diff options
author | Bruce Ashfield <bruce.ashfield@gmail.com> | 2024-01-19 16:14:15 -0500 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2024-01-22 13:39:22 +0000 |
commit | 68aa1522ae222813e58f0890ffd7242ff02fa528 (patch) | |
tree | 541bd58f8232058a7bbb204db83ce4f131119009 | |
parent | e35d26b8525f0d6d8877a7971a99c7f4be1a29fa (diff) | |
download | poky-68aa1522ae222813e58f0890ffd7242ff02fa528.tar.gz |
linux-yocto/6.1: security/cfg: add configs to harden protection
Integrating the following commit(s) to linux-yocto/.:
1/1 [
Author: Xiangyu Chen
Email: xiangyu.chen@windriver.com
Subject: feature/security: add configs to harden protection
Date: Tue, 16 Jan 2024 18:22:31 +0800
Add some configs to harden protection:
CONFIG_HW_RANDOM_TPM=y Exposing the TPM's Random Number Generator as a hwrng device.
CONFIG_DEBUG_WX=y Warn on W+X mappings at boot.
CONFIG_SECURITY_DMESG_RESTRICT=y Restrict unprivileged access to the kernel syslog.
CONFIG_LDISC_AUTOLOAD=n Disable automatically load TTY Line Disciplines.
Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
]
(From OE-Core rev: 33d3dd8f5469cb0b2999d7f935378899d447b3ce)
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r-- | meta/recipes-kernel/linux/linux-yocto-rt_6.1.bb | 2 | ||||
-rw-r--r-- | meta/recipes-kernel/linux/linux-yocto-tiny_6.1.bb | 2 | ||||
-rw-r--r-- | meta/recipes-kernel/linux/linux-yocto_6.1.bb | 2 |
3 files changed, 3 insertions, 3 deletions
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.1.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.1.bb index 2d471e3ee3..857197b211 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.1.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.1.bb | |||
@@ -15,7 +15,7 @@ python () { | |||
15 | } | 15 | } |
16 | 16 | ||
17 | SRCREV_machine ?= "6d67557b912380b57b6081da7ac106e9c003f4d1" | 17 | SRCREV_machine ?= "6d67557b912380b57b6081da7ac106e9c003f4d1" |
18 | SRCREV_meta ?= "dd140f6b950d56c837dc464af8f2a2a53af24fbf" | 18 | SRCREV_meta ?= "74fa91143e9076e0d1d5ff0cca93987b3330bf27" |
19 | 19 | ||
20 | SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ | 20 | SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ |
21 | git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.1;destsuffix=${KMETA};protocol=https" | 21 | git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.1;destsuffix=${KMETA};protocol=https" |
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.1.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.1.bb index 3314e7b2f1..55f78404b1 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.1.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.1.bb | |||
@@ -18,7 +18,7 @@ KMETA = "kernel-meta" | |||
18 | KCONF_BSP_AUDIT_LEVEL = "2" | 18 | KCONF_BSP_AUDIT_LEVEL = "2" |
19 | 19 | ||
20 | SRCREV_machine ?= "d08880e7ec70e70249f80b8305da8e90bd47c606" | 20 | SRCREV_machine ?= "d08880e7ec70e70249f80b8305da8e90bd47c606" |
21 | SRCREV_meta ?= "dd140f6b950d56c837dc464af8f2a2a53af24fbf" | 21 | SRCREV_meta ?= "74fa91143e9076e0d1d5ff0cca93987b3330bf27" |
22 | 22 | ||
23 | PV = "${LINUX_VERSION}+git" | 23 | PV = "${LINUX_VERSION}+git" |
24 | 24 | ||
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.1.bb b/meta/recipes-kernel/linux/linux-yocto_6.1.bb index fd018db6ed..a75efe66de 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.1.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.1.bb | |||
@@ -29,7 +29,7 @@ SRCREV_machine:qemux86 ?= "d08880e7ec70e70249f80b8305da8e90bd47c606" | |||
29 | SRCREV_machine:qemux86-64 ?= "d08880e7ec70e70249f80b8305da8e90bd47c606" | 29 | SRCREV_machine:qemux86-64 ?= "d08880e7ec70e70249f80b8305da8e90bd47c606" |
30 | SRCREV_machine:qemumips64 ?= "3407157586b654c9932356124429ee9dc9f56f18" | 30 | SRCREV_machine:qemumips64 ?= "3407157586b654c9932356124429ee9dc9f56f18" |
31 | SRCREV_machine ?= "d08880e7ec70e70249f80b8305da8e90bd47c606" | 31 | SRCREV_machine ?= "d08880e7ec70e70249f80b8305da8e90bd47c606" |
32 | SRCREV_meta ?= "dd140f6b950d56c837dc464af8f2a2a53af24fbf" | 32 | SRCREV_meta ?= "74fa91143e9076e0d1d5ff0cca93987b3330bf27" |
33 | 33 | ||
34 | # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll | 34 | # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll |
35 | # get the <version>/base branch, which is pure upstream -stable, and the same | 35 | # get the <version>/base branch, which is pure upstream -stable, and the same |