Piecuu/pmaports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

linux-postmarketos-mainline: Opt-in to SELinux configs

Browse source 
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/8352>
This commit is contained in:
Aelin 2026-04-14 04:52:37 +02:00 • committed by The Friendly Meow (merge) Bot
parent 5d06fe0fd1
commit dc9dc99690
No known key found for this signature in database
15 changed files with 136 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

17
device/main/linux-postmarketos-mainline/APKBUILD
View file

@ -2,7 +2,7 @@
maintainer="Aelin <aelin@postmarketos.org>"
pkgname=linux-postmarketos-mainline
pkgver=7.0
pkgrel=0
pkgrel=1
_rel=${pkgver#*_p}
_kver=${pkgver%_p*}
_kver=${_kver//_/-}
@ -22,6 +22,7 @@ options="
pmb:kconfigcheck-community
pmb:kconfigcheck-immutable
pmb:kconfigcheck-rust
pmb:kconfigcheck-selinux
pmb:kconfigcheck-uefi
pmb:kconfigcheck-virt
"
@ -120,11 +121,11 @@ f33998359e088ddc344fff44a32e8bdec49206dd45c63f5472366b2b2f925b5828f4455cd974ae15
1f11df2480e9f691573283597160b4c806e492cdca4825f3acb3afb70bde43abfab487bcde1f5553b431a702a0039479d041b0ce7859970e706b5a51d2ad8fb0 0001-WIP-arch-powerpc-boot-Support-LLVM-1-in-wrapper-scri.patch
26521a9c9ea769534095dc4e306babadc8bcbaf03d7faa523c377e41ba0f742ecd0490fa27791d895f729c3ae8845297dca59b4db2475e7f078e689c447430bc 0002-WIP-arch-powerpc-boot-Use-z-notext-for-pseries-image.patch
302c20c85559fc9b3b2420ed25be1bfbb76c87f2a470e4141c32e9542cf1f5c6b3b5a7847231a3eaa0f6bc0e5942d0c1599e807175dcf5e63469704c3d6adde3 0003-WIP-arch-powerpc-boot-Add-z-norelro.patch
fe1243700721893ffd68a814c34e10902a72cc81ea8c7c6118faaa34965e7c587467174c71f7fdce4446d1de8a84d334375a28811d9d6adabbc93c461fcd17ff config-mainline.aarch64
e7810d3769f14ed4dce8a7d0f989a70c14d29c9120821ec28efc7e5d2c90623c7ae657b092a745212ad0ff593d6ae0956dc6455bad01fecab1446fd2cbd8158d config-mainline.armv7
13ef29743774d6c1bda0412a0ee7c65674c73c0bf63e672662cf9666a33880c0981e6c431fc5851eeaaa78692c5402f3e42a48e89ac596b0fa29266291dc4a77 config-mainline.loongarch64
f6e430d5054f44ebe69b3c1ab285253626d39fa7c8fe2cd1bc018cfc041a2c57dac5b6a60e1f122e2b77e8f34b30c42ded9ce3165022f3cc11d9657a95d7fbcb config-mainline.ppc64le
a00292acfba3340f75d4e94b900ace6eb3e0508fed6c264436da55dce0ee8f5e405356edab8f19b152db82fd30b1a83c7c110c2a35de65aea6e2ac3d4ea68d32 config-mainline.riscv64
d9fb518d6b089b6ed48976fe1598cbd899676bb3eca147bf83b409dcb77c6cb5437ebce6006f764f15da261ed71bb8ee1d091decddcf6201c82a111308352ca5 config-mainline.x86
b8406799c7ac5f4095e1b62ca0f4ddcfcd0bb4a9627850c7fa14dbcd8b745d34bbcdab6becd524d6780a96aa18a07964d0f3d1fe486b465f2edcc65fa0e35414 config-mainline.x86_64
5302ff3e212956a08af8de0207f7b7417b6f029065c2e98bbb482acde78cd5423709ad6c47f1eb2576e832d8f4d04347991c01334a2c7debfcea7ed6fb990976 config-mainline.aarch64
cf3fd7c533ad31eb3aba66c08897beba8e5e6a74f85a417b442963a6703384f2457032bbb7a408127e5924097ea67cd3664fe02644fb7999ffd143a281dac4a3 config-mainline.armv7
6936123136be4cffc4a21e6c1f38d063172fca9cff0f257dfa7107d612542b1b4cb42363d1bf28fbfeec473271f6b4396751f8b0bc37a695cc11182a55f48a3e config-mainline.loongarch64
f6599723628357a79c6a68ca87f0f11764fecff798ba28e493dc36fadc42b50b73f3d41912e895ea5cf651f47fc71e7e9ec16467544ade66709c189e86e6bee2 config-mainline.ppc64le
f304f8e0b66a6c01daf01e103976c29de14e3284b9afbe2b88aa4fdf33dc5fddc431a50dcde204aa7ff5d4ab6bf0f3071d7ec4105d80aa053cedba9b3fc60a3d config-mainline.riscv64
f7f878309994ec97a585596a3c853fa1df65ba8ca7f0116de59a2270bc08149efec713124c412fd60bad8340586c78732d049d0c98ce6fbfbbafdebad3dc15fc config-mainline.x86
dc9586222c0620fab9701a8008bd9a8dce336c0cd3a169480ae181370c15ba45959e69ff948c245d5103e7bfa54d8881da9202bc781ef205d3efac8b5e216e33 config-mainline.x86_64
"

22
device/main/linux-postmarketos-mainline/config-mainline.aarch64
View file

@ -1270,7 +1270,7 @@ CONFIG_IPV6_MULTIPLE_TABLES=y
# CONFIG_IPV6_IOAM6_LWTUNNEL is not set
# CONFIG_NETLABEL is not set
# CONFIG_MPTCP is not set
# CONFIG_NETWORK_SECMARK is not set
CONFIG_NETWORK_SECMARK=y
CONFIG_NET_PTP_CLASSIFY=y
# CONFIG_NETWORK_PHY_TIMESTAMPING is not set
CONFIG_NETFILTER=y
@ -1294,6 +1294,7 @@ CONFIG_NETFILTER_BPF_LINK=y
CONFIG_NF_CONNTRACK=m
CONFIG_NF_LOG_SYSLOG=m
CONFIG_NF_CONNTRACK_MARK=y
# CONFIG_NF_CONNTRACK_SECMARK is not set
# CONFIG_NF_CONNTRACK_ZONES is not set
# CONFIG_NF_CONNTRACK_PROCFS is not set
CONFIG_NF_CONNTRACK_EVENTS=y
@ -1377,6 +1378,7 @@ CONFIG_NETFILTER_XT_TARGET_MASQUERADE=m
# CONFIG_NETFILTER_XT_TARGET_TEE is not set
# CONFIG_NETFILTER_XT_TARGET_TPROXY is not set
# CONFIG_NETFILTER_XT_TARGET_TRACE is not set
# CONFIG_NETFILTER_XT_TARGET_SECMARK is not set
CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set
@ -11493,16 +11495,25 @@ CONFIG_KEYS=y
# CONFIG_TRUSTED_KEYS is not set
# CONFIG_ENCRYPTED_KEYS is not set
CONFIG_KEY_DH_OPERATIONS=y
# CONFIG_SECURITY_DMESG_RESTRICT is not set
CONFIG_SECURITY_DMESG_RESTRICT=y
CONFIG_PROC_MEM_ALWAYS_FORCE=y
# CONFIG_PROC_MEM_FORCE_PTRACE is not set
# CONFIG_PROC_MEM_NO_FORCE is not set
CONFIG_SECURITY=y
CONFIG_HAS_SECURITY_AUDIT=y
CONFIG_SECURITYFS=y
# CONFIG_SECURITY_NETWORK is not set
CONFIG_SECURITY_NETWORK=y
# CONFIG_SECURITY_PATH is not set
CONFIG_LSM_MMAP_MIN_ADDR=32768
# CONFIG_STATIC_USERMODEHELPER is not set
CONFIG_SECURITY_SELINUX=y
CONFIG_SECURITY_SELINUX_BOOTPARAM=y
CONFIG_SECURITY_SELINUX_DEVELOP=y
CONFIG_SECURITY_SELINUX_AVC_STATS=y
CONFIG_SECURITY_SELINUX_SIDTAB_HASH_BITS=9
CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE=256
CONFIG_SECURITY_SELINUX_AVC_HASH_BITS=9
# CONFIG_SECURITY_SELINUX_DEBUG is not set
# CONFIG_SECURITY_SMACK is not set
# CONFIG_SECURITY_TOMOYO is not set
# CONFIG_SECURITY_APPARMOR is not set
@ -11518,8 +11529,9 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_IMA is not set
# CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set
# CONFIG_EVM is not set
CONFIG_DEFAULT_SECURITY_DAC=y
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,ipe,bpf"
CONFIG_DEFAULT_SECURITY_SELINUX=y
# CONFIG_DEFAULT_SECURITY_DAC is not set
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf"
#
# Kernel hardening options

32
device/main/linux-postmarketos-mainline/config-mainline.armv7
View file

@ -63,8 +63,9 @@ CONFIG_POSIX_MQUEUE=y
CONFIG_POSIX_MQUEUE_SYSCTL=y
# CONFIG_WATCH_QUEUE is not set
CONFIG_CROSS_MEMORY_ATTACH=y
# CONFIG_AUDIT is not set
CONFIG_AUDIT=y
CONFIG_HAVE_ARCH_AUDITSYSCALL=y
CONFIG_AUDITSYSCALL=y
#
# IRQ subsystem
@ -1268,7 +1269,7 @@ CONFIG_IPV6_MULTIPLE_TABLES=y
# CONFIG_IPV6_IOAM6_LWTUNNEL is not set
# CONFIG_NETLABEL is not set
# CONFIG_MPTCP is not set
# CONFIG_NETWORK_SECMARK is not set
CONFIG_NETWORK_SECMARK=y
CONFIG_NET_PTP_CLASSIFY=y
# CONFIG_NETWORK_PHY_TIMESTAMPING is not set
CONFIG_NETFILTER=y
@ -1291,6 +1292,7 @@ CONFIG_NETFILTER_BPF_LINK=y
CONFIG_NF_CONNTRACK=m
# CONFIG_NF_LOG_SYSLOG is not set
CONFIG_NF_CONNTRACK_MARK=y
# CONFIG_NF_CONNTRACK_SECMARK is not set
# CONFIG_NF_CONNTRACK_ZONES is not set
# CONFIG_NF_CONNTRACK_PROCFS is not set
# CONFIG_NF_CONNTRACK_EVENTS is not set
@ -1351,6 +1353,7 @@ CONFIG_NETFILTER_XT_MARK=m
#
# Xtables targets
#
# CONFIG_NETFILTER_XT_TARGET_AUDIT is not set
CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
# CONFIG_NETFILTER_XT_TARGET_CLASSIFY is not set
# CONFIG_NETFILTER_XT_TARGET_CONNMARK is not set
@ -1373,6 +1376,7 @@ CONFIG_NETFILTER_XT_TARGET_MASQUERADE=m
# CONFIG_NETFILTER_XT_TARGET_TEE is not set
# CONFIG_NETFILTER_XT_TARGET_TPROXY is not set
# CONFIG_NETFILTER_XT_TARGET_TRACE is not set
# CONFIG_NETFILTER_XT_TARGET_SECMARK is not set
CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set
@ -2703,6 +2707,7 @@ CONFIG_DM_VERITY=m
# CONFIG_DM_SWITCH is not set
# CONFIG_DM_LOG_WRITES is not set
CONFIG_DM_INTEGRITY=m
CONFIG_DM_AUDIT=y
CONFIG_TARGET_CORE=m
# CONFIG_TCM_IBLOCK is not set
# CONFIG_TCM_FILEIO is not set
@ -10975,15 +10980,26 @@ CONFIG_KEYS=y
# CONFIG_TRUSTED_KEYS is not set
# CONFIG_ENCRYPTED_KEYS is not set
CONFIG_KEY_DH_OPERATIONS=y
# CONFIG_SECURITY_DMESG_RESTRICT is not set
CONFIG_SECURITY_DMESG_RESTRICT=y
CONFIG_PROC_MEM_ALWAYS_FORCE=y
# CONFIG_PROC_MEM_FORCE_PTRACE is not set
# CONFIG_PROC_MEM_NO_FORCE is not set
CONFIG_SECURITY=y
CONFIG_HAS_SECURITY_AUDIT=y
CONFIG_SECURITYFS=y
# CONFIG_SECURITY_NETWORK is not set
CONFIG_SECURITY_NETWORK=y
# CONFIG_SECURITY_NETWORK_XFRM is not set
# CONFIG_SECURITY_PATH is not set
CONFIG_LSM_MMAP_MIN_ADDR=32768
# CONFIG_STATIC_USERMODEHELPER is not set
CONFIG_SECURITY_SELINUX=y
CONFIG_SECURITY_SELINUX_BOOTPARAM=y
CONFIG_SECURITY_SELINUX_DEVELOP=y
CONFIG_SECURITY_SELINUX_AVC_STATS=y
CONFIG_SECURITY_SELINUX_SIDTAB_HASH_BITS=9
CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE=256
CONFIG_SECURITY_SELINUX_AVC_HASH_BITS=9
# CONFIG_SECURITY_SELINUX_DEBUG is not set
# CONFIG_SECURITY_SMACK is not set
# CONFIG_SECURITY_TOMOYO is not set
# CONFIG_SECURITY_APPARMOR is not set
@ -10992,12 +11008,15 @@ CONFIG_SECURITYFS=y
# CONFIG_SECURITY_SAFESETID is not set
# CONFIG_SECURITY_LOCKDOWN_LSM is not set
# CONFIG_SECURITY_LANDLOCK is not set
# CONFIG_SECURITY_IPE is not set
CONFIG_INTEGRITY=y
# CONFIG_INTEGRITY_SIGNATURE is not set
CONFIG_INTEGRITY_AUDIT=y
# CONFIG_IMA is not set
# CONFIG_EVM is not set
CONFIG_DEFAULT_SECURITY_DAC=y
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,ipe,bpf"
CONFIG_DEFAULT_SECURITY_SELINUX=y
# CONFIG_DEFAULT_SECURITY_DAC is not set
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf"
#
# Kernel hardening options
@ -11364,6 +11383,7 @@ CONFIG_CRYPTO_LIB_SHA3=m
# end of Crypto library routines
CONFIG_XXHASH=y
CONFIG_AUDIT_GENERIC=y
# CONFIG_RANDOM32_SELFTEST is not set
CONFIG_842_COMPRESS=y
CONFIG_842_DECOMPRESS=y

8
device/main/linux-postmarketos-mainline/config-mainline.loongarch64
View file

@ -8174,7 +8174,7 @@ CONFIG_KEYS=y
# CONFIG_TRUSTED_KEYS is not set
# CONFIG_ENCRYPTED_KEYS is not set
CONFIG_KEY_DH_OPERATIONS=y
# CONFIG_SECURITY_DMESG_RESTRICT is not set
CONFIG_SECURITY_DMESG_RESTRICT=y
CONFIG_PROC_MEM_ALWAYS_FORCE=y
# CONFIG_PROC_MEM_FORCE_PTRACE is not set
# CONFIG_PROC_MEM_NO_FORCE is not set
@ -8215,10 +8215,10 @@ CONFIG_INTEGRITY=y
CONFIG_INTEGRITY_AUDIT=y
# CONFIG_IMA is not set
# CONFIG_EVM is not set
# CONFIG_DEFAULT_SECURITY_SELINUX is not set
CONFIG_DEFAULT_SECURITY_SELINUX=y
# CONFIG_DEFAULT_SECURITY_APPARMOR is not set
CONFIG_DEFAULT_SECURITY_DAC=y
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,ipe,bpf"
# CONFIG_DEFAULT_SECURITY_DAC is not set
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf"
#
# Kernel hardening options

4
device/main/linux-postmarketos-mainline/config-mainline.ppc64le
View file

@ -6052,7 +6052,7 @@ CONFIG_KEYS=y
# CONFIG_TRUSTED_KEYS is not set
# CONFIG_ENCRYPTED_KEYS is not set
CONFIG_KEY_DH_OPERATIONS=y
# CONFIG_SECURITY_DMESG_RESTRICT is not set
CONFIG_SECURITY_DMESG_RESTRICT=y
CONFIG_PROC_MEM_ALWAYS_FORCE=y
# CONFIG_PROC_MEM_FORCE_PTRACE is not set
# CONFIG_PROC_MEM_NO_FORCE is not set
@ -6121,7 +6121,7 @@ CONFIG_IMA_KEXEC_EXTRA_MEMORY_KB=0
# CONFIG_EVM is not set
CONFIG_DEFAULT_SECURITY_SELINUX=y
# CONFIG_DEFAULT_SECURITY_DAC is not set
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf"
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf"
#
# Kernel hardening options

10
device/main/linux-postmarketos-mainline/config-mainline.riscv64
View file

@ -7285,7 +7285,7 @@ CONFIG_KEYS=y
# CONFIG_TRUSTED_KEYS is not set
# CONFIG_ENCRYPTED_KEYS is not set
CONFIG_KEY_DH_OPERATIONS=y
# CONFIG_SECURITY_DMESG_RESTRICT is not set
CONFIG_SECURITY_DMESG_RESTRICT=y
CONFIG_PROC_MEM_ALWAYS_FORCE=y
# CONFIG_PROC_MEM_FORCE_PTRACE is not set
# CONFIG_PROC_MEM_NO_FORCE is not set
@ -7298,7 +7298,7 @@ CONFIG_SECURITY_PATH=y
CONFIG_LSM_MMAP_MIN_ADDR=65536
# CONFIG_STATIC_USERMODEHELPER is not set
CONFIG_SECURITY_SELINUX=y
# CONFIG_SECURITY_SELINUX_BOOTPARAM is not set
CONFIG_SECURITY_SELINUX_BOOTPARAM=y
CONFIG_SECURITY_SELINUX_DEVELOP=y
CONFIG_SECURITY_SELINUX_AVC_STATS=y
CONFIG_SECURITY_SELINUX_SIDTAB_HASH_BITS=9
@ -7325,10 +7325,10 @@ CONFIG_INTEGRITY=y
CONFIG_INTEGRITY_AUDIT=y
# CONFIG_IMA is not set
# CONFIG_EVM is not set
# CONFIG_DEFAULT_SECURITY_SELINUX is not set
CONFIG_DEFAULT_SECURITY_SELINUX=y
# CONFIG_DEFAULT_SECURITY_APPARMOR is not set
CONFIG_DEFAULT_SECURITY_DAC=y
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,ipe,bpf"
# CONFIG_DEFAULT_SECURITY_DAC is not set
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf"
#
# Kernel hardening options

4
device/main/linux-postmarketos-mainline/config-mainline.x86
View file

@ -6343,7 +6343,7 @@ CONFIG_KEYS=y
# CONFIG_TRUSTED_KEYS is not set
# CONFIG_ENCRYPTED_KEYS is not set
CONFIG_KEY_DH_OPERATIONS=y
# CONFIG_SECURITY_DMESG_RESTRICT is not set
CONFIG_SECURITY_DMESG_RESTRICT=y
CONFIG_PROC_MEM_ALWAYS_FORCE=y
# CONFIG_PROC_MEM_FORCE_PTRACE is not set
# CONFIG_PROC_MEM_NO_FORCE is not set
@ -6380,7 +6380,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_EVM is not set
CONFIG_DEFAULT_SECURITY_SELINUX=y
# CONFIG_DEFAULT_SECURITY_DAC is not set
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf"
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf"
#
# Kernel hardening options

4
device/main/linux-postmarketos-mainline/config-mainline.x86_64
View file

@ -6511,7 +6511,7 @@ CONFIG_KEYS=y
# CONFIG_TRUSTED_KEYS is not set
# CONFIG_ENCRYPTED_KEYS is not set
CONFIG_KEY_DH_OPERATIONS=y
# CONFIG_SECURITY_DMESG_RESTRICT is not set
CONFIG_SECURITY_DMESG_RESTRICT=y
CONFIG_PROC_MEM_ALWAYS_FORCE=y
# CONFIG_PROC_MEM_FORCE_PTRACE is not set
# CONFIG_PROC_MEM_NO_FORCE is not set
@ -6549,7 +6549,7 @@ CONFIG_INTEGRITY_AUDIT=y
# CONFIG_EVM is not set
CONFIG_DEFAULT_SECURITY_SELINUX=y
# CONFIG_DEFAULT_SECURITY_DAC is not set
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf"
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf"
#
# Kernel hardening options

9
device/main/linux-postmarketos-mainline/pmos.aarch64.config
View file

@ -453,6 +453,7 @@ CONFIG_EFIVAR_FS=m
CONFIG_DM_VERITY=m
# hardening
CONFIG_SECURITY_DMESG_RESTRICT=y
CONFIG_CFI=y
# CONFIG_CFI_PERMISSIVE is not set
CONFIG_CFI_ICALL_NORMALIZE_INTEGERS=y
@ -462,5 +463,13 @@ CONFIG_SHADOW_CALL_STACK=y
# CONFIG_DEBUG_INFO_BTF is not set
# CONFIG_DEBUG_INFO_BTF_MODULES is not set
# selinux
CONFIG_AUDIT=y
CONFIG_DEFAULT_SECURITY_SELINUX=y
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf"
CONFIG_SECURITY_NETWORK=y
CONFIG_SECURITY_SELINUX=y
CONFIG_SECURITY_SELINUX_BOOTPARAM=y
# wine
CONFIG_NTSYNC=m

9
device/main/linux-postmarketos-mainline/pmos.armv7.config
View file

@ -449,6 +449,7 @@ CONFIG_EFIVAR_FS=m
CONFIG_DM_VERITY=m
# hardening
CONFIG_SECURITY_DMESG_RESTRICT=y
CONFIG_CFI=y
# CONFIG_CFI_PERMISSIVE is not set
CONFIG_CFI_ICALL_NORMALIZE_INTEGERS=y
@ -457,5 +458,13 @@ CONFIG_CFI_ICALL_NORMALIZE_INTEGERS=y
# CONFIG_DEBUG_INFO_BTF is not set
# CONFIG_DEBUG_INFO_BTF_MODULES is not set
# selinux
CONFIG_AUDIT=y
CONFIG_DEFAULT_SECURITY_SELINUX=y
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf"
CONFIG_SECURITY_NETWORK=y
CONFIG_SECURITY_SELINUX=y
CONFIG_SECURITY_SELINUX_BOOTPARAM=y
# wine
CONFIG_NTSYNC=m

11
device/main/linux-postmarketos-mainline/pmos.loongarch64.config
View file

@ -448,9 +448,20 @@ CONFIG_FUNCTION_TRACER=y
CONFIG_EFIVAR_FS=m
CONFIG_DM_VERITY=m
# hardening
CONFIG_SECURITY_DMESG_RESTRICT=y
# rust
# CONFIG_DEBUG_INFO_BTF is not set
# CONFIG_DEBUG_INFO_BTF_MODULES is not set
# selinux
CONFIG_AUDIT=y
CONFIG_DEFAULT_SECURITY_SELINUX=y
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf"
CONFIG_SECURITY_NETWORK=y
CONFIG_SECURITY_SELINUX=y
CONFIG_SECURITY_SELINUX_BOOTPARAM=y
# wine
CONFIG_NTSYNC=m

11
device/main/linux-postmarketos-mainline/pmos.ppc64le.config
View file

@ -436,9 +436,20 @@ CONFIG_FUNCTION_TRACER=y
# immutable
CONFIG_DM_VERITY=m
# hardening
CONFIG_SECURITY_DMESG_RESTRICT=y
# rust
# CONFIG_DEBUG_INFO_BTF is not set
# CONFIG_DEBUG_INFO_BTF_MODULES is not set
# selinux
CONFIG_AUDIT=y
CONFIG_DEFAULT_SECURITY_SELINUX=y
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf"
CONFIG_SECURITY_NETWORK=y
CONFIG_SECURITY_SELINUX=y
CONFIG_SECURITY_SELINUX_BOOTPARAM=y
# wine
CONFIG_NTSYNC=m

9
device/main/linux-postmarketos-mainline/pmos.riscv64.config
View file

@ -450,6 +450,7 @@ CONFIG_EFIVAR_FS=m
CONFIG_DM_VERITY=m
# hardening
CONFIG_SECURITY_DMESG_RESTRICT=y
CONFIG_CFI=y
# CONFIG_CFI_PERMISSIVE is not set
CONFIG_CFI_ICALL_NORMALIZE_INTEGERS=y
@ -459,5 +460,13 @@ CONFIG_SHADOW_CALL_STACK=y
# CONFIG_DEBUG_INFO_BTF is not set
# CONFIG_DEBUG_INFO_BTF_MODULES is not set
# selinux
CONFIG_AUDIT=y
CONFIG_DEFAULT_SECURITY_SELINUX=y
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf"
CONFIG_SECURITY_NETWORK=y
CONFIG_SECURITY_SELINUX=y
CONFIG_SECURITY_SELINUX_BOOTPARAM=y
# wine
CONFIG_NTSYNC=m

11
device/main/linux-postmarketos-mainline/pmos.x86.config
View file

@ -451,9 +451,20 @@ CONFIG_FUNCTION_TRACER=y
CONFIG_EFIVAR_FS=m
CONFIG_DM_VERITY=m
# hardening
CONFIG_SECURITY_DMESG_RESTRICT=y
# rust
# CONFIG_DEBUG_INFO_BTF is not set
# CONFIG_DEBUG_INFO_BTF_MODULES is not set
# selinux
CONFIG_AUDIT=y
CONFIG_DEFAULT_SECURITY_SELINUX=y
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf"
CONFIG_SECURITY_NETWORK=y
CONFIG_SECURITY_SELINUX=y
CONFIG_SECURITY_SELINUX_BOOTPARAM=y
# wine
CONFIG_NTSYNC=m

9
device/main/linux-postmarketos-mainline/pmos.x86_64.config
View file

@ -454,6 +454,7 @@ CONFIG_EFIVAR_FS=m
CONFIG_DM_VERITY=m
# hardening
CONFIG_SECURITY_DMESG_RESTRICT=y
CONFIG_CFI=y
# CONFIG_CFI_PERMISSIVE is not set
CONFIG_CFI_ICALL_NORMALIZE_INTEGERS=y
@ -462,5 +463,13 @@ CONFIG_CFI_ICALL_NORMALIZE_INTEGERS=y
# CONFIG_DEBUG_INFO_BTF is not set
# CONFIG_DEBUG_INFO_BTF_MODULES is not set
# selinux
CONFIG_AUDIT=y
CONFIG_DEFAULT_SECURITY_SELINUX=y
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf"
CONFIG_SECURITY_NETWORK=y
CONFIG_SECURITY_SELINUX=y
CONFIG_SECURITY_SELINUX_BOOTPARAM=y
# wine
CONFIG_NTSYNC=m