diff --git a/device/main/linux-postmarketos-mainline/APKBUILD b/device/main/linux-postmarketos-mainline/APKBUILD index 119d3640e..c0ea3219b 100644 --- a/device/main/linux-postmarketos-mainline/APKBUILD +++ b/device/main/linux-postmarketos-mainline/APKBUILD @@ -2,7 +2,7 @@ maintainer="Aelin " pkgname=linux-postmarketos-mainline pkgver=7.0 -pkgrel=0 +pkgrel=1 _rel=${pkgver#*_p} _kver=${pkgver%_p*} _kver=${_kver//_/-} @@ -22,6 +22,7 @@ options=" pmb:kconfigcheck-community pmb:kconfigcheck-immutable pmb:kconfigcheck-rust + pmb:kconfigcheck-selinux pmb:kconfigcheck-uefi pmb:kconfigcheck-virt " @@ -120,11 +121,11 @@ f33998359e088ddc344fff44a32e8bdec49206dd45c63f5472366b2b2f925b5828f4455cd974ae15 1f11df2480e9f691573283597160b4c806e492cdca4825f3acb3afb70bde43abfab487bcde1f5553b431a702a0039479d041b0ce7859970e706b5a51d2ad8fb0 0001-WIP-arch-powerpc-boot-Support-LLVM-1-in-wrapper-scri.patch 26521a9c9ea769534095dc4e306babadc8bcbaf03d7faa523c377e41ba0f742ecd0490fa27791d895f729c3ae8845297dca59b4db2475e7f078e689c447430bc 0002-WIP-arch-powerpc-boot-Use-z-notext-for-pseries-image.patch 302c20c85559fc9b3b2420ed25be1bfbb76c87f2a470e4141c32e9542cf1f5c6b3b5a7847231a3eaa0f6bc0e5942d0c1599e807175dcf5e63469704c3d6adde3 0003-WIP-arch-powerpc-boot-Add-z-norelro.patch -fe1243700721893ffd68a814c34e10902a72cc81ea8c7c6118faaa34965e7c587467174c71f7fdce4446d1de8a84d334375a28811d9d6adabbc93c461fcd17ff config-mainline.aarch64 -e7810d3769f14ed4dce8a7d0f989a70c14d29c9120821ec28efc7e5d2c90623c7ae657b092a745212ad0ff593d6ae0956dc6455bad01fecab1446fd2cbd8158d config-mainline.armv7 -13ef29743774d6c1bda0412a0ee7c65674c73c0bf63e672662cf9666a33880c0981e6c431fc5851eeaaa78692c5402f3e42a48e89ac596b0fa29266291dc4a77 config-mainline.loongarch64 -f6e430d5054f44ebe69b3c1ab285253626d39fa7c8fe2cd1bc018cfc041a2c57dac5b6a60e1f122e2b77e8f34b30c42ded9ce3165022f3cc11d9657a95d7fbcb config-mainline.ppc64le -a00292acfba3340f75d4e94b900ace6eb3e0508fed6c264436da55dce0ee8f5e405356edab8f19b152db82fd30b1a83c7c110c2a35de65aea6e2ac3d4ea68d32 config-mainline.riscv64 -d9fb518d6b089b6ed48976fe1598cbd899676bb3eca147bf83b409dcb77c6cb5437ebce6006f764f15da261ed71bb8ee1d091decddcf6201c82a111308352ca5 config-mainline.x86 -b8406799c7ac5f4095e1b62ca0f4ddcfcd0bb4a9627850c7fa14dbcd8b745d34bbcdab6becd524d6780a96aa18a07964d0f3d1fe486b465f2edcc65fa0e35414 config-mainline.x86_64 +5302ff3e212956a08af8de0207f7b7417b6f029065c2e98bbb482acde78cd5423709ad6c47f1eb2576e832d8f4d04347991c01334a2c7debfcea7ed6fb990976 config-mainline.aarch64 +cf3fd7c533ad31eb3aba66c08897beba8e5e6a74f85a417b442963a6703384f2457032bbb7a408127e5924097ea67cd3664fe02644fb7999ffd143a281dac4a3 config-mainline.armv7 +6936123136be4cffc4a21e6c1f38d063172fca9cff0f257dfa7107d612542b1b4cb42363d1bf28fbfeec473271f6b4396751f8b0bc37a695cc11182a55f48a3e config-mainline.loongarch64 +f6599723628357a79c6a68ca87f0f11764fecff798ba28e493dc36fadc42b50b73f3d41912e895ea5cf651f47fc71e7e9ec16467544ade66709c189e86e6bee2 config-mainline.ppc64le +f304f8e0b66a6c01daf01e103976c29de14e3284b9afbe2b88aa4fdf33dc5fddc431a50dcde204aa7ff5d4ab6bf0f3071d7ec4105d80aa053cedba9b3fc60a3d config-mainline.riscv64 +f7f878309994ec97a585596a3c853fa1df65ba8ca7f0116de59a2270bc08149efec713124c412fd60bad8340586c78732d049d0c98ce6fbfbbafdebad3dc15fc config-mainline.x86 +dc9586222c0620fab9701a8008bd9a8dce336c0cd3a169480ae181370c15ba45959e69ff948c245d5103e7bfa54d8881da9202bc781ef205d3efac8b5e216e33 config-mainline.x86_64 " diff --git a/device/main/linux-postmarketos-mainline/config-mainline.aarch64 b/device/main/linux-postmarketos-mainline/config-mainline.aarch64 index faf6dae17..22a6cec14 100644 --- a/device/main/linux-postmarketos-mainline/config-mainline.aarch64 +++ b/device/main/linux-postmarketos-mainline/config-mainline.aarch64 @@ -1270,7 +1270,7 @@ CONFIG_IPV6_MULTIPLE_TABLES=y # CONFIG_IPV6_IOAM6_LWTUNNEL is not set # CONFIG_NETLABEL is not set # CONFIG_MPTCP is not set -# CONFIG_NETWORK_SECMARK is not set +CONFIG_NETWORK_SECMARK=y CONFIG_NET_PTP_CLASSIFY=y # CONFIG_NETWORK_PHY_TIMESTAMPING is not set CONFIG_NETFILTER=y @@ -1294,6 +1294,7 @@ CONFIG_NETFILTER_BPF_LINK=y CONFIG_NF_CONNTRACK=m CONFIG_NF_LOG_SYSLOG=m CONFIG_NF_CONNTRACK_MARK=y +# CONFIG_NF_CONNTRACK_SECMARK is not set # CONFIG_NF_CONNTRACK_ZONES is not set # CONFIG_NF_CONNTRACK_PROCFS is not set CONFIG_NF_CONNTRACK_EVENTS=y @@ -1377,6 +1378,7 @@ CONFIG_NETFILTER_XT_TARGET_MASQUERADE=m # CONFIG_NETFILTER_XT_TARGET_TEE is not set # CONFIG_NETFILTER_XT_TARGET_TPROXY is not set # CONFIG_NETFILTER_XT_TARGET_TRACE is not set +# CONFIG_NETFILTER_XT_TARGET_SECMARK is not set CONFIG_NETFILTER_XT_TARGET_TCPMSS=m # CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set @@ -11493,16 +11495,25 @@ CONFIG_KEYS=y # CONFIG_TRUSTED_KEYS is not set # CONFIG_ENCRYPTED_KEYS is not set CONFIG_KEY_DH_OPERATIONS=y -# CONFIG_SECURITY_DMESG_RESTRICT is not set +CONFIG_SECURITY_DMESG_RESTRICT=y CONFIG_PROC_MEM_ALWAYS_FORCE=y # CONFIG_PROC_MEM_FORCE_PTRACE is not set # CONFIG_PROC_MEM_NO_FORCE is not set CONFIG_SECURITY=y CONFIG_HAS_SECURITY_AUDIT=y CONFIG_SECURITYFS=y -# CONFIG_SECURITY_NETWORK is not set +CONFIG_SECURITY_NETWORK=y # CONFIG_SECURITY_PATH is not set +CONFIG_LSM_MMAP_MIN_ADDR=32768 # CONFIG_STATIC_USERMODEHELPER is not set +CONFIG_SECURITY_SELINUX=y +CONFIG_SECURITY_SELINUX_BOOTPARAM=y +CONFIG_SECURITY_SELINUX_DEVELOP=y +CONFIG_SECURITY_SELINUX_AVC_STATS=y +CONFIG_SECURITY_SELINUX_SIDTAB_HASH_BITS=9 +CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE=256 +CONFIG_SECURITY_SELINUX_AVC_HASH_BITS=9 +# CONFIG_SECURITY_SELINUX_DEBUG is not set # CONFIG_SECURITY_SMACK is not set # CONFIG_SECURITY_TOMOYO is not set # CONFIG_SECURITY_APPARMOR is not set @@ -11518,8 +11529,9 @@ CONFIG_INTEGRITY_AUDIT=y # CONFIG_IMA is not set # CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set # CONFIG_EVM is not set -CONFIG_DEFAULT_SECURITY_DAC=y -CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,ipe,bpf" +CONFIG_DEFAULT_SECURITY_SELINUX=y +# CONFIG_DEFAULT_SECURITY_DAC is not set +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" # # Kernel hardening options diff --git a/device/main/linux-postmarketos-mainline/config-mainline.armv7 b/device/main/linux-postmarketos-mainline/config-mainline.armv7 index 697a54ff7..62a1983d7 100644 --- a/device/main/linux-postmarketos-mainline/config-mainline.armv7 +++ b/device/main/linux-postmarketos-mainline/config-mainline.armv7 @@ -63,8 +63,9 @@ CONFIG_POSIX_MQUEUE=y CONFIG_POSIX_MQUEUE_SYSCTL=y # CONFIG_WATCH_QUEUE is not set CONFIG_CROSS_MEMORY_ATTACH=y -# CONFIG_AUDIT is not set +CONFIG_AUDIT=y CONFIG_HAVE_ARCH_AUDITSYSCALL=y +CONFIG_AUDITSYSCALL=y # # IRQ subsystem @@ -1268,7 +1269,7 @@ CONFIG_IPV6_MULTIPLE_TABLES=y # CONFIG_IPV6_IOAM6_LWTUNNEL is not set # CONFIG_NETLABEL is not set # CONFIG_MPTCP is not set -# CONFIG_NETWORK_SECMARK is not set +CONFIG_NETWORK_SECMARK=y CONFIG_NET_PTP_CLASSIFY=y # CONFIG_NETWORK_PHY_TIMESTAMPING is not set CONFIG_NETFILTER=y @@ -1291,6 +1292,7 @@ CONFIG_NETFILTER_BPF_LINK=y CONFIG_NF_CONNTRACK=m # CONFIG_NF_LOG_SYSLOG is not set CONFIG_NF_CONNTRACK_MARK=y +# CONFIG_NF_CONNTRACK_SECMARK is not set # CONFIG_NF_CONNTRACK_ZONES is not set # CONFIG_NF_CONNTRACK_PROCFS is not set # CONFIG_NF_CONNTRACK_EVENTS is not set @@ -1351,6 +1353,7 @@ CONFIG_NETFILTER_XT_MARK=m # # Xtables targets # +# CONFIG_NETFILTER_XT_TARGET_AUDIT is not set CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m # CONFIG_NETFILTER_XT_TARGET_CLASSIFY is not set # CONFIG_NETFILTER_XT_TARGET_CONNMARK is not set @@ -1373,6 +1376,7 @@ CONFIG_NETFILTER_XT_TARGET_MASQUERADE=m # CONFIG_NETFILTER_XT_TARGET_TEE is not set # CONFIG_NETFILTER_XT_TARGET_TPROXY is not set # CONFIG_NETFILTER_XT_TARGET_TRACE is not set +# CONFIG_NETFILTER_XT_TARGET_SECMARK is not set CONFIG_NETFILTER_XT_TARGET_TCPMSS=m # CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set @@ -2703,6 +2707,7 @@ CONFIG_DM_VERITY=m # CONFIG_DM_SWITCH is not set # CONFIG_DM_LOG_WRITES is not set CONFIG_DM_INTEGRITY=m +CONFIG_DM_AUDIT=y CONFIG_TARGET_CORE=m # CONFIG_TCM_IBLOCK is not set # CONFIG_TCM_FILEIO is not set @@ -10975,15 +10980,26 @@ CONFIG_KEYS=y # CONFIG_TRUSTED_KEYS is not set # CONFIG_ENCRYPTED_KEYS is not set CONFIG_KEY_DH_OPERATIONS=y -# CONFIG_SECURITY_DMESG_RESTRICT is not set +CONFIG_SECURITY_DMESG_RESTRICT=y CONFIG_PROC_MEM_ALWAYS_FORCE=y # CONFIG_PROC_MEM_FORCE_PTRACE is not set # CONFIG_PROC_MEM_NO_FORCE is not set CONFIG_SECURITY=y +CONFIG_HAS_SECURITY_AUDIT=y CONFIG_SECURITYFS=y -# CONFIG_SECURITY_NETWORK is not set +CONFIG_SECURITY_NETWORK=y +# CONFIG_SECURITY_NETWORK_XFRM is not set # CONFIG_SECURITY_PATH is not set +CONFIG_LSM_MMAP_MIN_ADDR=32768 # CONFIG_STATIC_USERMODEHELPER is not set +CONFIG_SECURITY_SELINUX=y +CONFIG_SECURITY_SELINUX_BOOTPARAM=y +CONFIG_SECURITY_SELINUX_DEVELOP=y +CONFIG_SECURITY_SELINUX_AVC_STATS=y +CONFIG_SECURITY_SELINUX_SIDTAB_HASH_BITS=9 +CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE=256 +CONFIG_SECURITY_SELINUX_AVC_HASH_BITS=9 +# CONFIG_SECURITY_SELINUX_DEBUG is not set # CONFIG_SECURITY_SMACK is not set # CONFIG_SECURITY_TOMOYO is not set # CONFIG_SECURITY_APPARMOR is not set @@ -10992,12 +11008,15 @@ CONFIG_SECURITYFS=y # CONFIG_SECURITY_SAFESETID is not set # CONFIG_SECURITY_LOCKDOWN_LSM is not set # CONFIG_SECURITY_LANDLOCK is not set +# CONFIG_SECURITY_IPE is not set CONFIG_INTEGRITY=y # CONFIG_INTEGRITY_SIGNATURE is not set +CONFIG_INTEGRITY_AUDIT=y # CONFIG_IMA is not set # CONFIG_EVM is not set -CONFIG_DEFAULT_SECURITY_DAC=y -CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,ipe,bpf" +CONFIG_DEFAULT_SECURITY_SELINUX=y +# CONFIG_DEFAULT_SECURITY_DAC is not set +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" # # Kernel hardening options @@ -11364,6 +11383,7 @@ CONFIG_CRYPTO_LIB_SHA3=m # end of Crypto library routines CONFIG_XXHASH=y +CONFIG_AUDIT_GENERIC=y # CONFIG_RANDOM32_SELFTEST is not set CONFIG_842_COMPRESS=y CONFIG_842_DECOMPRESS=y diff --git a/device/main/linux-postmarketos-mainline/config-mainline.loongarch64 b/device/main/linux-postmarketos-mainline/config-mainline.loongarch64 index 66e318ef6..036093d25 100644 --- a/device/main/linux-postmarketos-mainline/config-mainline.loongarch64 +++ b/device/main/linux-postmarketos-mainline/config-mainline.loongarch64 @@ -8174,7 +8174,7 @@ CONFIG_KEYS=y # CONFIG_TRUSTED_KEYS is not set # CONFIG_ENCRYPTED_KEYS is not set CONFIG_KEY_DH_OPERATIONS=y -# CONFIG_SECURITY_DMESG_RESTRICT is not set +CONFIG_SECURITY_DMESG_RESTRICT=y CONFIG_PROC_MEM_ALWAYS_FORCE=y # CONFIG_PROC_MEM_FORCE_PTRACE is not set # CONFIG_PROC_MEM_NO_FORCE is not set @@ -8215,10 +8215,10 @@ CONFIG_INTEGRITY=y CONFIG_INTEGRITY_AUDIT=y # CONFIG_IMA is not set # CONFIG_EVM is not set -# CONFIG_DEFAULT_SECURITY_SELINUX is not set +CONFIG_DEFAULT_SECURITY_SELINUX=y # CONFIG_DEFAULT_SECURITY_APPARMOR is not set -CONFIG_DEFAULT_SECURITY_DAC=y -CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,ipe,bpf" +# CONFIG_DEFAULT_SECURITY_DAC is not set +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" # # Kernel hardening options diff --git a/device/main/linux-postmarketos-mainline/config-mainline.ppc64le b/device/main/linux-postmarketos-mainline/config-mainline.ppc64le index b121b1c0e..c7118128e 100644 --- a/device/main/linux-postmarketos-mainline/config-mainline.ppc64le +++ b/device/main/linux-postmarketos-mainline/config-mainline.ppc64le @@ -6052,7 +6052,7 @@ CONFIG_KEYS=y # CONFIG_TRUSTED_KEYS is not set # CONFIG_ENCRYPTED_KEYS is not set CONFIG_KEY_DH_OPERATIONS=y -# CONFIG_SECURITY_DMESG_RESTRICT is not set +CONFIG_SECURITY_DMESG_RESTRICT=y CONFIG_PROC_MEM_ALWAYS_FORCE=y # CONFIG_PROC_MEM_FORCE_PTRACE is not set # CONFIG_PROC_MEM_NO_FORCE is not set @@ -6121,7 +6121,7 @@ CONFIG_IMA_KEXEC_EXTRA_MEMORY_KB=0 # CONFIG_EVM is not set CONFIG_DEFAULT_SECURITY_SELINUX=y # CONFIG_DEFAULT_SECURITY_DAC is not set -CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf" +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" # # Kernel hardening options diff --git a/device/main/linux-postmarketos-mainline/config-mainline.riscv64 b/device/main/linux-postmarketos-mainline/config-mainline.riscv64 index 935a8998e..6955c9e69 100644 --- a/device/main/linux-postmarketos-mainline/config-mainline.riscv64 +++ b/device/main/linux-postmarketos-mainline/config-mainline.riscv64 @@ -7285,7 +7285,7 @@ CONFIG_KEYS=y # CONFIG_TRUSTED_KEYS is not set # CONFIG_ENCRYPTED_KEYS is not set CONFIG_KEY_DH_OPERATIONS=y -# CONFIG_SECURITY_DMESG_RESTRICT is not set +CONFIG_SECURITY_DMESG_RESTRICT=y CONFIG_PROC_MEM_ALWAYS_FORCE=y # CONFIG_PROC_MEM_FORCE_PTRACE is not set # CONFIG_PROC_MEM_NO_FORCE is not set @@ -7298,7 +7298,7 @@ CONFIG_SECURITY_PATH=y CONFIG_LSM_MMAP_MIN_ADDR=65536 # CONFIG_STATIC_USERMODEHELPER is not set CONFIG_SECURITY_SELINUX=y -# CONFIG_SECURITY_SELINUX_BOOTPARAM is not set +CONFIG_SECURITY_SELINUX_BOOTPARAM=y CONFIG_SECURITY_SELINUX_DEVELOP=y CONFIG_SECURITY_SELINUX_AVC_STATS=y CONFIG_SECURITY_SELINUX_SIDTAB_HASH_BITS=9 @@ -7325,10 +7325,10 @@ CONFIG_INTEGRITY=y CONFIG_INTEGRITY_AUDIT=y # CONFIG_IMA is not set # CONFIG_EVM is not set -# CONFIG_DEFAULT_SECURITY_SELINUX is not set +CONFIG_DEFAULT_SECURITY_SELINUX=y # CONFIG_DEFAULT_SECURITY_APPARMOR is not set -CONFIG_DEFAULT_SECURITY_DAC=y -CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,ipe,bpf" +# CONFIG_DEFAULT_SECURITY_DAC is not set +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" # # Kernel hardening options diff --git a/device/main/linux-postmarketos-mainline/config-mainline.x86 b/device/main/linux-postmarketos-mainline/config-mainline.x86 index 9c016cc17..88516f180 100644 --- a/device/main/linux-postmarketos-mainline/config-mainline.x86 +++ b/device/main/linux-postmarketos-mainline/config-mainline.x86 @@ -6343,7 +6343,7 @@ CONFIG_KEYS=y # CONFIG_TRUSTED_KEYS is not set # CONFIG_ENCRYPTED_KEYS is not set CONFIG_KEY_DH_OPERATIONS=y -# CONFIG_SECURITY_DMESG_RESTRICT is not set +CONFIG_SECURITY_DMESG_RESTRICT=y CONFIG_PROC_MEM_ALWAYS_FORCE=y # CONFIG_PROC_MEM_FORCE_PTRACE is not set # CONFIG_PROC_MEM_NO_FORCE is not set @@ -6380,7 +6380,7 @@ CONFIG_INTEGRITY_AUDIT=y # CONFIG_EVM is not set CONFIG_DEFAULT_SECURITY_SELINUX=y # CONFIG_DEFAULT_SECURITY_DAC is not set -CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf" +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" # # Kernel hardening options diff --git a/device/main/linux-postmarketos-mainline/config-mainline.x86_64 b/device/main/linux-postmarketos-mainline/config-mainline.x86_64 index c2a4bd222..f05bc1cb5 100644 --- a/device/main/linux-postmarketos-mainline/config-mainline.x86_64 +++ b/device/main/linux-postmarketos-mainline/config-mainline.x86_64 @@ -6511,7 +6511,7 @@ CONFIG_KEYS=y # CONFIG_TRUSTED_KEYS is not set # CONFIG_ENCRYPTED_KEYS is not set CONFIG_KEY_DH_OPERATIONS=y -# CONFIG_SECURITY_DMESG_RESTRICT is not set +CONFIG_SECURITY_DMESG_RESTRICT=y CONFIG_PROC_MEM_ALWAYS_FORCE=y # CONFIG_PROC_MEM_FORCE_PTRACE is not set # CONFIG_PROC_MEM_NO_FORCE is not set @@ -6549,7 +6549,7 @@ CONFIG_INTEGRITY_AUDIT=y # CONFIG_EVM is not set CONFIG_DEFAULT_SECURITY_SELINUX=y # CONFIG_DEFAULT_SECURITY_DAC is not set -CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf" +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" # # Kernel hardening options diff --git a/device/main/linux-postmarketos-mainline/pmos.aarch64.config b/device/main/linux-postmarketos-mainline/pmos.aarch64.config index cca709859..593e9cacc 100644 --- a/device/main/linux-postmarketos-mainline/pmos.aarch64.config +++ b/device/main/linux-postmarketos-mainline/pmos.aarch64.config @@ -453,6 +453,7 @@ CONFIG_EFIVAR_FS=m CONFIG_DM_VERITY=m # hardening +CONFIG_SECURITY_DMESG_RESTRICT=y CONFIG_CFI=y # CONFIG_CFI_PERMISSIVE is not set CONFIG_CFI_ICALL_NORMALIZE_INTEGERS=y @@ -462,5 +463,13 @@ CONFIG_SHADOW_CALL_STACK=y # CONFIG_DEBUG_INFO_BTF is not set # CONFIG_DEBUG_INFO_BTF_MODULES is not set +# selinux +CONFIG_AUDIT=y +CONFIG_DEFAULT_SECURITY_SELINUX=y +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" +CONFIG_SECURITY_NETWORK=y +CONFIG_SECURITY_SELINUX=y +CONFIG_SECURITY_SELINUX_BOOTPARAM=y + # wine CONFIG_NTSYNC=m diff --git a/device/main/linux-postmarketos-mainline/pmos.armv7.config b/device/main/linux-postmarketos-mainline/pmos.armv7.config index 33b8e271b..1b24d5c81 100644 --- a/device/main/linux-postmarketos-mainline/pmos.armv7.config +++ b/device/main/linux-postmarketos-mainline/pmos.armv7.config @@ -449,6 +449,7 @@ CONFIG_EFIVAR_FS=m CONFIG_DM_VERITY=m # hardening +CONFIG_SECURITY_DMESG_RESTRICT=y CONFIG_CFI=y # CONFIG_CFI_PERMISSIVE is not set CONFIG_CFI_ICALL_NORMALIZE_INTEGERS=y @@ -457,5 +458,13 @@ CONFIG_CFI_ICALL_NORMALIZE_INTEGERS=y # CONFIG_DEBUG_INFO_BTF is not set # CONFIG_DEBUG_INFO_BTF_MODULES is not set +# selinux +CONFIG_AUDIT=y +CONFIG_DEFAULT_SECURITY_SELINUX=y +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" +CONFIG_SECURITY_NETWORK=y +CONFIG_SECURITY_SELINUX=y +CONFIG_SECURITY_SELINUX_BOOTPARAM=y + # wine CONFIG_NTSYNC=m diff --git a/device/main/linux-postmarketos-mainline/pmos.loongarch64.config b/device/main/linux-postmarketos-mainline/pmos.loongarch64.config index baac5027a..ea06546e5 100644 --- a/device/main/linux-postmarketos-mainline/pmos.loongarch64.config +++ b/device/main/linux-postmarketos-mainline/pmos.loongarch64.config @@ -448,9 +448,20 @@ CONFIG_FUNCTION_TRACER=y CONFIG_EFIVAR_FS=m CONFIG_DM_VERITY=m +# hardening +CONFIG_SECURITY_DMESG_RESTRICT=y + # rust # CONFIG_DEBUG_INFO_BTF is not set # CONFIG_DEBUG_INFO_BTF_MODULES is not set +# selinux +CONFIG_AUDIT=y +CONFIG_DEFAULT_SECURITY_SELINUX=y +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" +CONFIG_SECURITY_NETWORK=y +CONFIG_SECURITY_SELINUX=y +CONFIG_SECURITY_SELINUX_BOOTPARAM=y + # wine CONFIG_NTSYNC=m diff --git a/device/main/linux-postmarketos-mainline/pmos.ppc64le.config b/device/main/linux-postmarketos-mainline/pmos.ppc64le.config index 37156aed4..4cff8cd9e 100644 --- a/device/main/linux-postmarketos-mainline/pmos.ppc64le.config +++ b/device/main/linux-postmarketos-mainline/pmos.ppc64le.config @@ -436,9 +436,20 @@ CONFIG_FUNCTION_TRACER=y # immutable CONFIG_DM_VERITY=m +# hardening +CONFIG_SECURITY_DMESG_RESTRICT=y + # rust # CONFIG_DEBUG_INFO_BTF is not set # CONFIG_DEBUG_INFO_BTF_MODULES is not set +# selinux +CONFIG_AUDIT=y +CONFIG_DEFAULT_SECURITY_SELINUX=y +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" +CONFIG_SECURITY_NETWORK=y +CONFIG_SECURITY_SELINUX=y +CONFIG_SECURITY_SELINUX_BOOTPARAM=y + # wine CONFIG_NTSYNC=m diff --git a/device/main/linux-postmarketos-mainline/pmos.riscv64.config b/device/main/linux-postmarketos-mainline/pmos.riscv64.config index 4a6100040..274ebbf31 100644 --- a/device/main/linux-postmarketos-mainline/pmos.riscv64.config +++ b/device/main/linux-postmarketos-mainline/pmos.riscv64.config @@ -450,6 +450,7 @@ CONFIG_EFIVAR_FS=m CONFIG_DM_VERITY=m # hardening +CONFIG_SECURITY_DMESG_RESTRICT=y CONFIG_CFI=y # CONFIG_CFI_PERMISSIVE is not set CONFIG_CFI_ICALL_NORMALIZE_INTEGERS=y @@ -459,5 +460,13 @@ CONFIG_SHADOW_CALL_STACK=y # CONFIG_DEBUG_INFO_BTF is not set # CONFIG_DEBUG_INFO_BTF_MODULES is not set +# selinux +CONFIG_AUDIT=y +CONFIG_DEFAULT_SECURITY_SELINUX=y +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" +CONFIG_SECURITY_NETWORK=y +CONFIG_SECURITY_SELINUX=y +CONFIG_SECURITY_SELINUX_BOOTPARAM=y + # wine CONFIG_NTSYNC=m diff --git a/device/main/linux-postmarketos-mainline/pmos.x86.config b/device/main/linux-postmarketos-mainline/pmos.x86.config index 282fc9e7d..1e190c9e1 100644 --- a/device/main/linux-postmarketos-mainline/pmos.x86.config +++ b/device/main/linux-postmarketos-mainline/pmos.x86.config @@ -451,9 +451,20 @@ CONFIG_FUNCTION_TRACER=y CONFIG_EFIVAR_FS=m CONFIG_DM_VERITY=m +# hardening +CONFIG_SECURITY_DMESG_RESTRICT=y + # rust # CONFIG_DEBUG_INFO_BTF is not set # CONFIG_DEBUG_INFO_BTF_MODULES is not set +# selinux +CONFIG_AUDIT=y +CONFIG_DEFAULT_SECURITY_SELINUX=y +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" +CONFIG_SECURITY_NETWORK=y +CONFIG_SECURITY_SELINUX=y +CONFIG_SECURITY_SELINUX_BOOTPARAM=y + # wine CONFIG_NTSYNC=m diff --git a/device/main/linux-postmarketos-mainline/pmos.x86_64.config b/device/main/linux-postmarketos-mainline/pmos.x86_64.config index b6305ef8e..a9188235d 100644 --- a/device/main/linux-postmarketos-mainline/pmos.x86_64.config +++ b/device/main/linux-postmarketos-mainline/pmos.x86_64.config @@ -454,6 +454,7 @@ CONFIG_EFIVAR_FS=m CONFIG_DM_VERITY=m # hardening +CONFIG_SECURITY_DMESG_RESTRICT=y CONFIG_CFI=y # CONFIG_CFI_PERMISSIVE is not set CONFIG_CFI_ICALL_NORMALIZE_INTEGERS=y @@ -462,5 +463,13 @@ CONFIG_CFI_ICALL_NORMALIZE_INTEGERS=y # CONFIG_DEBUG_INFO_BTF is not set # CONFIG_DEBUG_INFO_BTF_MODULES is not set +# selinux +CONFIG_AUDIT=y +CONFIG_DEFAULT_SECURITY_SELINUX=y +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf" +CONFIG_SECURITY_NETWORK=y +CONFIG_SECURITY_SELINUX=y +CONFIG_SECURITY_SELINUX_BOOTPARAM=y + # wine CONFIG_NTSYNC=m