From 817cfa8d367f79d5eb8b046200a85ffdab3da2c9 Mon Sep 17 00:00:00 2001 From: adamthiede Date: Tue, 26 May 2026 06:13:06 -0500 Subject: [PATCH] linux-postmarketos-mediatek-mt8173: upgrade to 7.0.10 - enabled 'yama' for pmos kconfig checks - enabled 'lockdown' since it's similar, and options are good Part-of: --- .../APKBUILD | 6 ++-- ...onfig-postmarketos-mediatek-mt8173.aarch64 | 30 +++++++++++++++---- 2 files changed, 27 insertions(+), 9 deletions(-) diff --git a/device/community/linux-postmarketos-mediatek-mt8173/APKBUILD b/device/community/linux-postmarketos-mediatek-mt8173/APKBUILD index 45a675db6..5f3197163 100644 --- a/device/community/linux-postmarketos-mediatek-mt8173/APKBUILD +++ b/device/community/linux-postmarketos-mediatek-mt8173/APKBUILD @@ -3,7 +3,7 @@ # Co-Maintainer: WeirdTreeThing maintainer="Adam Thiede " pkgname=linux-postmarketos-mediatek-mt8173 -pkgver=7.0.6 +pkgver=7.0.10 pkgrel=0 pkgdesc="Mainline kernel fork for Mediatek MT8173 devices" arch="aarch64" @@ -69,6 +69,6 @@ package() { } sha512sums=" -770e2b7e5669b20c2c8d98be5333e756062e379246eb9561b5024644eecfd1ef66776e4ad813375e748be1b88493c649892afc38176c1b9bfd3b88c4e8754b29 linux-7.0.6.tar.xz -d70c2c8d1cbf8ce6508823a14d5ae03a1906734962b5b71070771a6a9c83fe5583635a0137c9a91bb66da0b33a09d95e23c8a4d73e8902f08b165e7b906246e8 config-postmarketos-mediatek-mt8173.aarch64 +6f04fa9ced78f2e7a41dfae7f707f540e7cc6dcd4d3847f0d28df58b2d18a8edb75f98c674ba935538897e89864a06681f4cd56b91f3ea3e1b7f04096cb796e7 linux-7.0.10.tar.xz +b4d6a1b2398746ead59cb6136b1ccc0cb818159ab0b42092c6edd84d56e97cf4995cabb6420b9d6b824f991985b3b10a83cbf37f581593feb49d234ab0182cc5 config-postmarketos-mediatek-mt8173.aarch64 " diff --git a/device/community/linux-postmarketos-mediatek-mt8173/config-postmarketos-mediatek-mt8173.aarch64 b/device/community/linux-postmarketos-mediatek-mt8173/config-postmarketos-mediatek-mt8173.aarch64 index c8c365deb..8a1124b57 100644 --- a/device/community/linux-postmarketos-mediatek-mt8173/config-postmarketos-mediatek-mt8173.aarch64 +++ b/device/community/linux-postmarketos-mediatek-mt8173/config-postmarketos-mediatek-mt8173.aarch64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 7.0.6 Kernel Configuration +# Linux/arm64 7.0.10 Kernel Configuration # CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.3" CONFIG_GCC_VERSION=0 @@ -13,7 +13,6 @@ CONFIG_LD_IS_LLD=y CONFIG_LLD_VERSION=220103 CONFIG_RUSTC_VERSION=0 CONFIG_RUSTC_LLVM_VERSION=0 -CONFIG_CC_CAN_LINK=y CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y CONFIG_TOOLS_SUPPORT_RELR=y @@ -855,6 +854,7 @@ CONFIG_CC_HAS_SANE_FUNCTION_ALIGNMENT=y # end of General architecture-dependent options CONFIG_RT_MUTEXES=y +CONFIG_MODULE_SIG_FORMAT=y CONFIG_MODULES=y # CONFIG_MODULE_DEBUG is not set # CONFIG_MODULE_FORCE_LOAD is not set @@ -863,7 +863,16 @@ CONFIG_MODULE_UNLOAD=y # CONFIG_MODULE_UNLOAD_TAINT_TRACKING is not set # CONFIG_MODVERSIONS is not set # CONFIG_MODULE_SRCVERSION_ALL is not set -# CONFIG_MODULE_SIG is not set +CONFIG_MODULE_SIG=y +# CONFIG_MODULE_SIG_FORCE is not set +CONFIG_MODULE_SIG_ALL=y +# CONFIG_MODULE_SIG_SHA256 is not set +# CONFIG_MODULE_SIG_SHA384 is not set +CONFIG_MODULE_SIG_SHA512=y +# CONFIG_MODULE_SIG_SHA3_256 is not set +# CONFIG_MODULE_SIG_SHA3_384 is not set +# CONFIG_MODULE_SIG_SHA3_512 is not set +CONFIG_MODULE_SIG_HASH="sha512" CONFIG_MODULE_COMPRESS=y # CONFIG_MODULE_COMPRESS_GZIP is not set # CONFIG_MODULE_COMPRESS_XZ is not set @@ -4725,7 +4734,6 @@ CONFIG_VIDEO_MEDIATEK_VPU=m # # Sunxi media platform drivers # -# CONFIG_VIDEO_DW_MIPI_CSI2RX is not set # # Texas Instruments drivers @@ -8654,9 +8662,13 @@ CONFIG_SECURITY_APPARMOR_HASH_DEFAULT=y CONFIG_SECURITY_APPARMOR_EXPORT_BINARY=y CONFIG_SECURITY_APPARMOR_PARANOID_LOAD=y # CONFIG_SECURITY_LOADPIN is not set -# CONFIG_SECURITY_YAMA is not set +CONFIG_SECURITY_YAMA=y # CONFIG_SECURITY_SAFESETID is not set -# CONFIG_SECURITY_LOCKDOWN_LSM is not set +CONFIG_SECURITY_LOCKDOWN_LSM=y +CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y +CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y +# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set +# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set # CONFIG_SECURITY_LANDLOCK is not set # CONFIG_SECURITY_IPE is not set CONFIG_INTEGRITY=y @@ -8924,6 +8936,12 @@ CONFIG_PKCS7_MESSAGE_PARSER=y # # Certificates for signature checking # +CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" +CONFIG_MODULE_SIG_KEY_TYPE_RSA=y +# CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_44 is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_65 is not set +# CONFIG_MODULE_SIG_KEY_TYPE_MLDSA_87 is not set CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_SYSTEM_TRUSTED_KEYS="" # CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set