3463e9d674663b9ede20d5dca1e82ebf32fdf91b8e06c5cd6eb62a config-mainline.ppc64le +8cb2ec930181f915dbb3953ae941afa1af6783e56c551c7bcade4415f8a2ee0f7a177d42abad59ac45e6a8c17be30e6f55ae0383fcf02c331827d53546bf9c82 config-mainline.riscv64 +5eaf5a87a6c0075b69f40dba6614d611730eadf9557d3bb0bc8df52b4de9c61fc17f8825dfa5b41852b5614476cf927eb052e61744224c406332b4e4dc8688fa config-mainline.x86 +f7fb6c031bf858e80146db516daf1d3ecfea755bedbeb866fe669a51657525a217e2d5db18b0c18ae219d1a299ecfa27dc9d0cb4db84cca3eaa2e23ae543082c config-mainline.x86_64 " diff --git a/device/main/linux-postmarketos-mainline/config-mainline.aarch64 b/device/main/linux-postmarketos-mainline/config-mainline.aarch64 index c9eda9a11..3f3c82011 100644 --- a/device/main/linux-postmarketos-mainline/config-mainline.aarch64 +++ b/device/main/linux-postmarketos-mainline/config-mainline.aarch64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 7.2.0-rc2 Kernel Configuration +# Linux/arm64 7.2.0-rc3 Kernel Configuration # CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.8" CONFIG_GCC_VERSION=0 @@ -975,6 +975,7 @@ CONFIG_HAVE_ARCH_GET_SECUREBOOT=y # end of General architecture-dependent options CONFIG_RT_MUTEXES=y +CONFIG_MODULE_SIG_FORMAT=y CONFIG_MODULES=y # CONFIG_MODULE_DEBUG is not set # CONFIG_MODULE_FORCE_LOAD is not set @@ -983,7 +984,16 @@ CONFIG_MODULE_UNLOAD=y # CONFIG_MODULE_UNLOAD_TAINT_TRACKING is not set # CONFIG_MODVERSIONS is not set # CONFIG_MODULE_SRCVERSION_ALL is not set -# CONFIG_MODULE_SIG is not set +CONFIG_MODULE_SIG=y +# CONFIG_MODULE_SIG_FORCE is not set +CONFIG_MODULE_SIG_ALL=y +# CONFIG_MODULE_SIG_SHA256 is not set +# CONFIG_MODULE_SIG_SHA384 is not set +CONFIG_MODULE_SIG_SHA512=y +# CONFIG_MODULE_SIG_SHA3_256 is not set +# CONFIG_MODULE_SIG_SHA3_384 is not set +# CONFIG_MODULE_SIG_SHA3_512 is not set +CONFIG_MODULE_SIG_HASH="sha512" CONFIG_MODULE_COMPRESS=y # CONFIG_MODULE_COMPRESS_GZIP is not set # CONFIG_MODULE_COMPRESS_XZ is not set @@ -11762,7 +11772,11 @@ CONFIG_SECURITY_SELINUX_AVC_HASH_BITS=9 # CONFIG_SECURITY_LOADPIN is not set CONFIG_SECURITY_YAMA=y # CONFIG_SECURITY_SAFESETID is not set -# CONFIG_SECURITY_LOCKDOWN_LSM is not set +CONFIG_SECURITY_LOCKDOWN_LSM=y +CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y +# CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE is not set +CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY=y +# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set # CONFIG_SECURITY_LANDLOCK is not set # CONFIG_SECURITY_IPE is not set CONFIG_INTEGRITY=y @@ -12079,6 +12093,12 @@ CONFIG_PKCS7_MESSAGE_PARSER=y # # Certificates for signature checking # +CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" +CONFIG_MODULE_SIG_KEY_TYPE_RSA=y +# CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_44 is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_65 is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_87 is not set CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_SYSTEM_TRUSTED_KEYS="" # CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set diff --git a/device/main/linux-postmarketos-mainline/config-mainline.armv7 b/device/main/linux-postmarketos-mainline/config-mainline.armv7 index 3c92fc6df..72a21012f 100644 --- a/device/main/linux-postmarketos-mainline/config-mainline.armv7 +++ b/device/main/linux-postmarketos-mainline/config-mainline.armv7 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 7.2.0-rc2 Kernel Configuration +# Linux/arm 7.2.0-rc3 Kernel Configuration # CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.8" CONFIG_GCC_VERSION=0 @@ -988,6 +988,7 @@ CONFIG_HAVE_ARCH_GET_SECUREBOOT=y # end of General architecture-dependent options CONFIG_RT_MUTEXES=y +CONFIG_MODULE_SIG_FORMAT=y CONFIG_MODULES=y # CONFIG_MODULE_DEBUG is not set # CONFIG_MODULE_FORCE_LOAD is not set @@ -996,7 +997,16 @@ CONFIG_MODULE_UNLOAD=y # CONFIG_MODULE_UNLOAD_TAINT_TRACKING is not set # CONFIG_MODVERSIONS is not set # CONFIG_MODULE_SRCVERSION_ALL is not set -# CONFIG_MODULE_SIG is not set +CONFIG_MODULE_SIG=y +# CONFIG_MODULE_SIG_FORCE is not set +CONFIG_MODULE_SIG_ALL=y +# CONFIG_MODULE_SIG_SHA256 is not set +# CONFIG_MODULE_SIG_SHA384 is not set +CONFIG_MODULE_SIG_SHA512=y +# CONFIG_MODULE_SIG_SHA3_256 is not set +# CONFIG_MODULE_SIG_SHA3_384 is not set +# CONFIG_MODULE_SIG_SHA3_512 is not set +CONFIG_MODULE_SIG_HASH="sha512" CONFIG_MODULE_COMPRESS=y # CONFIG_MODULE_COMPRESS_GZIP is not set # CONFIG_MODULE_COMPRESS_XZ is not set @@ -11127,7 +11137,11 @@ CONFIG_SECURITY_SELINUX_AVC_HASH_BITS=9 # CONFIG_SECURITY_LOADPIN is not set CONFIG_SECURITY_YAMA=y # CONFIG_SECURITY_SAFESETID is not set -# CONFIG_SECURITY_LOCKDOWN_LSM is not set +CONFIG_SECURITY_LOCKDOWN_LSM=y +CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y +# CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE is not set +CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY=y +# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set # CONFIG_SECURITY_LANDLOCK is not set # CONFIG_SECURITY_IPE is not set CONFIG_INTEGRITY=y @@ -11417,6 +11431,12 @@ CONFIG_PKCS7_MESSAGE_PARSER=y # # Certificates for signature checking # +CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" +CONFIG_MODULE_SIG_KEY_TYPE_RSA=y +# CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_44 is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_65 is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_87 is not set CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_SYSTEM_TRUSTED_KEYS="" # CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set diff --git a/device/main/linux-postmarketos-mainline/config-mainline.loongarch64 b/device/main/linux-postmarketos-mainline/config-mainline.loongarch64 index bd320323a..b344d2cff 100644 --- a/device/main/linux-postmarketos-mainline/config-mainline.loongarch64 +++ b/device/main/linux-postmarketos-mainline/config-mainline.loongarch64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/loongarch 7.2.0-rc2 Kernel Configuration +# Linux/loongarch 7.2.0-rc3 Kernel Configuration # CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.8" CONFIG_GCC_VERSION=0 @@ -641,6 +641,7 @@ CONFIG_HAVE_ARCH_GET_SECUREBOOT=y # end of General architecture-dependent options CONFIG_RT_MUTEXES=y +CONFIG_MODULE_SIG_FORMAT=y CONFIG_MODULES=y # CONFIG_MODULE_DEBUG is not set CONFIG_MODULE_FORCE_LOAD=y @@ -649,7 +650,16 @@ CONFIG_MODULE_FORCE_UNLOAD=y # CONFIG_MODULE_UNLOAD_TAINT_TRACKING is not set # CONFIG_MODVERSIONS is not set # CONFIG_MODULE_SRCVERSION_ALL is not set -# CONFIG_MODULE_SIG is not set +CONFIG_MODULE_SIG=y +# CONFIG_MODULE_SIG_FORCE is not set +CONFIG_MODULE_SIG_ALL=y +# CONFIG_MODULE_SIG_SHA256 is not set +# CONFIG_MODULE_SIG_SHA384 is not set +CONFIG_MODULE_SIG_SHA512=y +# CONFIG_MODULE_SIG_SHA3_256 is not set +# CONFIG_MODULE_SIG_SHA3_384 is not set +# CONFIG_MODULE_SIG_SHA3_512 is not set +CONFIG_MODULE_SIG_HASH="sha512" CONFIG_MODULE_COMPRESS=y # CONFIG_MODULE_COMPRESS_GZIP is not set # CONFIG_MODULE_COMPRESS_XZ is not set @@ -8310,7 +8320,11 @@ CONFIG_SECURITY_APPARMOR_PARANOID_LOAD=y # CONFIG_SECURITY_LOADPIN is not set CONFIG_SECURITY_YAMA=y # CONFIG_SECURITY_SAFESETID is not set -# CONFIG_SECURITY_LOCKDOWN_LSM is not set +CONFIG_SECURITY_LOCKDOWN_LSM=y +CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y +# CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE is not set +CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY=y +# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set # CONFIG_SECURITY_LANDLOCK is not set # CONFIG_SECURITY_IPE is not set CONFIG_INTEGRITY=y @@ -8554,6 +8568,12 @@ CONFIG_PKCS7_MESSAGE_PARSER=y # # Certificates for signature checking # +CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" +CONFIG_MODULE_SIG_KEY_TYPE_RSA=y +# CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_44 is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_65 is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_87 is not set CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_SYSTEM_TRUSTED_KEYS="" # CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set diff --git a/device/main/linux-postmarketos-mainline/config-mainline.ppc64le b/device/main/linux-postmarketos-mainline/config-mainline.ppc64le index 111c353a9..a1ee1bdbc 100644 --- a/device/main/linux-postmarketos-mainline/config-mainline.ppc64le +++ b/device/main/linux-postmarketos-mainline/config-mainline.ppc64le @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/powerpc 7.2.0-rc2 Kernel Configuration +# Linux/powerpc 7.2.0-rc3 Kernel Configuration # CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.8" CONFIG_GCC_VERSION=0 @@ -2533,6 +2533,7 @@ CONFIG_OF_MDIO=y # CONFIG_MDIO_BCM_UNIMAC is not set # CONFIG_MDIO_HISI_FEMAC is not set # CONFIG_MDIO_MVUSB is not set +# CONFIG_MDIO_MSCC_MIIM is not set # CONFIG_MDIO_OCTEON is not set # CONFIG_MDIO_IPQ4019 is not set # CONFIG_MDIO_THUNDER is not set @@ -7279,8 +7280,8 @@ CONFIG_SECURITY_YAMA=y # CONFIG_SECURITY_SAFESETID is not set CONFIG_SECURITY_LOCKDOWN_LSM=y CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y -CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y -# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set +# CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE is not set +CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY=y # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set CONFIG_SECURITY_LANDLOCK=y # CONFIG_SECURITY_IPE is not set diff --git a/device/main/linux-postmarketos-mainline/config-mainline.riscv64 b/device/main/linux-postmarketos-mainline/config-mainline.riscv64 index 6a7a6d436..e7b293c26 100644 --- a/device/main/linux-postmarketos-mainline/config-mainline.riscv64 +++ b/device/main/linux-postmarketos-mainline/config-mainline.riscv64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/riscv 7.2.0-rc2 Kernel Configuration +# Linux/riscv 7.2.0-rc3 Kernel Configuration # CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.8" CONFIG_GCC_VERSION=0 @@ -281,6 +281,7 @@ CONFIG_PERF_EVENTS=y # CONFIG_DEBUG_PERF_USE_VMALLOC is not set # end of Kernel Performance Events And Counters +CONFIG_SYSTEM_DATA_VERIFICATION=y CONFIG_PROFILING=y CONFIG_TRACEPOINTS=y @@ -344,6 +345,7 @@ CONFIG_SOC_STARFIVE=y CONFIG_ARCH_SUNXI=y CONFIG_ARCH_TENSTORRENT=y CONFIG_ARCH_THEAD=y +CONFIG_ARCH_ULTRARISC=y CONFIG_ARCH_VIRT=y CONFIG_ARCH_CANAAN=y # end of SoC selection @@ -754,6 +756,7 @@ CONFIG_HAVE_ARCH_GET_SECUREBOOT=y # end of General architecture-dependent options CONFIG_RT_MUTEXES=y +CONFIG_MODULE_SIG_FORMAT=y CONFIG_MODULES=y # CONFIG_MODULE_DEBUG is not set # CONFIG_MODULE_FORCE_LOAD is not set @@ -762,7 +765,16 @@ CONFIG_MODULE_UNLOAD=y # CONFIG_MODULE_UNLOAD_TAINT_TRACKING is not set # CONFIG_MODVERSIONS is not set # CONFIG_MODULE_SRCVERSION_ALL is not set -# CONFIG_MODULE_SIG is not set +CONFIG_MODULE_SIG=y +# CONFIG_MODULE_SIG_FORCE is not set +CONFIG_MODULE_SIG_ALL=y +# CONFIG_MODULE_SIG_SHA256 is not set +# CONFIG_MODULE_SIG_SHA384 is not set +CONFIG_MODULE_SIG_SHA512=y +# CONFIG_MODULE_SIG_SHA3_256 is not set +# CONFIG_MODULE_SIG_SHA3_384 is not set +# CONFIG_MODULE_SIG_SHA3_512 is not set +CONFIG_MODULE_SIG_HASH="sha512" CONFIG_MODULE_COMPRESS=y # CONFIG_MODULE_COMPRESS_GZIP is not set # CONFIG_MODULE_COMPRESS_XZ is not set @@ -1575,6 +1587,7 @@ CONFIG_PCIE_DW_HOST=y CONFIG_PCIE_FU740=y # CONFIG_PCIE_SOPHGO_DW is not set CONFIG_PCIE_SPACEMIT_K1=y +CONFIG_PCIE_ULTRARISC=y # end of DesignWare-based PCIe controllers # @@ -3300,6 +3313,8 @@ CONFIG_PINCTRL_SUN20I_D1=y # CONFIG_PINCTRL_SUN50I_H616_R is not set # CONFIG_PINCTRL_SUN55I_A523 is not set # CONFIG_PINCTRL_SUN55I_A523_R is not set +CONFIG_PINCTRL_ULTRARISC=y +CONFIG_PINCTRL_ULTRARISC_DP1000=y CONFIG_GPIOLIB_LEGACY=y CONFIG_GPIOLIB=y CONFIG_GPIOLIB_FASTPATH_LIMIT=512 @@ -7700,7 +7715,11 @@ CONFIG_SECURITY_APPARMOR_PARANOID_LOAD=y # CONFIG_SECURITY_LOADPIN is not set CONFIG_SECURITY_YAMA=y # CONFIG_SECURITY_SAFESETID is not set -# CONFIG_SECURITY_LOCKDOWN_LSM is not set +CONFIG_SECURITY_LOCKDOWN_LSM=y +CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y +# CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE is not set +CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY=y +# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set # CONFIG_SECURITY_LANDLOCK is not set # CONFIG_SECURITY_IPE is not set CONFIG_INTEGRITY=y @@ -7788,7 +7807,7 @@ CONFIG_CRYPTO_ENGINE=m # # Public-key cryptography # -CONFIG_CRYPTO_RSA=m +CONFIG_CRYPTO_RSA=y CONFIG_CRYPTO_DH=y # CONFIG_CRYPTO_DH_RFC7919_GROUPS is not set CONFIG_CRYPTO_ECC=m @@ -7933,12 +7952,23 @@ CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y CONFIG_X509_CERTIFICATE_PARSER=y CONFIG_PKCS8_PRIVATE_KEY_PARSER=m CONFIG_PKCS7_MESSAGE_PARSER=y +# CONFIG_PKCS7_TEST_KEY is not set +# CONFIG_SIGNED_PE_FILE_VERIFICATION is not set # CONFIG_FIPS_SIGNATURE_SELFTEST is not set # # Certificates for signature checking # -# CONFIG_SYSTEM_TRUSTED_KEYRING is not set +CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" +CONFIG_MODULE_SIG_KEY_TYPE_RSA=y +# CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_44 is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_65 is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_87 is not set +CONFIG_SYSTEM_TRUSTED_KEYRING=y +CONFIG_SYSTEM_TRUSTED_KEYS="" +# CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set +# CONFIG_SECONDARY_TRUSTED_KEYRING is not set # CONFIG_SYSTEM_BLACKLIST_KEYRING is not set CONFIG_OPENSSL_SUPPORTS_ML_DSA=y # end of Certificates for signature checking diff --git a/device/main/linux-postmarketos-mainline/config-mainline.x86 b/device/main/linux-postmarketos-mainline/config-mainline.x86 index 3b1a00bfc..28d220a1a 100644 --- a/device/main/linux-postmarketos-mainline/config-mainline.x86 +++ b/device/main/linux-postmarketos-mainline/config-mainline.x86 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/i386 7.2.0-rc2 Kernel Configuration +# Linux/i386 7.2.0-rc3 Kernel Configuration # CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.8" CONFIG_GCC_VERSION=0 @@ -869,6 +869,7 @@ CONFIG_HAVE_ARCH_GET_SECUREBOOT=y # end of General architecture-dependent options CONFIG_RT_MUTEXES=y +CONFIG_MODULE_SIG_FORMAT=y CONFIG_MODULES=y # CONFIG_MODULE_DEBUG is not set # CONFIG_MODULE_FORCE_LOAD is not set @@ -877,7 +878,16 @@ CONFIG_MODULE_FORCE_UNLOAD=y # CONFIG_MODULE_UNLOAD_TAINT_TRACKING is not set # CONFIG_MODVERSIONS is not set # CONFIG_MODULE_SRCVERSION_ALL is not set -# CONFIG_MODULE_SIG is not set +CONFIG_MODULE_SIG=y +# CONFIG_MODULE_SIG_FORCE is not set +CONFIG_MODULE_SIG_ALL=y +# CONFIG_MODULE_SIG_SHA256 is not set +# CONFIG_MODULE_SIG_SHA384 is not set +CONFIG_MODULE_SIG_SHA512=y +# CONFIG_MODULE_SIG_SHA3_256 is not set +# CONFIG_MODULE_SIG_SHA3_384 is not set +# CONFIG_MODULE_SIG_SHA3_512 is not set +CONFIG_MODULE_SIG_HASH="sha512" CONFIG_MODULE_COMPRESS=y # CONFIG_MODULE_COMPRESS_GZIP is not set # CONFIG_MODULE_COMPRESS_XZ is not set @@ -2579,6 +2589,7 @@ CONFIG_ACPI_MDIO=y # CONFIG_MDIO_BITBANG is not set # CONFIG_MDIO_BCM_UNIMAC is not set # CONFIG_MDIO_MVUSB is not set +# CONFIG_MDIO_MSCC_MIIM is not set # # MDIO Multiplexers @@ -7526,7 +7537,11 @@ CONFIG_SECURITY_SELINUX_AVC_HASH_BITS=9 # CONFIG_SECURITY_LOADPIN is not set CONFIG_SECURITY_YAMA=y # CONFIG_SECURITY_SAFESETID is not set -# CONFIG_SECURITY_LOCKDOWN_LSM is not set +CONFIG_SECURITY_LOCKDOWN_LSM=y +CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y +# CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE is not set +CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY=y +# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set # CONFIG_SECURITY_LANDLOCK is not set # CONFIG_SECURITY_IPE is not set CONFIG_INTEGRITY=y @@ -7770,6 +7785,12 @@ CONFIG_PKCS7_MESSAGE_PARSER=y # # Certificates for signature checking # +CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" +CONFIG_MODULE_SIG_KEY_TYPE_RSA=y +# CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_44 is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_65 is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_87 is not set CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_SYSTEM_TRUSTED_KEYS="" # CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set diff --git a/device/main/linux-postmarketos-mainline/config-mainline.x86_64 b/device/main/linux-postmarketos-mainline/config-mainline.x86_64 index c8cabff45..e77145e69 100644 --- a/device/main/linux-postmarketos-mainline/config-mainline.x86_64 +++ b/device/main/linux-postmarketos-mainline/config-mainline.x86_64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86_64 7.2.0-rc2 Kernel Configuration +# Linux/x86_64 7.2.0-rc3 Kernel Configuration # CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.8" CONFIG_GCC_VERSION=0 @@ -955,6 +955,7 @@ CONFIG_HAVE_ARCH_GET_SECUREBOOT=y # end of General architecture-dependent options CONFIG_RT_MUTEXES=y +CONFIG_MODULE_SIG_FORMAT=y CONFIG_MODULES=y # CONFIG_MODULE_DEBUG is not set # CONFIG_MODULE_FORCE_LOAD is not set @@ -963,7 +964,16 @@ CONFIG_MODULE_FORCE_UNLOAD=y # CONFIG_MODULE_UNLOAD_TAINT_TRACKING is not set # CONFIG_MODVERSIONS is not set # CONFIG_MODULE_SRCVERSION_ALL is not set -# CONFIG_MODULE_SIG is not set +CONFIG_MODULE_SIG=y +# CONFIG_MODULE_SIG_FORCE is not set +CONFIG_MODULE_SIG_ALL=y +# CONFIG_MODULE_SIG_SHA256 is not set +# CONFIG_MODULE_SIG_SHA384 is not set +CONFIG_MODULE_SIG_SHA512=y +# CONFIG_MODULE_SIG_SHA3_256 is not set +# CONFIG_MODULE_SIG_SHA3_384 is not set +# CONFIG_MODULE_SIG_SHA3_512 is not set +CONFIG_MODULE_SIG_HASH="sha512" CONFIG_MODULE_COMPRESS=y # CONFIG_MODULE_COMPRESS_GZIP is not set # CONFIG_MODULE_COMPRESS_XZ is not set @@ -2710,6 +2720,7 @@ CONFIG_ACPI_MDIO=y # CONFIG_MDIO_BITBANG is not set # CONFIG_MDIO_BCM_UNIMAC is not set # CONFIG_MDIO_MVUSB is not set +# CONFIG_MDIO_MSCC_MIIM is not set # CONFIG_MDIO_THUNDER is not set # @@ -7717,7 +7728,11 @@ CONFIG_SECURITY_SELINUX_AVC_HASH_BITS=9 # CONFIG_SECURITY_LOADPIN is not set CONFIG_SECURITY_YAMA=y # CONFIG_SECURITY_SAFESETID is not set -# CONFIG_SECURITY_LOCKDOWN_LSM is not set +CONFIG_SECURITY_LOCKDOWN_LSM=y +CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y +# CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE is not set +CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY=y +# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set # CONFIG_SECURITY_LANDLOCK is not set # CONFIG_SECURITY_IPE is not set CONFIG_INTEGRITY=y @@ -7977,6 +7992,12 @@ CONFIG_PKCS7_MESSAGE_PARSER=y # # Certificates for signature checking # +CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" +CONFIG_MODULE_SIG_KEY_TYPE_RSA=y +# CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_44 is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_65 is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_87 is not set CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_SYSTEM_TRUSTED_KEYS="" # CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set diff --git a/device/main/linux-postmarketos-mainline/pmos.aarch64.config b/device/main/linux-postmarketos-mainline/pmos.aarch64.config index 2b38417d8..25658d28e 100644 --- a/device/main/linux-postmarketos-mainline/pmos.aarch64.config +++ b/device/main/linux-postmarketos-mainline/pmos.aarch64.config @@ -57,7 +57,6 @@ CONFIG_CRYPTO_CAMELLIA=m CONFIG_CRYPTO_CMAC=m CONFIG_CRYPTO_CTS=y CONFIG_CRYPTO_HMAC=y -CONFIG_CRYPTO_KRB5=m CONFIG_CRYPTO_SHA256=y CONFIG_CRYPTO_SHA512=y CONFIG_FSCACHE=y @@ -75,6 +74,7 @@ CONFIG_NFS_V4=m CONFIG_NFS_V4_2=y CONFIG_RPCSEC_GSS_KRB5=m CONFIG_CRYPTO_AES_ARM64_CE_BLK=y +CONFIG_CRYPTO_KRB5=m # accessibility CONFIG_A11Y_BRAILLE_CONSOLE=y @@ -498,7 +498,10 @@ CONFIG_EFIVAR_FS=m CONFIG_DM_VERITY=m # hardening +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" CONFIG_SECURITY_DMESG_RESTRICT=y +CONFIG_SECURITY_LOCKDOWN_LSM=y +CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y CONFIG_SECURITY_YAMA=y CONFIG_SHADOW_CALL_STACK=y CONFIG_CFI=y @@ -512,10 +515,12 @@ CONFIG_RUST=y # selinux CONFIG_AUDIT=y CONFIG_DEFAULT_SECURITY_SELINUX=y -CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" CONFIG_SECURITY_NETWORK=y CONFIG_SECURITY_SELINUX=y CONFIG_SECURITY_SELINUX_BOOTPARAM=y +# lockdown +CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY=y + # wine CONFIG_NTSYNC=m diff --git a/device/main/linux-postmarketos-mainline/pmos.armv7.config b/device/main/linux-postmarketos-mainline/pmos.armv7.config index 9cc8db1cb..81f931e7e 100644 --- a/device/main/linux-postmarketos-mainline/pmos.armv7.config +++ b/device/main/linux-postmarketos-mainline/pmos.armv7.config @@ -57,7 +57,6 @@ CONFIG_CRYPTO_CAMELLIA=m CONFIG_CRYPTO_CMAC=m CONFIG_CRYPTO_CTS=y CONFIG_CRYPTO_HMAC=y -CONFIG_CRYPTO_KRB5=m CONFIG_CRYPTO_SHA256=y CONFIG_CRYPTO_SHA512=y CONFIG_FSCACHE=y @@ -74,6 +73,7 @@ CONFIG_NFS_V3=m CONFIG_NFS_V4=m CONFIG_NFS_V4_2=y CONFIG_RPCSEC_GSS_KRB5=m +CONFIG_CRYPTO_KRB5=m # accessibility CONFIG_A11Y_BRAILLE_CONSOLE=y @@ -493,7 +493,10 @@ CONFIG_EFIVAR_FS=m CONFIG_DM_VERITY=m # hardening +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" CONFIG_SECURITY_DMESG_RESTRICT=y +CONFIG_SECURITY_LOCKDOWN_LSM=y +CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y CONFIG_SECURITY_YAMA=y CONFIG_CFI=y # CONFIG_CFI_PERMISSIVE is not set @@ -502,10 +505,12 @@ CONFIG_CFI_ICALL_NORMALIZE_INTEGERS=y # selinux CONFIG_AUDIT=y CONFIG_DEFAULT_SECURITY_SELINUX=y -CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" CONFIG_SECURITY_NETWORK=y CONFIG_SECURITY_SELINUX=y CONFIG_SECURITY_SELINUX_BOOTPARAM=y +# lockdown +CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY=y + # wine CONFIG_NTSYNC=m diff --git a/device/main/linux-postmarketos-mainline/pmos.loongarch64.config b/device/main/linux-postmarketos-mainline/pmos.loongarch64.config index ffb591d8b..8a8f5e584 100644 --- a/device/main/linux-postmarketos-mainline/pmos.loongarch64.config +++ b/device/main/linux-postmarketos-mainline/pmos.loongarch64.config @@ -58,7 +58,6 @@ CONFIG_CRYPTO_CAMELLIA=m CONFIG_CRYPTO_CMAC=m CONFIG_CRYPTO_CTS=y CONFIG_CRYPTO_HMAC=y -CONFIG_CRYPTO_KRB5=m CONFIG_CRYPTO_SHA256=y CONFIG_CRYPTO_SHA512=y CONFIG_FSCACHE=y @@ -75,6 +74,7 @@ CONFIG_NFS_V3=m CONFIG_NFS_V4=m CONFIG_NFS_V4_2=y CONFIG_RPCSEC_GSS_KRB5=m +CONFIG_CRYPTO_KRB5=m # accessibility CONFIG_A11Y_BRAILLE_CONSOLE=y @@ -494,7 +494,10 @@ CONFIG_EFIVAR_FS=m CONFIG_DM_VERITY=m # hardening +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" CONFIG_SECURITY_DMESG_RESTRICT=y +CONFIG_SECURITY_LOCKDOWN_LSM=y +CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y CONFIG_SECURITY_YAMA=y # rust @@ -504,10 +507,12 @@ CONFIG_RUST=y # selinux CONFIG_AUDIT=y CONFIG_DEFAULT_SECURITY_SELINUX=y -CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" CONFIG_SECURITY_NETWORK=y CONFIG_SECURITY_SELINUX=y CONFIG_SECURITY_SELINUX_BOOTPARAM=y +# lockdown +CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY=y + # wine CONFIG_NTSYNC=m diff --git a/device/main/linux-postmarketos-mainline/pmos.ppc64le.config b/device/main/linux-postmarketos-mainline/pmos.ppc64le.config index 6efd05795..e49ff0750 100644 --- a/device/main/linux-postmarketos-mainline/pmos.ppc64le.config +++ b/device/main/linux-postmarketos-mainline/pmos.ppc64le.config @@ -58,7 +58,6 @@ CONFIG_CRYPTO_CAMELLIA=m CONFIG_CRYPTO_CMAC=m CONFIG_CRYPTO_CTS=y CONFIG_CRYPTO_HMAC=y -CONFIG_CRYPTO_KRB5=m CONFIG_CRYPTO_SHA256=y CONFIG_CRYPTO_SHA512=y CONFIG_FSCACHE=y @@ -75,6 +74,7 @@ CONFIG_NFS_V3=m CONFIG_NFS_V4=m CONFIG_NFS_V4_2=y CONFIG_RPCSEC_GSS_KRB5=m +CONFIG_CRYPTO_KRB5=m # accessibility CONFIG_A11Y_BRAILLE_CONSOLE=y @@ -484,16 +484,21 @@ CONFIG_FUNCTION_TRACER=y CONFIG_DM_VERITY=m # hardening +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" CONFIG_SECURITY_DMESG_RESTRICT=y +CONFIG_SECURITY_LOCKDOWN_LSM=y +CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y CONFIG_SECURITY_YAMA=y # selinux CONFIG_AUDIT=y CONFIG_DEFAULT_SECURITY_SELINUX=y -CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" CONFIG_SECURITY_NETWORK=y CONFIG_SECURITY_SELINUX=y CONFIG_SECURITY_SELINUX_BOOTPARAM=y +# lockdown +CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY=y + # wine CONFIG_NTSYNC=m diff --git a/device/main/linux-postmarketos-mainline/pmos.riscv64.config b/device/main/linux-postmarketos-mainline/pmos.riscv64.config index 372b44ccc..e14c757ce 100644 --- a/device/main/linux-postmarketos-mainline/pmos.riscv64.config +++ b/device/main/linux-postmarketos-mainline/pmos.riscv64.config @@ -57,7 +57,6 @@ CONFIG_CRYPTO_CAMELLIA=m CONFIG_CRYPTO_CMAC=m CONFIG_CRYPTO_CTS=y CONFIG_CRYPTO_HMAC=y -CONFIG_CRYPTO_KRB5=m CONFIG_CRYPTO_SHA256=y CONFIG_CRYPTO_SHA512=y CONFIG_FSCACHE=y @@ -74,6 +73,7 @@ CONFIG_NFS_V3=m CONFIG_NFS_V4=m CONFIG_NFS_V4_2=y CONFIG_RPCSEC_GSS_KRB5=m +CONFIG_CRYPTO_KRB5=m # accessibility CONFIG_A11Y_BRAILLE_CONSOLE=y @@ -494,7 +494,10 @@ CONFIG_EFIVAR_FS=m CONFIG_DM_VERITY=m # hardening +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" CONFIG_SECURITY_DMESG_RESTRICT=y +CONFIG_SECURITY_LOCKDOWN_LSM=y +CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y CONFIG_SECURITY_YAMA=y CONFIG_CFI=y # CONFIG_CFI_PERMISSIVE is not set @@ -504,10 +507,12 @@ CONFIG_SHADOW_CALL_STACK=y # selinux CONFIG_AUDIT=y CONFIG_DEFAULT_SECURITY_SELINUX=y -CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" CONFIG_SECURITY_NETWORK=y CONFIG_SECURITY_SELINUX=y CONFIG_SECURITY_SELINUX_BOOTPARAM=y +# lockdown +CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY=y + # wine CONFIG_NTSYNC=m diff --git a/device/main/linux-postmarketos-mainline/pmos.x86.config b/device/main/linux-postmarketos-mainline/pmos.x86.config index 1a6f3c15e..76ee0cb5d 100644 --- a/device/main/linux-postmarketos-mainline/pmos.x86.config +++ b/device/main/linux-postmarketos-mainline/pmos.x86.config @@ -58,7 +58,6 @@ CONFIG_CRYPTO_CAMELLIA=m CONFIG_CRYPTO_CMAC=m CONFIG_CRYPTO_CTS=y CONFIG_CRYPTO_HMAC=y -CONFIG_CRYPTO_KRB5=m CONFIG_CRYPTO_SHA256=y CONFIG_CRYPTO_SHA512=y CONFIG_FSCACHE=y @@ -75,6 +74,7 @@ CONFIG_NFS_V3=m CONFIG_NFS_V4=m CONFIG_NFS_V4_2=y CONFIG_RPCSEC_GSS_KRB5=m +CONFIG_CRYPTO_KRB5=m # accessibility CONFIG_A11Y_BRAILLE_CONSOLE=y @@ -497,16 +497,21 @@ CONFIG_EFIVAR_FS=m CONFIG_DM_VERITY=m # hardening +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" CONFIG_SECURITY_DMESG_RESTRICT=y +CONFIG_SECURITY_LOCKDOWN_LSM=y +CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y CONFIG_SECURITY_YAMA=y # selinux CONFIG_AUDIT=y CONFIG_DEFAULT_SECURITY_SELINUX=y -CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" CONFIG_SECURITY_NETWORK=y CONFIG_SECURITY_SELINUX=y CONFIG_SECURITY_SELINUX_BOOTPARAM=y +# lockdown +CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY=y + # wine CONFIG_NTSYNC=m diff --git a/device/main/linux-postmarketos-mainline/pmos.x86_64.config b/device/main/linux-postmarketos-mainline/pmos.x86_64.config index c6d434f6f..329dd2995 100644 --- a/device/main/linux-postmarketos-mainline/pmos.x86_64.config +++ b/device/main/linux-postmarketos-mainline/pmos.x86_64.config @@ -58,7 +58,6 @@ CONFIG_CRYPTO_CAMELLIA=m CONFIG_CRYPTO_CMAC=m CONFIG_CRYPTO_CTS=y CONFIG_CRYPTO_HMAC=y -CONFIG_CRYPTO_KRB5=m CONFIG_CRYPTO_SHA256=y CONFIG_CRYPTO_SHA512=y CONFIG_FSCACHE=y @@ -75,6 +74,7 @@ CONFIG_NFS_V3=m CONFIG_NFS_V4=m CONFIG_NFS_V4_2=y CONFIG_RPCSEC_GSS_KRB5=m +CONFIG_CRYPTO_KRB5=m # accessibility CONFIG_A11Y_BRAILLE_CONSOLE=y @@ -499,7 +499,10 @@ CONFIG_EFIVAR_FS=m CONFIG_DM_VERITY=m # hardening +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" CONFIG_SECURITY_DMESG_RESTRICT=y +CONFIG_SECURITY_LOCKDOWN_LSM=y +CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y CONFIG_SECURITY_YAMA=y CONFIG_CFI=y # CONFIG_CFI_PERMISSIVE is not set @@ -512,10 +515,12 @@ CONFIG_RUST=y # selinux CONFIG_AUDIT=y CONFIG_DEFAULT_SECURITY_SELINUX=y -CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" CONFIG_SECURITY_NETWORK=y CONFIG_SECURITY_SELINUX=y CONFIG_SECURITY_SELINUX_BOOTPARAM=y +# lockdown +CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY=y + # wine CONFIG_NTSYNC=m