From b5c5a91b605164e490445f26ce29e228bdceafa2 Mon Sep 17 00:00:00 2001
From: Aster Boese <asterboese@mailbox.org>
Date: Sun, 12 Apr 2026 22:28:28 +0200
Subject: [PATCH] kconfigcheck: enable SECURITY_DMESG_RESTRICT

Kernel logs can contain sensitive information which we don't want
easily accessible. This locks the kernel buffer to privileged
access (with sudo).

Signed-off-by: Aster Boese <asterboese@mailbox.org>
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/8342>
---
 kconfigcheck.toml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kconfigcheck.toml b/kconfigcheck.toml
index d478c37da..8a7bef431 100644
--- a/kconfigcheck.toml
+++ b/kconfigcheck.toml
@@ -638,6 +638,9 @@ EFIVAR_FS = "m"
 ["category:immutable".">=0.0.0"."all"]
 DM_VERITY = "m"
 
+["category:hardening".">=0.0.0"."all"]
+SECURITY_DMESG_RESTRICT = "y"
+
 # In 6.18+, CFI_CLANG is CFI
 ["category:hardening".">=6.18_rc1"."x86_64 aarch64 armv7 riscv64"]
 CFI = "y"