From d9b807d2a1027385433aa66e2bd6ccafc3b096cb Mon Sep 17 00:00:00 2001 From: EnumDev Date: Fri, 18 Sep 2026 16:27:29 +0300 Subject: [PATCH] Enable some security options --- info.yml | 2 +- source-files/config | 36 ++++++++++++++++++++++++++++-------- 2 files changed, 29 insertions(+), 9 deletions(-) diff --git a/info.yml b/info.yml index ca2f534..4faa64a 100644 --- a/info.yml +++ b/info.yml @@ -1,7 +1,7 @@ name: linux-lts description: The longterm support version of the linux kernel version: 6.18.46 -revision: 1 +revision: 2 url: https://www.kernel.org/ license: GPL2-only maintainers: diff --git a/source-files/config b/source-files/config index 45efff2..17cb867 100644 --- a/source-files/config +++ b/source-files/config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.18.38 Kernel Configuration +# Linux/x86 6.18.46 Kernel Configuration # CONFIG_CC_VERSION_TEXT="clang version 22.1.8" CONFIG_GCC_VERSION=0 @@ -11,7 +11,7 @@ CONFIG_AS_VERSION=220108 CONFIG_LD_VERSION=0 CONFIG_LD_IS_LLD=y CONFIG_LLD_VERSION=220108 -CONFIG_RUSTC_VERSION=109700 +CONFIG_RUSTC_VERSION=109800 CONFIG_RUST_IS_AVAILABLE=y CONFIG_RUSTC_LLVM_VERSION=220108 CONFIG_CC_CAN_LINK=y @@ -29,6 +29,7 @@ CONFIG_RUSTC_HAS_SPAN_FILE=y CONFIG_RUSTC_HAS_UNNECESSARY_TRANSMUTES=y CONFIG_RUSTC_HAS_FILE_WITH_NUL=y CONFIG_RUSTC_HAS_FILE_AS_C_STR=y +CONFIG_RUSTC_HAS_SUSPICIOUS_RUNTIME_SYMBOL_DEFINITIONS=y CONFIG_PAHOLE_VERSION=131 CONFIG_IRQ_WORK=y CONFIG_BUILDTIME_TABLE_SORT=y @@ -297,7 +298,7 @@ CONFIG_PERF_EVENTS=y CONFIG_SYSTEM_DATA_VERIFICATION=y CONFIG_PROFILING=y CONFIG_RUST=y -CONFIG_RUSTC_VERSION_TEXT="rustc 1.97.0 (2d8144b78 2026-07-07) (for Tide Linux)" +CONFIG_RUSTC_VERSION_TEXT="rustc 1.98.0 (88d9e12ae 2026-08-18) (for Tide Linux)" CONFIG_BINDGEN_VERSION_TEXT="bindgen 0.72.1" CONFIG_TRACEPOINTS=y @@ -391,12 +392,12 @@ CONFIG_X86_MINIMUM_CPU_FAMILY=64 CONFIG_X86_DEBUGCTLMSR=y CONFIG_IA32_FEAT_CTL=y CONFIG_X86_VMX_FEATURE_NAMES=y -CONFIG_BROADCAST_TLB_FLUSH=y CONFIG_CPU_SUP_INTEL=y CONFIG_CPU_SUP_AMD=y CONFIG_CPU_SUP_HYGON=y CONFIG_CPU_SUP_CENTAUR=y CONFIG_CPU_SUP_ZHAOXIN=y +CONFIG_BROADCAST_TLB_FLUSH=y CONFIG_HPET_TIMER=y CONFIG_HPET_EMULATE_RTC=y CONFIG_DMI=y @@ -969,6 +970,7 @@ CONFIG_ARCH_HAS_CPU_ATTACK_VECTORS=y # end of General architecture-dependent options CONFIG_RT_MUTEXES=y +CONFIG_MODULE_SIG_FORMAT=y CONFIG_MODULES=y # CONFIG_MODULE_DEBUG is not set # CONFIG_MODULE_FORCE_LOAD is not set @@ -977,7 +979,17 @@ CONFIG_MODULE_FORCE_UNLOAD=y # CONFIG_MODULE_UNLOAD_TAINT_TRACKING is not set # CONFIG_MODVERSIONS is not set # CONFIG_MODULE_SRCVERSION_ALL is not set -# CONFIG_MODULE_SIG is not set +CONFIG_MODULE_SIG=y +# CONFIG_MODULE_SIG_FORCE is not set +CONFIG_MODULE_SIG_ALL=y +# CONFIG_MODULE_SIG_SHA1 is not set +# CONFIG_MODULE_SIG_SHA256 is not set +# CONFIG_MODULE_SIG_SHA384 is not set +CONFIG_MODULE_SIG_SHA512=y +# CONFIG_MODULE_SIG_SHA3_256 is not set +# CONFIG_MODULE_SIG_SHA3_384 is not set +# CONFIG_MODULE_SIG_SHA3_512 is not set +CONFIG_MODULE_SIG_HASH="sha512" # CONFIG_MODULE_COMPRESS is not set # CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set CONFIG_MODPROBE_PATH="/sbin/modprobe" @@ -4920,6 +4932,7 @@ CONFIG_AGP_INTEL=y # CONFIG_AGP_VIA is not set CONFIG_INTEL_GTT=y # CONFIG_VGA_SWITCHEROO is not set +CONFIG_GPU_BUDDY=y # CONFIG_NOVA_CORE is not set CONFIG_DRM=y @@ -7273,10 +7286,14 @@ CONFIG_SECURITY_APPARMOR_HASH_DEFAULT=y CONFIG_SECURITY_APPARMOR_EXPORT_BINARY=y CONFIG_SECURITY_APPARMOR_PARANOID_LOAD=y # CONFIG_SECURITY_LOADPIN is not set -# CONFIG_SECURITY_YAMA is not set +CONFIG_SECURITY_YAMA=y # CONFIG_SECURITY_SAFESETID is not set -# CONFIG_SECURITY_LOCKDOWN_LSM is not set -# CONFIG_SECURITY_LANDLOCK is not set +CONFIG_SECURITY_LOCKDOWN_LSM=y +CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y +CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y +# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set +# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set +CONFIG_SECURITY_LANDLOCK=y # CONFIG_SECURITY_IPE is not set CONFIG_INTEGRITY=y # CONFIG_INTEGRITY_SIGNATURE is not set @@ -7575,6 +7592,9 @@ CONFIG_PKCS7_MESSAGE_PARSER=y # # Certificates for signature checking # +CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" +CONFIG_MODULE_SIG_KEY_TYPE_RSA=y +# CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_SYSTEM_TRUSTED_KEYS="" # CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set