folkslinux
/
CBL-Mariner
mirror of https://github.com/microsoft/CBL-Mariner.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

kernel: turn on landlock (#3484)

This commit is contained in:
rlmenge 2022-08-04 13:19:38 -07:00 committed by GitHub
parent 48baac17e7
commit 67b5ba4bf0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
10 changed files with 22 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
SPECS-SIGNED/kernel-signed/kernel-signed.spec
View File

@ -10,7 +10,7 @@
Summary: Signed Linux Kernel for %{buildarch} systems
Name: kernel-signed-%{buildarch}
Version: 5.15.57.1
Release: 2%{?dist}
Release: 3%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Mariner
@ -153,6 +153,9 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg
%exclude /module_info.ld
%changelog
* Tue Aug 02 2022 Rachel Menge <rachelmenge@microsoft.com> - 5.15.57.1-3
- Bump release number to match kernel release
* Mon Aug 01 2022 Rachel Menge <rachelmenge@microsoft.com> - 5.15.57.1-2
- Bump release number to match kernel release

5
SPECS/kernel-headers/kernel-headers.spec
View File

@ -1,7 +1,7 @@
Summary: Linux API header files
Name: kernel-headers
Version: 5.15.57.1
Release: 2%{?dist}
Release: 3%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Mariner
@ -36,6 +36,9 @@ cp -rv usr/include/* /%{buildroot}%{_includedir}
%{_includedir}/*
%changelog
* Tue Aug 02 2022 Rachel Menge <rachelmenge@microsoft.com> - 5.15.57.1-3
- Bump release number to match kernel release
* Mon Aug 01 2022 Rachel Menge <rachelmenge@microsoft.com> - 5.15.57.1-2
- Bump release number to match kernel release

4
SPECS/kernel/config
View File

@ -6773,7 +6773,7 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
# CONFIG_SECURITY_LANDLOCK is not set
CONFIG_SECURITY_LANDLOCK=y
CONFIG_INTEGRITY=y
# CONFIG_INTEGRITY_SIGNATURE is not set
CONFIG_INTEGRITY_AUDIT=y
@ -6798,7 +6798,7 @@ CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS=y
# CONFIG_DEFAULT_SECURITY_SELINUX is not set
CONFIG_DEFAULT_SECURITY_APPARMOR=y
# CONFIG_DEFAULT_SECURITY_DAC is not set
CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,apparmor,selinux,tomoyo"
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,apparmor,selinux,tomoyo"
#
# Kernel hardening options

4
SPECS/kernel/config_aarch64
View File

@ -8954,7 +8954,7 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
# CONFIG_SECURITY_LANDLOCK is not set
CONFIG_SECURITY_LANDLOCK=y
CONFIG_INTEGRITY=y
# CONFIG_INTEGRITY_SIGNATURE is not set
CONFIG_INTEGRITY_AUDIT=y
@ -8980,7 +8980,7 @@ CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS=y
# CONFIG_DEFAULT_SECURITY_SELINUX is not set
CONFIG_DEFAULT_SECURITY_APPARMOR=y
# CONFIG_DEFAULT_SECURITY_DAC is not set
CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,apparmor,selinux,tomoyo"
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,apparmor,selinux,tomoyo"
#
# Kernel hardening options

4
SPECS/kernel/kernel.signatures.json
View File

@ -1,8 +1,8 @@
{
"Signatures": {
"cbl-mariner-ca-20211013.pem": "5ef124b0924cb1047c111a0ecff1ae11e6ad7cac8d1d9b40f98f99334121f0b0",
"config": "a62487f734129283b6ac8d39bc9904d281af8ed59741dd7f412fb37e7544a715",
"config_aarch64": "7cd37ede6cd4af979c4ac4a42054c8093e309d776a113f47c1ba0f71d5fb2645",
"config": "fe08d6d95149bc0be3a3b890d50e617751a2d9a2a62634e27299d13fb9773303",
"config_aarch64": "744a209729a6adb0d254fd62c6487d07d610e417c0c1a7730129481985508249",
"sha512hmac-openssl.sh": "02ab91329c4be09ee66d759e4d23ac875037c3b56e5a598e32fd1206da06a27f",
"kernel-5.15.57.1.tar.gz": "010bbb79b84d9df58a1b8d3198d46466d9d042e3fb2fe24b7b9ef10c109449a8"
}

5
SPECS/kernel/kernel.spec
View File

@ -18,7 +18,7 @@
Summary: Linux Kernel
Name: kernel
Version: 5.15.57.1
Release: 2%{?dist}
Release: 3%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Mariner
@ -391,6 +391,9 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg
%{_sysconfdir}/bash_completion.d/bpftool
%changelog
* Tue Aug 02 2022 Rachel Menge <rachelmenge@microsoft.com> - 5.15.57.1-3
- Turn on CONFIG_SECURITY_LANDLOCK
* Mon Aug 01 2022 Rachel Menge <rachelmenge@microsoft.com> - 5.15.57.1-2
- Turn on CONFIG_BLK_DEV_ZONED

2
toolkit/resources/manifests/package/pkggen_core_aarch64.txt
View File

@ -1,5 +1,5 @@
filesystem-1.1-10.cm2.aarch64.rpm
kernel-headers-5.15.57.1-2.cm2.noarch.rpm
kernel-headers-5.15.57.1-3.cm2.noarch.rpm
glibc-2.35-2.cm2.aarch64.rpm
glibc-devel-2.35-2.cm2.aarch64.rpm
glibc-i18n-2.35-2.cm2.aarch64.rpm

2
toolkit/resources/manifests/package/pkggen_core_x86_64.txt
View File

@ -1,5 +1,5 @@
filesystem-1.1-10.cm2.x86_64.rpm
kernel-headers-5.15.57.1-2.cm2.noarch.rpm
kernel-headers-5.15.57.1-3.cm2.noarch.rpm
glibc-2.35-2.cm2.x86_64.rpm
glibc-devel-2.35-2.cm2.x86_64.rpm
glibc-i18n-2.35-2.cm2.x86_64.rpm

2
toolkit/resources/manifests/package/toolchain_aarch64.txt
View File

@ -131,7 +131,7 @@ intltool-0.51.0-7.cm2.noarch.rpm
itstool-2.0.6-4.cm2.noarch.rpm
kbd-2.2.0-1.cm2.aarch64.rpm
kbd-debuginfo-2.2.0-1.cm2.aarch64.rpm
kernel-headers-5.15.57.1-2.cm2.noarch.rpm
kernel-headers-5.15.57.1-3.cm2.noarch.rpm
kmod-29-1.cm2.aarch64.rpm
kmod-debuginfo-29-1.cm2.aarch64.rpm
kmod-devel-29-1.cm2.aarch64.rpm

2
toolkit/resources/manifests/package/toolchain_x86_64.txt
View File

@ -131,7 +131,7 @@ intltool-0.51.0-7.cm2.noarch.rpm
itstool-2.0.6-4.cm2.noarch.rpm
kbd-2.2.0-1.cm2.x86_64.rpm
kbd-debuginfo-2.2.0-1.cm2.x86_64.rpm
kernel-headers-5.15.57.1-2.cm2.noarch.rpm
kernel-headers-5.15.57.1-3.cm2.noarch.rpm
kmod-29-1.cm2.x86_64.rpm
kmod-debuginfo-29-1.cm2.x86_64.rpm
kmod-devel-29-1.cm2.x86_64.rpm