From d80e880f28833d7d50507388e3b491c1ab77eb91 Mon Sep 17 00:00:00 2001 From: Tycho Andersen Date: Thu, 18 May 2017 10:55:04 -0600 Subject: [PATCH] projects: add IMA namespacing project This is a project with a v1 of the IMA namespacing patches. See the readme for details on use. Signed-off-by: Tycho Andersen --- projects/README.md | 2 + projects/ima-namespace/Makefile | 10 + projects/ima-namespace/README.md | 42 + projects/ima-namespace/ima-namespace.yml | 26 + projects/ima-namespace/init/Dockerfile | 12 + projects/ima-namespace/init/Makefile | 14 + .../ima-namespace/init/etc/init.d/containerd | 9 + .../ima-namespace/init/etc/init.d/containers | 32 + projects/ima-namespace/init/etc/init.d/rcS | 112 + projects/ima-namespace/init/etc/inittab | 15 + projects/ima-namespace/init/etc/issue | 12 + projects/ima-namespace/init/init | 45 + projects/ima-namespace/kernel/.gitignore | 6 + projects/ima-namespace/kernel/Dockerfile | 73 + projects/ima-namespace/kernel/Makefile | 66 + .../ima-namespace/kernel/kernel_config-4.11.x | 3838 +++++++++++++++++ .../ima-namespace/kernel/kernel_config.debug | 26 + ...ualify-pathname-in-audit-info-record.patch | 44 + ...pathname-in-audit-measurement-record.patch | 52 + ...qualify-pathname-in-measurement-file.patch | 210 + ...support-to-namespace-securityfs-file.patch | 262 ++ ...mespace-policy-structure-in-a-radix-.patch | 301 ++ ...s-release-namespace-policy-resources.patch | 104 + ...e-policy-structure-to-track-initial-.patch | 313 ++ ...l-namespace-id-on-the-namespace-poli.patch | 61 + ...pace-policy-securityfs-file-in-write.patch | 70 + ...-policy-flags-per-namespace-using-im.patch | 689 +++ ...e-per-namespace-with-new-enforce_ns-.patch | 141 + 28 files changed, 6587 insertions(+) create mode 100644 projects/ima-namespace/Makefile create mode 100644 projects/ima-namespace/README.md create mode 100644 projects/ima-namespace/ima-namespace.yml create mode 100644 projects/ima-namespace/init/Dockerfile create mode 100644 projects/ima-namespace/init/Makefile create mode 100755 projects/ima-namespace/init/etc/init.d/containerd create mode 100755 projects/ima-namespace/init/etc/init.d/containers create mode 100755 projects/ima-namespace/init/etc/init.d/rcS create mode 100644 projects/ima-namespace/init/etc/inittab create mode 100644 projects/ima-namespace/init/etc/issue create mode 100755 projects/ima-namespace/init/init create mode 100644 projects/ima-namespace/kernel/.gitignore create mode 100644 projects/ima-namespace/kernel/Dockerfile create mode 100644 projects/ima-namespace/kernel/Makefile create mode 100644 projects/ima-namespace/kernel/kernel_config-4.11.x create mode 100644 projects/ima-namespace/kernel/kernel_config.debug create mode 100644 projects/ima-namespace/kernel/patches-4.11.x/0001-ima-qualify-pathname-in-audit-info-record.patch create mode 100644 projects/ima-namespace/kernel/patches-4.11.x/0002-ima-qualify-pathname-in-audit-measurement-record.patch create mode 100644 projects/ima-namespace/kernel/patches-4.11.x/0003-ima-qualify-pathname-in-measurement-file.patch create mode 100644 projects/ima-namespace/kernel/patches-4.11.x/0004-ima-add-support-to-namespace-securityfs-file.patch create mode 100644 projects/ima-namespace/kernel/patches-4.11.x/0005-ima-store-new-namespace-policy-structure-in-a-radix-.patch create mode 100644 projects/ima-namespace/kernel/patches-4.11.x/0006-ima-fs-release-namespace-policy-resources.patch create mode 100644 projects/ima-namespace/kernel/patches-4.11.x/0007-ima-new-namespace-policy-structure-to-track-initial-.patch create mode 100644 projects/ima-namespace/kernel/patches-4.11.x/0008-ima-block-initial-namespace-id-on-the-namespace-poli.patch create mode 100644 projects/ima-namespace/kernel/patches-4.11.x/0009-ima-delete-namespace-policy-securityfs-file-in-write.patch create mode 100644 projects/ima-namespace/kernel/patches-4.11.x/0010-ima-handling-all-policy-flags-per-namespace-using-im.patch create mode 100644 projects/ima-namespace/kernel/patches-4.11.x/0011-ima-appraise-mode-per-namespace-with-new-enforce_ns-.patch diff --git a/projects/README.md b/projects/README.md index 03dc488ef..59f8435ca 100644 --- a/projects/README.md +++ b/projects/README.md @@ -22,6 +22,8 @@ If you want to create a project, please submit a pull request to create a new di - [Logging](logging/) Experimental logging tools - [etcd cluster](etcd/) etcd cluster demo from DockerCon'17 - [kernel-config](kernel-config/) an experiment on how to manage kernel config +- [IMA-namespace](ima-namespace/) patches for supporting per-mount-namespace + IMA policies ## Current projects not yet documented - VMWare support (VMWare) diff --git a/projects/ima-namespace/Makefile b/projects/ima-namespace/Makefile new file mode 100644 index 000000000..08770f129 --- /dev/null +++ b/projects/ima-namespace/Makefile @@ -0,0 +1,10 @@ +.PHONY: run +run: ima-namespace-kernel + ../../bin/linuxkit run ima-namespace + +ima-namespace-kernel: + ../../bin/moby build ima-namespace + +.PHONY: clean +clean: + -rm *-cmdline *-kernel *.img diff --git a/projects/ima-namespace/README.md b/projects/ima-namespace/README.md new file mode 100644 index 000000000..d6d12a767 --- /dev/null +++ b/projects/ima-namespace/README.md @@ -0,0 +1,42 @@ +## IMA namespace patches + +These are draft patches for an implementation of IMA namespacing. They are +currently a rebased version of the v1 set posted here [1]. + +### Usage + +Let's suppose you have some sensitive files owned by a particular user that you +want to keep secure: + + sensitive=/tmp/foo + user=71452 + mkdir -p $(dirname $sensitive) && echo "hello" > $sensitive + chown $user $sensitive + +To use IMA in the per-namespace mode, you need ima\_appraise=enforce\_ns on the +kernel CLI (this is done in the yaml file). Then, the userspace interface looks +something like this: + + # create a new mount namespace + unshare -m + + # enable per-ns policy for this new namespace + nsid=$(readlink /proc/self/ns/mnt | cut -c '6-15') + echo ${nsid} > /sys/kernel/security/ima/namespaces + + # set the policy (we use tmpfs magic here since that's all that linuxkit + # has available to write to for this example) + TMPFS_MAGIC=0x01021994 + printf "appraise fsmagic=$TMPFS_MAGIC fowner=$user\nappraise func=MODULE_CHECK" > /sys/kernel/security/ima/$nsid/policy + + hash=$(echo -e "\x4$(openssl dgst -sha256 -binary $sensitive)") + setfattr -n security.ima -v "${hash}" $sensitive + +And now you should be able to see things failing: + + moby:/# echo foo > /tmp/foo + moby:/# cat /tmp/foo + [ 3233.681544] audit: type=1800 audit(1495131746.610:29): pid=384 uid=0 auid=4294967295 ses=4294967295 op="appraise_data" cause="invalid-hash" comm="cat" name="/tmp/foo" mnt_ns=4026532208 dev="tmpfs" ino=13105 res=0 + cat: can't open '/tmp/foo': Permission denied + +[1]: https://lkml.org/lkml/2017/5/11/699 diff --git a/projects/ima-namespace/ima-namespace.yml b/projects/ima-namespace/ima-namespace.yml new file mode 100644 index 000000000..93ac38520 --- /dev/null +++ b/projects/ima-namespace/ima-namespace.yml @@ -0,0 +1,26 @@ +kernel: + image: "linuxkit/kernel-ima:4.11.x" + cmdline: "console=ttyS0 page_poison=1 ima_appraise=enforce_ns" +init: + - linuxkit/init-ima:1bf49efd6df8d137813884211860607c58ff383e + - mobylinux/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9 + - mobylinux/containerd:18eaf72f3f4f9a9f29ca1951f66df701f873060b + - mobylinux/ca-certificates:eabc5a6e59f05aa91529d80e9a595b85b046f935 +onboot: + - name: sysctl + image: "mobylinux/sysctl:2cf2f9d5b4d314ba1bfc22b2fe931924af666d8c" + net: host + pid: host + ipc: host + capabilities: + - CAP_SYS_ADMIN + readonly: true +services: + - name: rngd + image: "mobylinux/rngd:3dad6dd43270fa632ac031e99d1947f20b22eec9" + capabilities: + - CAP_SYS_ADMIN + oomScoreAdj: -800 + readonly: true +outputs: + - format: kernel+initrd diff --git a/projects/ima-namespace/init/Dockerfile b/projects/ima-namespace/init/Dockerfile new file mode 100644 index 000000000..f6f86d17a --- /dev/null +++ b/projects/ima-namespace/init/Dockerfile @@ -0,0 +1,12 @@ +# Use sha256 here to get a fixed version +FROM alpine:edge +ENTRYPOINT [] +CMD [] +WORKDIR / +COPY init / +COPY etc etc/ + +RUN ip a +RUN apk update +RUN apk add --no-cache attr openssl +RUN rm -rf /mirror /etc/apk/repositories /etc/apk/keys diff --git a/projects/ima-namespace/init/Makefile b/projects/ima-namespace/init/Makefile new file mode 100644 index 000000000..3f465ad25 --- /dev/null +++ b/projects/ima-namespace/init/Makefile @@ -0,0 +1,14 @@ +.PHONY: tag push +default: push + +IMAGE=init-ima +DEPS=Dockerfile init $(wildcard etc/*) $(wildcard etc/init.d/*) + +HASH?=$(shell git ls-tree HEAD -- ../$(notdir $(CURDIR)) | awk '{print $$3}') + +tag: $(DEPS) + docker build --no-cache -t linuxkit/$(IMAGE):$(HASH) . + +push: tag + docker pull linuxkit/$(IMAGE):$(HASH) || \ + docker push linuxkit/$(IMAGE):$(HASH) diff --git a/projects/ima-namespace/init/etc/init.d/containerd b/projects/ima-namespace/init/etc/init.d/containerd new file mode 100755 index 000000000..f62710d7e --- /dev/null +++ b/projects/ima-namespace/init/etc/init.d/containerd @@ -0,0 +1,9 @@ +#!/bin/sh + +# bring up containerd +ulimit -n 1048576 +ulimit -p unlimited + +printf "\nStarting containerd\n" +mkdir -p /var/log +exec /usr/bin/containerd diff --git a/projects/ima-namespace/init/etc/init.d/containers b/projects/ima-namespace/init/etc/init.d/containers new file mode 100755 index 000000000..982a1bafc --- /dev/null +++ b/projects/ima-namespace/init/etc/init.d/containers @@ -0,0 +1,32 @@ +#!/bin/sh + +# start onboot containers, run to completion + +if [ -d /containers/onboot ] +then + for f in $(find /containers/onboot -mindepth 1 -maxdepth 1 | sort) + do + base="$(basename $f)" + /bin/mount --bind "$f/rootfs" "$f/rootfs" + mount -o remount,rw "$f/rootfs" + /usr/bin/runc run --bundle "$f" "$(basename $f)" + printf " - $base\n" + done +fi + +# start service containers + +if [ -d /containers/services ] +then + for f in $(find /containers/services -mindepth 1 -maxdepth 1 | sort) + do + base="$(basename $f)" + /bin/mount --bind "$f/rootfs" "$f/rootfs" + mount -o remount,rw "$f/rootfs" + log="/var/log/$base.log" + ctr run --runtime-config "$f/config.json" --rootfs "$f/rootfs" --id "$(basename $f)" $log >$log & + printf " - $base\n" + done +fi + +wait diff --git a/projects/ima-namespace/init/etc/init.d/rcS b/projects/ima-namespace/init/etc/init.d/rcS new file mode 100755 index 000000000..339a428ba --- /dev/null +++ b/projects/ima-namespace/init/etc/init.d/rcS @@ -0,0 +1,112 @@ +#!/bin/sh + +# mount filesystems +mount -n -t proc proc /proc -o nodev,nosuid,noexec,relatime + +mount -n -t tmpfs tmpfs /run -o nodev,nosuid,noexec,relatime,size=10%,mode=755 +mount -n -t tmpfs tmpfs /tmp -o nodev,nosuid,noexec,relatime,size=10%,mode=1777 + +# mount devfs +mount -n -t devtmpfs dev /dev -o nosuid,noexec,relatime,size=10m,nr_inodes=248418,mode=755 +# devices +[ -c /dev/console ] || mknod -m 600 /dev/console c 5 1 +[ -c /dev/tty1 ] || mknod -m 620 /dev/tty1 c 4 1 +[ -c /dev/tty ] || mknod -m 666 /dev/tty c 5 0 + +[ -c /dev/null ] || mknod -m 666 /dev/null c 1 3 +[ -c /dev/kmsg ] || mknod -m 660 /dev/kmsg c 1 11 + +# extra symbolic links not provided by default +[ -e /dev/fd ] || ln -snf /proc/self/fd /dev/fd +[ -e /dev/stdin ] || ln -snf /proc/self/fd/0 /dev/stdin +[ -e /dev/stdout ] || ln -snf /proc/self/fd/1 /dev/stdout +[ -e /dev/stderr ] || ln -snf /proc/self/fd/2 /dev/stderr +[ -e /proc/kcore ] && ln -snf /proc/kcore /dev/core + +# devfs filesystems +mkdir -p -m 1777 /dev/mqueue +mkdir -p -m 1777 /dev/shm +mkdir -p -m 0755 /dev/pts +mount -n -t mqueue -o noexec,nosuid,nodev mqueue /dev/mqueue +mount -n -t tmpfs -o noexec,nosuid,nodev,mode=1777 shm /dev/shm +mount -n -t devpts -o noexec,nosuid,gid=5,mode=0620 devpts /dev/pts + +# mount sysfs +sysfs_opts=nodev,noexec,nosuid +mount -n -t sysfs -o ${sysfs_opts} sysfs /sys +[ -d /sys/kernel/security ] && mount -n -t securityfs -o ${sysfs_opts} securityfs /sys/kernel/security +[ -d /sys/kernel/debug ] && mount -n -t debugfs -o ${sysfs_opts} debugfs /sys/kernel/debug +[ -d /sys/kernel/config ] && mount -n -t configfs -o ${sysfs_opts} configfs /sys/kernel/config +[ -d /sys/fs/fuse/connections ] && mount -n -t fusectl -o ${sysfs_opts} fusectl /sys/fs/fuse/connections +[ -d /sys/fs/selinux ] && mount -n -t selinuxfs -o nosuid,noexec selinuxfs /sys/fs/selinux +[ -d /sys/fs/pstore ] && mount -n -t pstore pstore -o ${sysfs_opts} /sys/fs/pstore +[ -d /sys/firmware/efi/efivars ] && mount -n -t efivarfs -o ro,${sysfs_opts} efivarfs /sys/firmware/efi/efivars + +# misc /proc mounted fs +[ -d /proc/sys/fs/binfmt_misc ] && mount -t binfmt_misc -o nodev,noexec,nosuid binfmt_misc /proc/sys/fs/binfmt_misc + +# mount cgroups +mount -n -t tmpfs -o nodev,noexec,nosuid,mode=755,size=10m cgroup_root /sys/fs/cgroup + +while read name hier groups enabled rest +do + case "${enabled}" in + 1) mkdir -p /sys/fs/cgroup/${name} + mount -n -t cgroup -o ${sysfs_opts},${name} ${name} /sys/fs/cgroup/${name} + ;; + esac +done < /proc/cgroups + +# use hierarchy for memory +echo 1 > /sys/fs/cgroup/memory/memory.use_hierarchy + +# for compatibility +mkdir -p /sys/fs/cgroup/systemd +mount -t cgroup -o none,name=systemd cgroup /sys/fs/cgroup/systemd + +# start mdev for hotplug +echo "/sbin/mdev" > /proc/sys/kernel/hotplug + +# mdev -s will not create /dev/usb[1-9] devices with recent kernels +# so we trigger hotplug events for usb for now +for i in $(find /sys/devices -name 'usb[0-9]*'); do + [ -e $i/uevent ] && echo add > $i/uevent +done + +mdev -s + +# set hostname +if [ -s /etc/hostname ] +then + hostname -F /etc/hostname +fi + +if [ $(hostname) = "(none)" -a -f /sys/class/net/eth0/address ] +then + mac=$(cat /sys/class/net/eth0/address) + hostname linuxkit-$(echo $mac | sed 's/://g') +fi + +# set system clock from hwclock +hwclock --hctosys --utc + +# bring up loopback interface +ip addr add 127.0.0.1/8 dev lo brd + scope host +ip route add 127.0.0.0/8 dev lo scope host +ip link set lo up + +# for containerising dhcpcd and other containers that need writable etc +mkdir /tmp/etc +mv /etc/resolv.conf /tmp/etc/resolv.conf +ln -snf /tmp/etc/resolv.conf /etc/resolv.conf + +# remount rootfs as readonly +mount -o remount,ro / + +# make /var writeable and shared +mount -o bind /var /var +mount -o remount,rw,nodev,nosuid,noexec,relatime /var /var +mount --make-rshared /var + +# make / rshared +mount --make-rshared / diff --git a/projects/ima-namespace/init/etc/inittab b/projects/ima-namespace/init/etc/inittab new file mode 100644 index 000000000..8ef3e8565 --- /dev/null +++ b/projects/ima-namespace/init/etc/inittab @@ -0,0 +1,15 @@ +# /etc/inittab + +::sysinit:/etc/init.d/rcS +::once:/etc/init.d/containerd +::once:/etc/init.d/containers + +# Stuff to do for the 3-finger salute +::ctrlaltdel:/sbin/reboot + +# Stuff to do before rebooting +::shutdown:/usr/sbin/killall5 -15 +::shutdown:/bin/sleep 5 +::shutdown:/usr/sbin/killall5 -9 +::shutdown:/bin/echo "Unmounting filesystems" +::shutdown:/bin/umount -a -r diff --git a/projects/ima-namespace/init/etc/issue b/projects/ima-namespace/init/etc/issue new file mode 100644 index 000000000..ac3f79e41 --- /dev/null +++ b/projects/ima-namespace/init/etc/issue @@ -0,0 +1,12 @@ + +Welcome to LinuxKit + + ## . + ## ## ## == + ## ## ## ## ## === + /"""""""""""""""""\___/ === + ~~~ {~~ ~~~~ ~~~ ~~~~ ~~~ ~ / ===- ~~~ + \______ o __/ + \ \ __/ + \____\_______/ + diff --git a/projects/ima-namespace/init/init b/projects/ima-namespace/init/init new file mode 100755 index 000000000..f27b647b0 --- /dev/null +++ b/projects/ima-namespace/init/init @@ -0,0 +1,45 @@ +#!/bin/sh + +setup_console() { + tty=${1%,*} + speed=${1#*,} + inittab="$2" + securetty="$3" + line= + term="linux" + [ "$speed" = "$1" ] && speed=115200 + + case "$tty" in + ttyS*|ttyAMA*|ttyUSB*|ttyMFD*) + line="-L" + term="vt100" + ;; + tty?) + line="" + speed="38400" + term="" + ;; + esac + # skip consoles already in inittab + grep -q "^$tty:" "$inittab" && return + + echo "$tty::once:cat /etc/issue" >> "$inittab" + echo "$tty::respawn:/sbin/getty -n -l /bin/sh $line $speed $tty $term" >> "$inittab" + if ! grep -q -w "$tty" "$securetty"; then + echo "$tty" >> "$securetty" + fi +} + +/bin/mount -t tmpfs tmpfs /mnt + +/bin/cp -a / /mnt 2>/dev/null + +/bin/mount -t proc -o noexec,nosuid,nodev proc /proc +for opt in $(cat /proc/cmdline); do + case "$opt" in + console=*) + setup_console ${opt#console=} /mnt/etc/inittab /mnt/etc/securetty;; + esac +done + +exec /bin/busybox switch_root /mnt /sbin/init diff --git a/projects/ima-namespace/kernel/.gitignore b/projects/ima-namespace/kernel/.gitignore new file mode 100644 index 000000000..6405fb210 --- /dev/null +++ b/projects/ima-namespace/kernel/.gitignore @@ -0,0 +1,6 @@ +x86_64/ +etc/ +lib/ +usr/ +sbin/ +bzImage diff --git a/projects/ima-namespace/kernel/Dockerfile b/projects/ima-namespace/kernel/Dockerfile new file mode 100644 index 000000000..797831a54 --- /dev/null +++ b/projects/ima-namespace/kernel/Dockerfile @@ -0,0 +1,73 @@ +FROM linuxkit/kernel-compile:1b396c221af673757703258159ddc8539843b02b@sha256:6b32d205bfc6407568324337b707d195d027328dbfec554428ea93e7b0a8299b AS kernel-build + +ARG KERNEL_VERSION +ARG KERNEL_SERIES +ARG DEBUG + +ENV KERNEL_SOURCE=https://www.kernel.org/pub/linux/kernel/v4.x/linux-${KERNEL_VERSION}.tar.xz + +RUN curl -fsSL -o linux-${KERNEL_VERSION}.tar.xz ${KERNEL_SOURCE} + +RUN cat linux-${KERNEL_VERSION}.tar.xz | tar --absolute-names -xJ && mv /linux-${KERNEL_VERSION} /linux + +COPY kernel_config-${KERNEL_SERIES} /linux/arch/x86/configs/x86_64_defconfig +COPY kernel_config.debug /linux/debug_config + +RUN if [ -n "${DEBUG}" ]; then \ + sed -i 's/CONFIG_PANIC_ON_OOPS=y/# CONFIG_PANIC_ON_OOPS is not set/' /linux/arch/x86/configs/x86_64_defconfig; \ + cat /linux/debug_config >> /linux/arch/x86/configs/x86_64_defconfig; \ + fi + +# Apply local patches +COPY patches-${KERNEL_SERIES} /patches +WORKDIR /linux +RUN set -e && for patch in /patches/*.patch; do \ + echo "Applying $patch"; \ + patch -p1 < "$patch"; \ + done + +RUN mkdir /out + +# Kernel +RUN make defconfig && \ + make oldconfig && \ + make -j "$(getconf _NPROCESSORS_ONLN)" KCFLAGS="-fno-pie" && \ + cp arch/x86_64/boot/bzImage /out/kernel && \ + cp System.map /out && \ + ([ -n "${DEBUG}" ] && cp vmlinux /out || true) + +# Modules +RUN make INSTALL_MOD_PATH=/tmp/kernel-modules modules_install && \ + ( DVER=$(basename $(find /tmp/kernel-modules/lib/modules/ -mindepth 1 -maxdepth 1)) && \ + cd /tmp/kernel-modules/lib/modules/$DVER && \ + rm build source && \ + ln -s /usr/src/linux-headers-$DVER build ) && \ + ( cd /tmp/kernel-modules && tar cf /out/kernel.tar lib ) + +# Headers (userspace API) +RUN mkdir -p /tmp/kernel-headers/usr && \ + make INSTALL_HDR_PATH=/tmp/kernel-headers/usr headers_install && \ + ( cd /tmp/kernel-headers && tar cf /out/kernel-headers.tar usr ) + +# Headers (kernel development) +RUN DVER=$(basename $(find /tmp/kernel-modules/lib/modules/ -mindepth 1 -maxdepth 1)) && \ + dir=/tmp/usr/src/linux-headers-$DVER && \ + mkdir -p $dir && \ + cp /linux/.config $dir && \ + cp /linux/Module.symvers $dir && \ + find . -path './include/*' -prune -o \ + -path './arch/*/include' -prune -o \ + -path './scripts/*' -prune -o \ + -type f \( -name 'Makefile*' -o -name 'Kconfig*' -o -name 'Kbuild*' -o \ + -name '*.lds' -o -name '*.pl' -o -name '*.sh' \) | \ + tar cf - -T - | (cd $dir; tar xf -) && \ + ( cd /tmp && tar cf /out/kernel-dev.tar usr/src ) + +RUN printf "KERNEL_SOURCE=${KERNEL_SOURCE}\n" > /out/kernel-source-info + + +FROM linuxkit/toybox-media:b396a375852e5dffc002389d95e0658c8de72914@sha256:a317cc378946ee48cc011cdfc5aa08f0229f5bf10ff70e3690d8f60b36700033 +ENTRYPOINT [] +CMD [] +WORKDIR / +COPY --from=kernel-build /out/* / diff --git a/projects/ima-namespace/kernel/Makefile b/projects/ima-namespace/kernel/Makefile new file mode 100644 index 000000000..255a26210 --- /dev/null +++ b/projects/ima-namespace/kernel/Makefile @@ -0,0 +1,66 @@ +# This builds the supported LinuxKit kernels. Kernels are wrapped up +# in a minimal toybox container, which contains the bzImage, a tar +# ball with modules and the kernel source. +# +# Each kernel is pushed to hub twice, once as +# linuxkit/kernel:..- and once as +# inuxkit/kernel:..x. The is the git tree hash +# of the current directory. The build will only rebuild the kernel +# image if the git tree hash changed. + +# Git tree hash of this directory. Override to force build +HASH?=$(shell git ls-tree HEAD -- ../$(notdir $(CURDIR)) | awk '{print $$3}') +# Name and Org on Hub +ORG?=linuxkit +IMAGE:=kernel-ima + +.PHONY: check tag push sign +# Targets: +# build: builds all kernels +# push: pushes all tagged kernel images to hub +# sign: sign and push all kernel images to hub +build: +push: +sign: + +# A template for defining kernel build +# Arguments: +# $1: Full kernel version, e.g., 4.9.22 +# $2: Kernel "series", e.g., 4.9.x +# $3: Build a debug kernel (used as suffix for image) +# This defines targets like: +# build_4.9.x, push_4.9.x and sign_4.9.x and adds them as dependencies +# to the global targets +# Set $3 to "_dbg", to build debug kernels. This defines targets like +# build_4.9.x_dbg and adds "_dbg" to the hub image name. +define kernel +build_$(2)$(3): Dockerfile Makefile $(wildcard patches-$(2)/*) kernel_config-$(2) kernel_config.debug + docker pull $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) || \ + docker build \ + --build-arg KERNEL_VERSION=$(1) \ + --build-arg KERNEL_SERIES=$(2) \ + --build-arg DEBUG=$(3) \ + --no-cache -t $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) . + +push_$(2)$(3): build_$(2)$(3) + docker pull $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) || \ + (docker push $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) && \ + docker tag $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) $(ORG)/$(IMAGE):$(2)$(3) && \ + docker push $(ORG)/$(IMAGE):$(2)$(3)) + +sign_$(2)$(3): build_$(2)$(3) + DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) || \ + (DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) && \ + docker tag $(ORG)/$(IMAGE):$(1)$(3)-$(HASH) $(ORG)/$(IMAGE):$(2)$(3) && \ + DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(2)$(3)) + +build: build_$(2)$(3) +push: push_$(2)$(3) +sign: sign_$(2)$(3) +endef + +# +# Build Targets +# Debug targets only for latest stable and LTS stable +# +$(eval $(call kernel,4.11.1,4.11.x)) diff --git a/projects/ima-namespace/kernel/kernel_config-4.11.x b/projects/ima-namespace/kernel/kernel_config-4.11.x new file mode 100644 index 000000000..be8f87add --- /dev/null +++ b/projects/ima-namespace/kernel/kernel_config-4.11.x @@ -0,0 +1,3838 @@ +# +# Automatically generated file; DO NOT EDIT. +# Linux/x86 4.11.0 Kernel Configuration +# +CONFIG_64BIT=y +CONFIG_X86_64=y +CONFIG_X86=y +CONFIG_INSTRUCTION_DECODER=y +CONFIG_OUTPUT_FORMAT="elf64-x86-64" +CONFIG_ARCH_DEFCONFIG="arch/x86/configs/x86_64_defconfig" +CONFIG_LOCKDEP_SUPPORT=y +CONFIG_STACKTRACE_SUPPORT=y +CONFIG_MMU=y +CONFIG_ARCH_MMAP_RND_BITS_MIN=28 +CONFIG_ARCH_MMAP_RND_BITS_MAX=32 +CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8 +CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16 +CONFIG_NEED_DMA_MAP_STATE=y +CONFIG_NEED_SG_DMA_LENGTH=y +CONFIG_GENERIC_ISA_DMA=y +CONFIG_GENERIC_BUG=y +CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y +CONFIG_GENERIC_HWEIGHT=y +CONFIG_ARCH_MAY_HAVE_PC_FDC=y +CONFIG_RWSEM_XCHGADD_ALGORITHM=y +CONFIG_GENERIC_CALIBRATE_DELAY=y +CONFIG_ARCH_HAS_CPU_RELAX=y +CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y +CONFIG_HAVE_SETUP_PER_CPU_AREA=y +CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y +CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y +CONFIG_ARCH_HIBERNATION_POSSIBLE=y +CONFIG_ARCH_SUSPEND_POSSIBLE=y +CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y +CONFIG_ARCH_WANT_GENERAL_HUGETLB=y +CONFIG_ZONE_DMA32=y +CONFIG_AUDIT_ARCH=y +CONFIG_ARCH_SUPPORTS_OPTIMIZED_INLINING=y +CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y +CONFIG_X86_64_SMP=y +CONFIG_ARCH_SUPPORTS_UPROBES=y +CONFIG_FIX_EARLYCON_MEM=y +CONFIG_PGTABLE_LEVELS=4 +CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config" +CONFIG_IRQ_WORK=y +CONFIG_BUILDTIME_EXTABLE_SORT=y +CONFIG_THREAD_INFO_IN_TASK=y + +# +# General setup +# +CONFIG_INIT_ENV_ARG_LIMIT=32 +CONFIG_CROSS_COMPILE="" +# CONFIG_COMPILE_TEST is not set +CONFIG_LOCALVERSION="-linuxkit" +# CONFIG_LOCALVERSION_AUTO is not set +CONFIG_HAVE_KERNEL_GZIP=y +CONFIG_HAVE_KERNEL_BZIP2=y +CONFIG_HAVE_KERNEL_LZMA=y +CONFIG_HAVE_KERNEL_XZ=y +CONFIG_HAVE_KERNEL_LZO=y +CONFIG_HAVE_KERNEL_LZ4=y +CONFIG_KERNEL_GZIP=y +# CONFIG_KERNEL_BZIP2 is not set +# CONFIG_KERNEL_LZMA is not set +# CONFIG_KERNEL_XZ is not set +# CONFIG_KERNEL_LZO is not set +# CONFIG_KERNEL_LZ4 is not set +CONFIG_DEFAULT_HOSTNAME="(none)" +CONFIG_SWAP=y +CONFIG_SYSVIPC=y +CONFIG_SYSVIPC_SYSCTL=y +CONFIG_POSIX_MQUEUE=y +CONFIG_POSIX_MQUEUE_SYSCTL=y +CONFIG_CROSS_MEMORY_ATTACH=y +CONFIG_FHANDLE=y +# CONFIG_USELIB is not set +CONFIG_AUDIT=y +CONFIG_HAVE_ARCH_AUDITSYSCALL=y +CONFIG_AUDITSYSCALL=y +CONFIG_AUDIT_WATCH=y +CONFIG_AUDIT_TREE=y + +# +# IRQ subsystem +# +CONFIG_GENERIC_IRQ_PROBE=y +CONFIG_GENERIC_IRQ_SHOW=y +CONFIG_GENERIC_PENDING_IRQ=y +CONFIG_IRQ_DOMAIN=y +CONFIG_IRQ_DOMAIN_HIERARCHY=y +CONFIG_GENERIC_MSI_IRQ=y +CONFIG_GENERIC_MSI_IRQ_DOMAIN=y +# CONFIG_IRQ_DOMAIN_DEBUG is not set +CONFIG_IRQ_FORCED_THREADING=y +CONFIG_SPARSE_IRQ=y +CONFIG_CLOCKSOURCE_WATCHDOG=y +CONFIG_ARCH_CLOCKSOURCE_DATA=y +CONFIG_CLOCKSOURCE_VALIDATE_LAST_CYCLE=y +CONFIG_GENERIC_TIME_VSYSCALL=y +CONFIG_GENERIC_CLOCKEVENTS=y +CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y +CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST=y +CONFIG_GENERIC_CMOS_UPDATE=y + +# +# Timers subsystem +# +CONFIG_TICK_ONESHOT=y +CONFIG_NO_HZ_COMMON=y +# CONFIG_HZ_PERIODIC is not set +CONFIG_NO_HZ_IDLE=y +# CONFIG_NO_HZ_FULL is not set +CONFIG_NO_HZ=y +CONFIG_HIGH_RES_TIMERS=y + +# +# CPU/Task time and stats accounting +# +CONFIG_TICK_CPU_ACCOUNTING=y +# CONFIG_VIRT_CPU_ACCOUNTING_GEN is not set +# CONFIG_IRQ_TIME_ACCOUNTING is not set +CONFIG_BSD_PROCESS_ACCT=y +CONFIG_BSD_PROCESS_ACCT_V3=y +CONFIG_TASKSTATS=y +CONFIG_TASK_DELAY_ACCT=y +# CONFIG_TASK_XACCT is not set + +# +# RCU Subsystem +# +CONFIG_TREE_RCU=y +# CONFIG_RCU_EXPERT is not set +CONFIG_SRCU=y +# CONFIG_TASKS_RCU is not set +CONFIG_RCU_STALL_COMMON=y +# CONFIG_TREE_RCU_TRACE is not set +CONFIG_BUILD_BIN2C=y +CONFIG_IKCONFIG=y +CONFIG_IKCONFIG_PROC=y +CONFIG_LOG_BUF_SHIFT=17 +CONFIG_LOG_CPU_MAX_BUF_SHIFT=12 +CONFIG_PRINTK_SAFE_LOG_BUF_SHIFT=13 +CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y +CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y +CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH=y +CONFIG_ARCH_SUPPORTS_INT128=y +CONFIG_CGROUPS=y +CONFIG_PAGE_COUNTER=y +CONFIG_MEMCG=y +CONFIG_MEMCG_SWAP=y +CONFIG_MEMCG_SWAP_ENABLED=y +CONFIG_BLK_CGROUP=y +# CONFIG_DEBUG_BLK_CGROUP is not set +CONFIG_CGROUP_WRITEBACK=y +CONFIG_CGROUP_SCHED=y +CONFIG_FAIR_GROUP_SCHED=y +CONFIG_CFS_BANDWIDTH=y +CONFIG_RT_GROUP_SCHED=y +CONFIG_CGROUP_PIDS=y +# CONFIG_CGROUP_RDMA is not set +CONFIG_CGROUP_FREEZER=y +CONFIG_CGROUP_HUGETLB=y +CONFIG_CPUSETS=y +CONFIG_PROC_PID_CPUSET=y +CONFIG_CGROUP_DEVICE=y +CONFIG_CGROUP_CPUACCT=y +CONFIG_CGROUP_PERF=y +# CONFIG_CGROUP_BPF is not set +# CONFIG_CGROUP_DEBUG is not set +CONFIG_SOCK_CGROUP_DATA=y +CONFIG_CHECKPOINT_RESTORE=y +CONFIG_NAMESPACES=y +CONFIG_UTS_NS=y +CONFIG_IPC_NS=y +CONFIG_USER_NS=y +CONFIG_PID_NS=y +CONFIG_NET_NS=y +CONFIG_SCHED_AUTOGROUP=y +# CONFIG_SYSFS_DEPRECATED is not set +CONFIG_RELAY=y +CONFIG_BLK_DEV_INITRD=y +CONFIG_INITRAMFS_SOURCE="" +CONFIG_RD_GZIP=y +# CONFIG_RD_BZIP2 is not set +# CONFIG_RD_LZMA is not set +# CONFIG_RD_XZ is not set +# CONFIG_RD_LZO is not set +# CONFIG_RD_LZ4 is not set +CONFIG_INITRAMFS_COMPRESSION=".gz" +# CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE is not set +CONFIG_CC_OPTIMIZE_FOR_SIZE=y +CONFIG_SYSCTL=y +CONFIG_ANON_INODES=y +CONFIG_HAVE_UID16=y +CONFIG_SYSCTL_EXCEPTION_TRACE=y +CONFIG_HAVE_PCSPKR_PLATFORM=y +CONFIG_BPF=y +CONFIG_EXPERT=y +CONFIG_UID16=y +CONFIG_MULTIUSER=y +CONFIG_SGETMASK_SYSCALL=y +CONFIG_SYSFS_SYSCALL=y +# CONFIG_SYSCTL_SYSCALL is not set +CONFIG_POSIX_TIMERS=y +CONFIG_KALLSYMS=y +# CONFIG_KALLSYMS_ALL is not set +CONFIG_KALLSYMS_ABSOLUTE_PERCPU=y +CONFIG_KALLSYMS_BASE_RELATIVE=y +CONFIG_PRINTK=y +CONFIG_PRINTK_NMI=y +CONFIG_BUG=y +CONFIG_ELF_CORE=y +CONFIG_PCSPKR_PLATFORM=y +CONFIG_BASE_FULL=y +CONFIG_FUTEX=y +CONFIG_EPOLL=y +CONFIG_SIGNALFD=y +CONFIG_TIMERFD=y +CONFIG_EVENTFD=y +CONFIG_BPF_SYSCALL=y +CONFIG_SHMEM=y +CONFIG_AIO=y +CONFIG_ADVISE_SYSCALLS=y +# CONFIG_USERFAULTFD is not set +CONFIG_PCI_QUIRKS=y +CONFIG_MEMBARRIER=y +# CONFIG_EMBEDDED is not set +CONFIG_HAVE_PERF_EVENTS=y +# CONFIG_PC104 is not set + +# +# Kernel Performance Events And Counters +# +CONFIG_PERF_EVENTS=y +# CONFIG_DEBUG_PERF_USE_VMALLOC is not set +CONFIG_VM_EVENT_COUNTERS=y +# CONFIG_COMPAT_BRK is not set +CONFIG_SLAB=y +# CONFIG_SLUB is not set +# CONFIG_SLOB is not set +CONFIG_SLAB_FREELIST_RANDOM=y +# CONFIG_SYSTEM_DATA_VERIFICATION is not set +CONFIG_PROFILING=y +CONFIG_TRACEPOINTS=y +CONFIG_OPROFILE=y +# CONFIG_OPROFILE_EVENT_MULTIPLEX is not set +CONFIG_HAVE_OPROFILE=y +CONFIG_OPROFILE_NMI_TIMER=y +CONFIG_KPROBES=y +CONFIG_JUMP_LABEL=y +# CONFIG_STATIC_KEYS_SELFTEST is not set +CONFIG_OPTPROBES=y +CONFIG_KPROBES_ON_FTRACE=y +# CONFIG_UPROBES is not set +# CONFIG_HAVE_64BIT_ALIGNED_ACCESS is not set +CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y +CONFIG_ARCH_USE_BUILTIN_BSWAP=y +CONFIG_KRETPROBES=y +CONFIG_HAVE_IOREMAP_PROT=y +CONFIG_HAVE_KPROBES=y +CONFIG_HAVE_KRETPROBES=y +CONFIG_HAVE_OPTPROBES=y +CONFIG_HAVE_KPROBES_ON_FTRACE=y +CONFIG_HAVE_NMI=y +CONFIG_HAVE_ARCH_TRACEHOOK=y +CONFIG_HAVE_DMA_CONTIGUOUS=y +CONFIG_GENERIC_SMP_IDLE_THREAD=y +CONFIG_ARCH_HAS_SET_MEMORY=y +CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT=y +CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y +CONFIG_HAVE_CLK=y +CONFIG_HAVE_DMA_API_DEBUG=y +CONFIG_HAVE_HW_BREAKPOINT=y +CONFIG_HAVE_MIXED_BREAKPOINTS_REGS=y +CONFIG_HAVE_USER_RETURN_NOTIFIER=y +CONFIG_HAVE_PERF_EVENTS_NMI=y +CONFIG_HAVE_PERF_REGS=y +CONFIG_HAVE_PERF_USER_STACK_DUMP=y +CONFIG_HAVE_ARCH_JUMP_LABEL=y +CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y +CONFIG_HAVE_CMPXCHG_LOCAL=y +CONFIG_HAVE_CMPXCHG_DOUBLE=y +CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION=y +CONFIG_ARCH_WANT_OLD_COMPAT_IPC=y +CONFIG_HAVE_ARCH_SECCOMP_FILTER=y +CONFIG_SECCOMP_FILTER=y +CONFIG_HAVE_GCC_PLUGINS=y +# CONFIG_GCC_PLUGINS is not set +CONFIG_HAVE_CC_STACKPROTECTOR=y +CONFIG_CC_STACKPROTECTOR=y +# CONFIG_CC_STACKPROTECTOR_NONE is not set +# CONFIG_CC_STACKPROTECTOR_REGULAR is not set +CONFIG_CC_STACKPROTECTOR_STRONG=y +CONFIG_HAVE_ARCH_WITHIN_STACK_FRAMES=y +CONFIG_HAVE_CONTEXT_TRACKING=y +CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y +CONFIG_HAVE_IRQ_TIME_ACCOUNTING=y +CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE=y +CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD=y +CONFIG_HAVE_ARCH_HUGE_VMAP=y +CONFIG_HAVE_ARCH_SOFT_DIRTY=y +CONFIG_MODULES_USE_ELF_RELA=y +CONFIG_HAVE_IRQ_EXIT_ON_IRQ_STACK=y +CONFIG_ARCH_HAS_ELF_RANDOMIZE=y +CONFIG_HAVE_ARCH_MMAP_RND_BITS=y +CONFIG_HAVE_EXIT_THREAD=y +CONFIG_ARCH_MMAP_RND_BITS=28 +CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS=y +CONFIG_ARCH_MMAP_RND_COMPAT_BITS=8 +CONFIG_HAVE_COPY_THREAD_TLS=y +CONFIG_HAVE_STACK_VALIDATION=y +# CONFIG_HAVE_ARCH_HASH is not set +# CONFIG_ISA_BUS_API is not set +CONFIG_OLD_SIGSUSPEND3=y +CONFIG_COMPAT_OLD_SIGACTION=y +# CONFIG_CPU_NO_EFFICIENT_FFS is not set +CONFIG_HAVE_ARCH_VMAP_STACK=y +CONFIG_VMAP_STACK=y +# CONFIG_ARCH_OPTIONAL_KERNEL_RWX is not set +# CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT is not set +CONFIG_ARCH_HAS_STRICT_KERNEL_RWX=y +CONFIG_STRICT_KERNEL_RWX=y +CONFIG_ARCH_HAS_STRICT_MODULE_RWX=y +CONFIG_STRICT_MODULE_RWX=y + +# +# GCOV-based kernel profiling +# +# CONFIG_GCOV_KERNEL is not set +CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y +# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set +CONFIG_SLABINFO=y +CONFIG_RT_MUTEXES=y +CONFIG_BASE_SMALL=0 +CONFIG_MODULES=y +# CONFIG_MODULE_FORCE_LOAD is not set +CONFIG_MODULE_UNLOAD=y +# CONFIG_MODULE_FORCE_UNLOAD is not set +# CONFIG_MODVERSIONS is not set +# CONFIG_MODULE_SRCVERSION_ALL is not set +# CONFIG_MODULE_SIG is not set +# CONFIG_MODULE_COMPRESS is not set +# CONFIG_TRIM_UNUSED_KSYMS is not set +CONFIG_MODULES_TREE_LOOKUP=y +CONFIG_BLOCK=y +CONFIG_BLK_SCSI_REQUEST=y +CONFIG_BLK_DEV_BSG=y +# CONFIG_BLK_DEV_BSGLIB is not set +CONFIG_BLK_DEV_INTEGRITY=y +# CONFIG_BLK_DEV_ZONED is not set +CONFIG_BLK_DEV_THROTTLING=y +# CONFIG_BLK_CMDLINE_PARSER is not set +# CONFIG_BLK_WBT is not set +CONFIG_BLK_DEBUG_FS=y +# CONFIG_BLK_SED_OPAL is not set + +# +# Partition Types +# +CONFIG_PARTITION_ADVANCED=y +# CONFIG_ACORN_PARTITION is not set +# CONFIG_AIX_PARTITION is not set +# CONFIG_OSF_PARTITION is not set +# CONFIG_AMIGA_PARTITION is not set +# CONFIG_ATARI_PARTITION is not set +# CONFIG_MAC_PARTITION is not set +CONFIG_MSDOS_PARTITION=y +# CONFIG_BSD_DISKLABEL is not set +# CONFIG_MINIX_SUBPARTITION is not set +# CONFIG_SOLARIS_X86_PARTITION is not set +# CONFIG_UNIXWARE_DISKLABEL is not set +# CONFIG_LDM_PARTITION is not set +# CONFIG_SGI_PARTITION is not set +# CONFIG_ULTRIX_PARTITION is not set +# CONFIG_SUN_PARTITION is not set +# CONFIG_KARMA_PARTITION is not set +CONFIG_EFI_PARTITION=y +# CONFIG_SYSV68_PARTITION is not set +# CONFIG_CMDLINE_PARTITION is not set +CONFIG_BLOCK_COMPAT=y +CONFIG_BLK_MQ_PCI=y +CONFIG_BLK_MQ_VIRTIO=y + +# +# IO Schedulers +# +CONFIG_IOSCHED_NOOP=y +CONFIG_IOSCHED_DEADLINE=y +CONFIG_IOSCHED_CFQ=y +CONFIG_CFQ_GROUP_IOSCHED=y +CONFIG_DEFAULT_DEADLINE=y +# CONFIG_DEFAULT_CFQ is not set +# CONFIG_DEFAULT_NOOP is not set +CONFIG_DEFAULT_IOSCHED="deadline" +CONFIG_MQ_IOSCHED_DEADLINE=y +CONFIG_ASN1=y +CONFIG_INLINE_SPIN_UNLOCK_IRQ=y +CONFIG_INLINE_READ_UNLOCK=y +CONFIG_INLINE_READ_UNLOCK_IRQ=y +CONFIG_INLINE_WRITE_UNLOCK=y +CONFIG_INLINE_WRITE_UNLOCK_IRQ=y +CONFIG_ARCH_SUPPORTS_ATOMIC_RMW=y +CONFIG_MUTEX_SPIN_ON_OWNER=y +CONFIG_RWSEM_SPIN_ON_OWNER=y +CONFIG_LOCK_SPIN_ON_OWNER=y +CONFIG_ARCH_USE_QUEUED_SPINLOCKS=y +CONFIG_QUEUED_SPINLOCKS=y +CONFIG_ARCH_USE_QUEUED_RWLOCKS=y +CONFIG_QUEUED_RWLOCKS=y +CONFIG_FREEZER=y + +# +# Processor type and features +# +CONFIG_ZONE_DMA=y +CONFIG_SMP=y +CONFIG_X86_FEATURE_NAMES=y +CONFIG_X86_FAST_FEATURE_TESTS=y +# CONFIG_X86_X2APIC is not set +CONFIG_X86_MPPARSE=y +# CONFIG_GOLDFISH is not set +# CONFIG_INTEL_RDT_A is not set +# CONFIG_X86_EXTENDED_PLATFORM is not set +# CONFIG_X86_INTEL_LPSS is not set +# CONFIG_X86_AMD_PLATFORM_DEVICE is not set +# CONFIG_IOSF_MBI is not set +CONFIG_SCHED_OMIT_FRAME_POINTER=y +CONFIG_HYPERVISOR_GUEST=y +CONFIG_PARAVIRT=y +# CONFIG_PARAVIRT_DEBUG is not set +CONFIG_PARAVIRT_SPINLOCKS=y +# CONFIG_QUEUED_LOCK_STAT is not set +CONFIG_XEN=y +CONFIG_XEN_DOM0=y +CONFIG_XEN_PVHVM=y +CONFIG_XEN_512GB=y +CONFIG_XEN_SAVE_RESTORE=y +# CONFIG_XEN_DEBUG_FS is not set +CONFIG_XEN_PVH=y +CONFIG_KVM_GUEST=y +# CONFIG_KVM_DEBUG_FS is not set +# CONFIG_PARAVIRT_TIME_ACCOUNTING is not set +CONFIG_PARAVIRT_CLOCK=y +CONFIG_NO_BOOTMEM=y +# CONFIG_MK8 is not set +# CONFIG_MPSC is not set +# CONFIG_MCORE2 is not set +# CONFIG_MATOM is not set +CONFIG_GENERIC_CPU=y +CONFIG_X86_INTERNODE_CACHE_SHIFT=6 +CONFIG_X86_L1_CACHE_SHIFT=6 +CONFIG_X86_TSC=y +CONFIG_X86_CMPXCHG64=y +CONFIG_X86_CMOV=y +CONFIG_X86_MINIMUM_CPU_FAMILY=64 +CONFIG_X86_DEBUGCTLMSR=y +# CONFIG_PROCESSOR_SELECT is not set +CONFIG_CPU_SUP_INTEL=y +CONFIG_CPU_SUP_AMD=y +CONFIG_CPU_SUP_CENTAUR=y +CONFIG_HPET_TIMER=y +CONFIG_HPET_EMULATE_RTC=y +CONFIG_DMI=y +# CONFIG_GART_IOMMU is not set +# CONFIG_CALGARY_IOMMU is not set +CONFIG_SWIOTLB=y +CONFIG_IOMMU_HELPER=y +# CONFIG_MAXSMP is not set +CONFIG_NR_CPUS=128 +# CONFIG_SCHED_SMT is not set +CONFIG_SCHED_MC=y +CONFIG_SCHED_MC_PRIO=y +# CONFIG_PREEMPT_NONE is not set +CONFIG_PREEMPT_VOLUNTARY=y +# CONFIG_PREEMPT is not set +CONFIG_X86_LOCAL_APIC=y +CONFIG_X86_IO_APIC=y +CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y +# CONFIG_X86_MCE is not set + +# +# Performance monitoring +# +CONFIG_PERF_EVENTS_INTEL_UNCORE=y +CONFIG_PERF_EVENTS_INTEL_RAPL=y +CONFIG_PERF_EVENTS_INTEL_CSTATE=y +# CONFIG_PERF_EVENTS_AMD_POWER is not set +# CONFIG_VM86 is not set +CONFIG_X86_VSYSCALL_EMULATION=y +# CONFIG_I8K is not set +CONFIG_MICROCODE=y +CONFIG_MICROCODE_INTEL=y +CONFIG_MICROCODE_AMD=y +CONFIG_MICROCODE_OLD_INTERFACE=y +CONFIG_X86_MSR=y +CONFIG_X86_CPUID=y +CONFIG_ARCH_PHYS_ADDR_T_64BIT=y +CONFIG_ARCH_DMA_ADDR_T_64BIT=y +CONFIG_X86_DIRECT_GBPAGES=y +# CONFIG_NUMA is not set +CONFIG_ARCH_SPARSEMEM_ENABLE=y +CONFIG_ARCH_SPARSEMEM_DEFAULT=y +CONFIG_ARCH_SELECT_MEMORY_MODEL=y +# CONFIG_ARCH_MEMORY_PROBE is not set +CONFIG_ARCH_PROC_KCORE_TEXT=y +CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000 +CONFIG_SELECT_MEMORY_MODEL=y +CONFIG_SPARSEMEM_MANUAL=y +CONFIG_SPARSEMEM=y +CONFIG_HAVE_MEMORY_PRESENT=y +CONFIG_SPARSEMEM_EXTREME=y +CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y +CONFIG_SPARSEMEM_ALLOC_MEM_MAP_TOGETHER=y +CONFIG_SPARSEMEM_VMEMMAP=y +CONFIG_HAVE_MEMBLOCK=y +CONFIG_HAVE_MEMBLOCK_NODE_MAP=y +CONFIG_ARCH_DISCARD_MEMBLOCK=y +CONFIG_MEMORY_ISOLATION=y +CONFIG_HAVE_BOOTMEM_INFO_NODE=y +CONFIG_MEMORY_HOTPLUG=y +CONFIG_MEMORY_HOTPLUG_SPARSE=y +# CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE is not set +CONFIG_MEMORY_HOTREMOVE=y +CONFIG_SPLIT_PTLOCK_CPUS=4 +CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK=y +CONFIG_MEMORY_BALLOON=y +CONFIG_BALLOON_COMPACTION=y +CONFIG_COMPACTION=y +CONFIG_MIGRATION=y +CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION=y +CONFIG_PHYS_ADDR_T_64BIT=y +CONFIG_BOUNCE=y +CONFIG_VIRT_TO_BUS=y +CONFIG_MMU_NOTIFIER=y +CONFIG_KSM=y +CONFIG_DEFAULT_MMAP_MIN_ADDR=4096 +CONFIG_TRANSPARENT_HUGEPAGE=y +CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y +# CONFIG_TRANSPARENT_HUGEPAGE_MADVISE is not set +CONFIG_TRANSPARENT_HUGE_PAGECACHE=y +# CONFIG_CLEANCACHE is not set +# CONFIG_FRONTSWAP is not set +# CONFIG_CMA is not set +# CONFIG_MEM_SOFT_DIRTY is not set +# CONFIG_ZPOOL is not set +# CONFIG_ZBUD is not set +# CONFIG_ZSMALLOC is not set +CONFIG_GENERIC_EARLY_IOREMAP=y +CONFIG_ARCH_SUPPORTS_DEFERRED_STRUCT_PAGE_INIT=y +# CONFIG_DEFERRED_STRUCT_PAGE_INIT is not set +# CONFIG_IDLE_PAGE_TRACKING is not set +# CONFIG_ZONE_DEVICE is not set +CONFIG_ARCH_USES_HIGH_VMA_FLAGS=y +CONFIG_ARCH_HAS_PKEYS=y +# CONFIG_X86_PMEM_LEGACY is not set +# CONFIG_X86_CHECK_BIOS_CORRUPTION is not set +CONFIG_X86_RESERVE_LOW=64 +CONFIG_MTRR=y +CONFIG_MTRR_SANITIZER=y +CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=0 +CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT=1 +CONFIG_X86_PAT=y +CONFIG_ARCH_USES_PG_UNCACHED=y +CONFIG_ARCH_RANDOM=y +CONFIG_X86_SMAP=y +# CONFIG_X86_INTEL_MPX is not set +CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS=y +CONFIG_EFI=y +CONFIG_EFI_STUB=y +# CONFIG_EFI_MIXED is not set +CONFIG_SECCOMP=y +CONFIG_HZ_100=y +# CONFIG_HZ_250 is not set +# CONFIG_HZ_300 is not set +# CONFIG_HZ_1000 is not set +CONFIG_HZ=100 +CONFIG_SCHED_HRTICK=y +# CONFIG_KEXEC is not set +# CONFIG_KEXEC_FILE is not set +# CONFIG_CRASH_DUMP is not set +CONFIG_PHYSICAL_START=0x1000000 +CONFIG_RELOCATABLE=y +CONFIG_RANDOMIZE_BASE=y +CONFIG_X86_NEED_RELOCS=y +CONFIG_PHYSICAL_ALIGN=0x1000000 +CONFIG_RANDOMIZE_MEMORY=y +CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING=0xa +CONFIG_HOTPLUG_CPU=y +# CONFIG_BOOTPARAM_HOTPLUG_CPU0 is not set +# CONFIG_DEBUG_HOTPLUG_CPU0 is not set +# CONFIG_COMPAT_VDSO is not set +# CONFIG_LEGACY_VSYSCALL_NATIVE is not set +# CONFIG_LEGACY_VSYSCALL_EMULATE is not set +CONFIG_LEGACY_VSYSCALL_NONE=y +# CONFIG_CMDLINE_BOOL is not set +# CONFIG_MODIFY_LDT_SYSCALL is not set +CONFIG_HAVE_LIVEPATCH=y +CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y +CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y + +# +# Power management and ACPI options +# +# CONFIG_SUSPEND is not set +CONFIG_HIBERNATE_CALLBACKS=y +# CONFIG_HIBERNATION is not set +CONFIG_PM_SLEEP=y +CONFIG_PM_SLEEP_SMP=y +# CONFIG_PM_AUTOSLEEP is not set +# CONFIG_PM_WAKELOCKS is not set +CONFIG_PM=y +# CONFIG_PM_DEBUG is not set +CONFIG_PM_CLK=y +# CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set +CONFIG_ACPI=y +CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y +CONFIG_ARCH_MIGHT_HAVE_ACPI_PDC=y +CONFIG_ACPI_SYSTEM_POWER_STATES_SUPPORT=y +# CONFIG_ACPI_DEBUGGER is not set +# CONFIG_ACPI_PROCFS_POWER is not set +# CONFIG_ACPI_REV_OVERRIDE_POSSIBLE is not set +# CONFIG_ACPI_EC_DEBUGFS is not set +CONFIG_ACPI_AC=y +CONFIG_ACPI_BATTERY=y +CONFIG_ACPI_BUTTON=y +CONFIG_ACPI_FAN=y +CONFIG_ACPI_DOCK=y +CONFIG_ACPI_CPU_FREQ_PSS=y +CONFIG_ACPI_PROCESSOR_CSTATE=y +CONFIG_ACPI_PROCESSOR_IDLE=y +CONFIG_ACPI_CPPC_LIB=y +CONFIG_ACPI_PROCESSOR=y +CONFIG_ACPI_HOTPLUG_CPU=y +CONFIG_ACPI_PROCESSOR_AGGREGATOR=y +CONFIG_ACPI_THERMAL=y +# CONFIG_ACPI_CUSTOM_DSDT is not set +CONFIG_ARCH_HAS_ACPI_TABLE_UPGRADE=y +CONFIG_ACPI_TABLE_UPGRADE=y +# CONFIG_ACPI_DEBUG is not set +# CONFIG_ACPI_PCI_SLOT is not set +CONFIG_X86_PM_TIMER=y +CONFIG_ACPI_CONTAINER=y +# CONFIG_ACPI_HOTPLUG_MEMORY is not set +CONFIG_ACPI_HOTPLUG_IOAPIC=y +CONFIG_ACPI_SBS=y +CONFIG_ACPI_HED=y +# CONFIG_ACPI_CUSTOM_METHOD is not set +# CONFIG_ACPI_BGRT is not set +# CONFIG_ACPI_REDUCED_HARDWARE_ONLY is not set +# CONFIG_ACPI_NFIT is not set +CONFIG_HAVE_ACPI_APEI=y +CONFIG_HAVE_ACPI_APEI_NMI=y +CONFIG_ACPI_APEI=y +CONFIG_ACPI_APEI_GHES=y +# CONFIG_ACPI_APEI_EINJ is not set +# CONFIG_ACPI_APEI_ERST_DEBUG is not set +# CONFIG_DPTF_POWER is not set +# CONFIG_PMIC_OPREGION is not set +# CONFIG_ACPI_CONFIGFS is not set +# CONFIG_SFI is not set + +# +# CPU Frequency scaling +# +CONFIG_CPU_FREQ=y +CONFIG_CPU_FREQ_GOV_ATTR_SET=y +CONFIG_CPU_FREQ_GOV_COMMON=y +CONFIG_CPU_FREQ_STAT=y +# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set +# CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set +# CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set +CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y +# CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set +# CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL is not set +CONFIG_CPU_FREQ_GOV_PERFORMANCE=y +CONFIG_CPU_FREQ_GOV_POWERSAVE=y +CONFIG_CPU_FREQ_GOV_USERSPACE=y +CONFIG_CPU_FREQ_GOV_ONDEMAND=y +CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y +# CONFIG_CPU_FREQ_GOV_SCHEDUTIL is not set + +# +# CPU frequency scaling drivers +# +CONFIG_X86_INTEL_PSTATE=y +CONFIG_X86_PCC_CPUFREQ=y +CONFIG_X86_ACPI_CPUFREQ=y +CONFIG_X86_ACPI_CPUFREQ_CPB=y +CONFIG_X86_POWERNOW_K8=y +# CONFIG_X86_AMD_FREQ_SENSITIVITY is not set +# CONFIG_X86_SPEEDSTEP_CENTRINO is not set +CONFIG_X86_P4_CLOCKMOD=y + +# +# shared options +# +CONFIG_X86_SPEEDSTEP_LIB=y + +# +# CPU Idle +# +CONFIG_CPU_IDLE=y +CONFIG_CPU_IDLE_GOV_LADDER=y +CONFIG_CPU_IDLE_GOV_MENU=y +# CONFIG_ARCH_NEEDS_CPU_IDLE_COUPLED is not set +CONFIG_INTEL_IDLE=y + +# +# Bus options (PCI etc.) +# +CONFIG_PCI=y +CONFIG_PCI_DIRECT=y +CONFIG_PCI_MMCONFIG=y +CONFIG_PCI_XEN=y +CONFIG_PCI_DOMAINS=y +# CONFIG_PCI_CNB20LE_QUIRK is not set +CONFIG_PCIEPORTBUS=y +CONFIG_HOTPLUG_PCI_PCIE=y +# CONFIG_PCIEAER is not set +CONFIG_PCIEASPM=y +# CONFIG_PCIEASPM_DEBUG is not set +CONFIG_PCIEASPM_DEFAULT=y +# CONFIG_PCIEASPM_POWERSAVE is not set +# CONFIG_PCIEASPM_POWER_SUPERSAVE is not set +# CONFIG_PCIEASPM_PERFORMANCE is not set +CONFIG_PCIE_PME=y +# CONFIG_PCIE_DPC is not set +# CONFIG_PCIE_PTM is not set +CONFIG_PCI_BUS_ADDR_T_64BIT=y +CONFIG_PCI_MSI=y +CONFIG_PCI_MSI_IRQ_DOMAIN=y +# CONFIG_PCI_DEBUG is not set +# CONFIG_PCI_REALLOC_ENABLE_AUTO is not set +CONFIG_PCI_STUB=y +CONFIG_XEN_PCIDEV_FRONTEND=y +CONFIG_HT_IRQ=y +CONFIG_PCI_ATS=y +CONFIG_PCI_IOV=y +CONFIG_PCI_PRI=y +CONFIG_PCI_PASID=y +CONFIG_PCI_LABEL=y +# CONFIG_PCI_HYPERV is not set +CONFIG_HOTPLUG_PCI=y +# CONFIG_HOTPLUG_PCI_ACPI is not set +# CONFIG_HOTPLUG_PCI_CPCI is not set +CONFIG_HOTPLUG_PCI_SHPC=y + +# +# DesignWare PCI Core Support +# +# CONFIG_PCIE_DW_PLAT is not set + +# +# PCI host controller drivers +# +# CONFIG_VMD is not set +# CONFIG_ISA_BUS is not set +CONFIG_ISA_DMA_API=y +CONFIG_AMD_NB=y +# CONFIG_PCCARD is not set +# CONFIG_RAPIDIO is not set +# CONFIG_X86_SYSFB is not set + +# +# Executable file formats / Emulations +# +CONFIG_BINFMT_ELF=y +CONFIG_COMPAT_BINFMT_ELF=y +CONFIG_ELFCORE=y +# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set +CONFIG_BINFMT_SCRIPT=y +# CONFIG_HAVE_AOUT is not set +CONFIG_BINFMT_MISC=y +CONFIG_COREDUMP=y +CONFIG_IA32_EMULATION=y +# CONFIG_IA32_AOUT is not set +# CONFIG_X86_X32 is not set +CONFIG_COMPAT_32=y +CONFIG_COMPAT=y +CONFIG_COMPAT_FOR_U64_ALIGNMENT=y +CONFIG_SYSVIPC_COMPAT=y +CONFIG_KEYS_COMPAT=y +CONFIG_X86_DEV_DMA_OPS=y +CONFIG_NET=y +CONFIG_NET_INGRESS=y +CONFIG_NET_EGRESS=y + +# +# Networking options +# +CONFIG_PACKET=y +CONFIG_PACKET_DIAG=y +CONFIG_UNIX=y +CONFIG_UNIX_DIAG=y +CONFIG_XFRM=y +CONFIG_XFRM_ALGO=y +CONFIG_XFRM_USER=y +CONFIG_XFRM_SUB_POLICY=y +CONFIG_XFRM_MIGRATE=y +CONFIG_XFRM_STATISTICS=y +CONFIG_XFRM_IPCOMP=y +CONFIG_NET_KEY=y +CONFIG_NET_KEY_MIGRATE=y +CONFIG_INET=y +CONFIG_IP_MULTICAST=y +CONFIG_IP_ADVANCED_ROUTER=y +CONFIG_IP_FIB_TRIE_STATS=y +CONFIG_IP_MULTIPLE_TABLES=y +CONFIG_IP_ROUTE_MULTIPATH=y +CONFIG_IP_ROUTE_VERBOSE=y +CONFIG_IP_ROUTE_CLASSID=y +CONFIG_IP_PNP=y +CONFIG_IP_PNP_DHCP=y +# CONFIG_IP_PNP_BOOTP is not set +# CONFIG_IP_PNP_RARP is not set +CONFIG_NET_IPIP=y +CONFIG_NET_IPGRE_DEMUX=y +CONFIG_NET_IP_TUNNEL=y +CONFIG_NET_IPGRE=y +CONFIG_NET_IPGRE_BROADCAST=y +CONFIG_IP_MROUTE=y +CONFIG_IP_MROUTE_MULTIPLE_TABLES=y +CONFIG_IP_PIMSM_V1=y +CONFIG_IP_PIMSM_V2=y +CONFIG_SYN_COOKIES=y +CONFIG_NET_IPVTI=y +CONFIG_NET_UDP_TUNNEL=y +CONFIG_NET_FOU=y +CONFIG_NET_FOU_IP_TUNNELS=y +CONFIG_INET_AH=y +CONFIG_INET_ESP=y +# CONFIG_INET_ESP_OFFLOAD is not set +CONFIG_INET_IPCOMP=y +CONFIG_INET_XFRM_TUNNEL=y +CONFIG_INET_TUNNEL=y +CONFIG_INET_XFRM_MODE_TRANSPORT=y +CONFIG_INET_XFRM_MODE_TUNNEL=y +CONFIG_INET_XFRM_MODE_BEET=y +CONFIG_INET_DIAG=y +CONFIG_INET_TCP_DIAG=y +CONFIG_INET_UDP_DIAG=y +# CONFIG_INET_RAW_DIAG is not set +# CONFIG_INET_DIAG_DESTROY is not set +# CONFIG_TCP_CONG_ADVANCED is not set +CONFIG_TCP_CONG_CUBIC=y +CONFIG_DEFAULT_TCP_CONG="cubic" +CONFIG_TCP_MD5SIG=y +CONFIG_IPV6=y +CONFIG_IPV6_ROUTER_PREF=y +# CONFIG_IPV6_ROUTE_INFO is not set +# CONFIG_IPV6_OPTIMISTIC_DAD is not set +CONFIG_INET6_AH=y +CONFIG_INET6_ESP=y +# CONFIG_INET6_ESP_OFFLOAD is not set +CONFIG_INET6_IPCOMP=y +CONFIG_IPV6_MIP6=y +CONFIG_IPV6_ILA=y +CONFIG_INET6_XFRM_TUNNEL=y +CONFIG_INET6_TUNNEL=y +CONFIG_INET6_XFRM_MODE_TRANSPORT=y +CONFIG_INET6_XFRM_MODE_TUNNEL=y +CONFIG_INET6_XFRM_MODE_BEET=y +CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION=y +CONFIG_IPV6_VTI=y +CONFIG_IPV6_SIT=y +CONFIG_IPV6_SIT_6RD=y +CONFIG_IPV6_NDISC_NODETYPE=y +CONFIG_IPV6_TUNNEL=y +CONFIG_IPV6_GRE=y +CONFIG_IPV6_FOU=y +CONFIG_IPV6_FOU_TUNNEL=y +CONFIG_IPV6_MULTIPLE_TABLES=y +CONFIG_IPV6_SUBTREES=y +# CONFIG_IPV6_MROUTE is not set +# CONFIG_IPV6_SEG6_LWTUNNEL is not set +# CONFIG_IPV6_SEG6_HMAC is not set +CONFIG_NETLABEL=y +CONFIG_NETWORK_SECMARK=y +CONFIG_NET_PTP_CLASSIFY=y +# CONFIG_NETWORK_PHY_TIMESTAMPING is not set +CONFIG_NETFILTER=y +# CONFIG_NETFILTER_DEBUG is not set +CONFIG_NETFILTER_ADVANCED=y +CONFIG_BRIDGE_NETFILTER=y + +# +# Core Netfilter Configuration +# +CONFIG_NETFILTER_INGRESS=y +CONFIG_NETFILTER_NETLINK=y +CONFIG_NETFILTER_NETLINK_ACCT=y +CONFIG_NETFILTER_NETLINK_QUEUE=y +CONFIG_NETFILTER_NETLINK_LOG=y +CONFIG_NF_CONNTRACK=y +CONFIG_NF_LOG_COMMON=y +# CONFIG_NF_LOG_NETDEV is not set +CONFIG_NF_CONNTRACK_MARK=y +# CONFIG_NF_CONNTRACK_SECMARK is not set +CONFIG_NF_CONNTRACK_ZONES=y +CONFIG_NF_CONNTRACK_PROCFS=y +CONFIG_NF_CONNTRACK_EVENTS=y +CONFIG_NF_CONNTRACK_TIMEOUT=y +CONFIG_NF_CONNTRACK_TIMESTAMP=y +CONFIG_NF_CONNTRACK_LABELS=y +CONFIG_NF_CT_PROTO_DCCP=y +CONFIG_NF_CT_PROTO_GRE=y +CONFIG_NF_CT_PROTO_SCTP=y +CONFIG_NF_CT_PROTO_UDPLITE=y +CONFIG_NF_CONNTRACK_AMANDA=y +CONFIG_NF_CONNTRACK_FTP=y +CONFIG_NF_CONNTRACK_H323=y +CONFIG_NF_CONNTRACK_IRC=y +CONFIG_NF_CONNTRACK_BROADCAST=y +CONFIG_NF_CONNTRACK_NETBIOS_NS=y +CONFIG_NF_CONNTRACK_SNMP=y +CONFIG_NF_CONNTRACK_PPTP=y +CONFIG_NF_CONNTRACK_SANE=y +CONFIG_NF_CONNTRACK_SIP=y +CONFIG_NF_CONNTRACK_TFTP=y +CONFIG_NF_CT_NETLINK=y +CONFIG_NF_CT_NETLINK_TIMEOUT=y +CONFIG_NF_CT_NETLINK_HELPER=y +CONFIG_NETFILTER_NETLINK_GLUE_CT=y +CONFIG_NF_NAT=y +CONFIG_NF_NAT_NEEDED=y +CONFIG_NF_NAT_PROTO_DCCP=y +CONFIG_NF_NAT_PROTO_UDPLITE=y +CONFIG_NF_NAT_PROTO_SCTP=y +CONFIG_NF_NAT_AMANDA=y +CONFIG_NF_NAT_FTP=y +CONFIG_NF_NAT_IRC=y +CONFIG_NF_NAT_SIP=y +CONFIG_NF_NAT_TFTP=y +CONFIG_NF_NAT_REDIRECT=y +CONFIG_NETFILTER_SYNPROXY=y +CONFIG_NF_TABLES=y +CONFIG_NF_TABLES_INET=y +CONFIG_NF_TABLES_NETDEV=y +CONFIG_NFT_EXTHDR=y +CONFIG_NFT_META=y +# CONFIG_NFT_RT is not set +# CONFIG_NFT_NUMGEN is not set +CONFIG_NFT_CT=y +# CONFIG_NFT_SET_RBTREE is not set +# CONFIG_NFT_SET_HASH is not set +# CONFIG_NFT_SET_BITMAP is not set +CONFIG_NFT_COUNTER=y +CONFIG_NFT_LOG=y +CONFIG_NFT_LIMIT=y +CONFIG_NFT_MASQ=y +CONFIG_NFT_REDIR=y +CONFIG_NFT_NAT=y +# CONFIG_NFT_OBJREF is not set +CONFIG_NFT_QUEUE=y +# CONFIG_NFT_QUOTA is not set +CONFIG_NFT_REJECT=y +CONFIG_NFT_REJECT_INET=y +CONFIG_NFT_COMPAT=y +CONFIG_NFT_HASH=y +CONFIG_NF_DUP_NETDEV=y +CONFIG_NFT_DUP_NETDEV=y +CONFIG_NFT_FWD_NETDEV=y +CONFIG_NETFILTER_XTABLES=y + +# +# Xtables combined modules +# +CONFIG_NETFILTER_XT_MARK=y +CONFIG_NETFILTER_XT_CONNMARK=y +CONFIG_NETFILTER_XT_SET=y + +# +# Xtables targets +# +# CONFIG_NETFILTER_XT_TARGET_AUDIT is not set +CONFIG_NETFILTER_XT_TARGET_CHECKSUM=y +CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y +CONFIG_NETFILTER_XT_TARGET_CONNMARK=y +CONFIG_NETFILTER_XT_TARGET_CT=y +CONFIG_NETFILTER_XT_TARGET_DSCP=y +CONFIG_NETFILTER_XT_TARGET_HL=y +CONFIG_NETFILTER_XT_TARGET_HMARK=y +CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y +CONFIG_NETFILTER_XT_TARGET_LOG=y +CONFIG_NETFILTER_XT_TARGET_MARK=y +CONFIG_NETFILTER_XT_NAT=y +CONFIG_NETFILTER_XT_TARGET_NETMAP=y +CONFIG_NETFILTER_XT_TARGET_NFLOG=y +CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y +CONFIG_NETFILTER_XT_TARGET_NOTRACK=y +CONFIG_NETFILTER_XT_TARGET_RATEEST=y +CONFIG_NETFILTER_XT_TARGET_REDIRECT=y +CONFIG_NETFILTER_XT_TARGET_TEE=y +CONFIG_NETFILTER_XT_TARGET_TPROXY=y +CONFIG_NETFILTER_XT_TARGET_TRACE=y +# CONFIG_NETFILTER_XT_TARGET_SECMARK is not set +CONFIG_NETFILTER_XT_TARGET_TCPMSS=y +CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=y + +# +# Xtables matches +# +CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y +CONFIG_NETFILTER_XT_MATCH_BPF=y +CONFIG_NETFILTER_XT_MATCH_CGROUP=y +CONFIG_NETFILTER_XT_MATCH_CLUSTER=y +CONFIG_NETFILTER_XT_MATCH_COMMENT=y +CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y +CONFIG_NETFILTER_XT_MATCH_CONNLABEL=y +CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y +CONFIG_NETFILTER_XT_MATCH_CONNMARK=y +CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y +CONFIG_NETFILTER_XT_MATCH_CPU=y +CONFIG_NETFILTER_XT_MATCH_DCCP=y +CONFIG_NETFILTER_XT_MATCH_DEVGROUP=y +CONFIG_NETFILTER_XT_MATCH_DSCP=y +CONFIG_NETFILTER_XT_MATCH_ECN=y +CONFIG_NETFILTER_XT_MATCH_ESP=y +CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y +CONFIG_NETFILTER_XT_MATCH_HELPER=y +CONFIG_NETFILTER_XT_MATCH_HL=y +CONFIG_NETFILTER_XT_MATCH_IPCOMP=y +CONFIG_NETFILTER_XT_MATCH_IPRANGE=y +CONFIG_NETFILTER_XT_MATCH_IPVS=y +CONFIG_NETFILTER_XT_MATCH_L2TP=y +CONFIG_NETFILTER_XT_MATCH_LENGTH=y +CONFIG_NETFILTER_XT_MATCH_LIMIT=y +CONFIG_NETFILTER_XT_MATCH_MAC=y +CONFIG_NETFILTER_XT_MATCH_MARK=y +CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y +CONFIG_NETFILTER_XT_MATCH_NFACCT=y +CONFIG_NETFILTER_XT_MATCH_OSF=y +CONFIG_NETFILTER_XT_MATCH_OWNER=y +CONFIG_NETFILTER_XT_MATCH_POLICY=y +CONFIG_NETFILTER_XT_MATCH_PHYSDEV=y +CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y +CONFIG_NETFILTER_XT_MATCH_QUOTA=y +CONFIG_NETFILTER_XT_MATCH_RATEEST=y +CONFIG_NETFILTER_XT_MATCH_REALM=y +CONFIG_NETFILTER_XT_MATCH_RECENT=y +CONFIG_NETFILTER_XT_MATCH_SCTP=y +CONFIG_NETFILTER_XT_MATCH_STATE=y +CONFIG_NETFILTER_XT_MATCH_STATISTIC=y +CONFIG_NETFILTER_XT_MATCH_STRING=y +CONFIG_NETFILTER_XT_MATCH_TCPMSS=y +CONFIG_NETFILTER_XT_MATCH_TIME=y +CONFIG_NETFILTER_XT_MATCH_U32=y +CONFIG_IP_SET=y +CONFIG_IP_SET_MAX=256 +CONFIG_IP_SET_BITMAP_IP=y +CONFIG_IP_SET_BITMAP_IPMAC=y +CONFIG_IP_SET_BITMAP_PORT=y +CONFIG_IP_SET_HASH_IP=y +# CONFIG_IP_SET_HASH_IPMARK is not set +CONFIG_IP_SET_HASH_IPPORT=y +CONFIG_IP_SET_HASH_IPPORTIP=y +CONFIG_IP_SET_HASH_IPPORTNET=y +# CONFIG_IP_SET_HASH_IPMAC is not set +# CONFIG_IP_SET_HASH_MAC is not set +# CONFIG_IP_SET_HASH_NETPORTNET is not set +CONFIG_IP_SET_HASH_NET=y +# CONFIG_IP_SET_HASH_NETNET is not set +CONFIG_IP_SET_HASH_NETPORT=y +CONFIG_IP_SET_HASH_NETIFACE=y +CONFIG_IP_SET_LIST_SET=y +CONFIG_IP_VS=y +CONFIG_IP_VS_IPV6=y +CONFIG_IP_VS_DEBUG=y +CONFIG_IP_VS_TAB_BITS=12 + +# +# IPVS transport protocol load balancing support +# +CONFIG_IP_VS_PROTO_TCP=y +CONFIG_IP_VS_PROTO_UDP=y +CONFIG_IP_VS_PROTO_AH_ESP=y +CONFIG_IP_VS_PROTO_ESP=y +CONFIG_IP_VS_PROTO_AH=y +CONFIG_IP_VS_PROTO_SCTP=y + +# +# IPVS scheduler +# +CONFIG_IP_VS_RR=y +CONFIG_IP_VS_WRR=y +CONFIG_IP_VS_LC=y +CONFIG_IP_VS_WLC=y +CONFIG_IP_VS_FO=y +CONFIG_IP_VS_OVF=y +CONFIG_IP_VS_LBLC=y +CONFIG_IP_VS_LBLCR=y +CONFIG_IP_VS_DH=y +CONFIG_IP_VS_SH=y +CONFIG_IP_VS_SED=y +CONFIG_IP_VS_NQ=y + +# +# IPVS SH scheduler +# +CONFIG_IP_VS_SH_TAB_BITS=8 + +# +# IPVS application helper +# +CONFIG_IP_VS_FTP=y +CONFIG_IP_VS_NFCT=y +# CONFIG_IP_VS_PE_SIP is not set + +# +# IP: Netfilter Configuration +# +CONFIG_NF_DEFRAG_IPV4=y +CONFIG_NF_CONNTRACK_IPV4=y +# CONFIG_NF_SOCKET_IPV4 is not set +CONFIG_NF_TABLES_IPV4=y +CONFIG_NFT_CHAIN_ROUTE_IPV4=y +CONFIG_NFT_REJECT_IPV4=y +CONFIG_NFT_DUP_IPV4=y +# CONFIG_NFT_FIB_IPV4 is not set +CONFIG_NF_TABLES_ARP=y +CONFIG_NF_DUP_IPV4=y +CONFIG_NF_LOG_ARP=y +CONFIG_NF_LOG_IPV4=y +CONFIG_NF_REJECT_IPV4=y +CONFIG_NF_NAT_IPV4=y +CONFIG_NFT_CHAIN_NAT_IPV4=y +CONFIG_NF_NAT_MASQUERADE_IPV4=y +CONFIG_NFT_MASQ_IPV4=y +CONFIG_NFT_REDIR_IPV4=y +CONFIG_NF_NAT_SNMP_BASIC=y +CONFIG_NF_NAT_PROTO_GRE=y +CONFIG_NF_NAT_PPTP=y +CONFIG_NF_NAT_H323=y +CONFIG_IP_NF_IPTABLES=y +CONFIG_IP_NF_MATCH_AH=y +CONFIG_IP_NF_MATCH_ECN=y +CONFIG_IP_NF_MATCH_RPFILTER=y +CONFIG_IP_NF_MATCH_TTL=y +CONFIG_IP_NF_FILTER=y +CONFIG_IP_NF_TARGET_REJECT=y +CONFIG_IP_NF_TARGET_SYNPROXY=y +CONFIG_IP_NF_NAT=y +CONFIG_IP_NF_TARGET_MASQUERADE=y +CONFIG_IP_NF_TARGET_NETMAP=y +CONFIG_IP_NF_TARGET_REDIRECT=y +CONFIG_IP_NF_MANGLE=y +CONFIG_IP_NF_TARGET_CLUSTERIP=y +CONFIG_IP_NF_TARGET_ECN=y +CONFIG_IP_NF_TARGET_TTL=y +CONFIG_IP_NF_RAW=y +CONFIG_IP_NF_SECURITY=y +CONFIG_IP_NF_ARPTABLES=y +CONFIG_IP_NF_ARPFILTER=y +CONFIG_IP_NF_ARP_MANGLE=y + +# +# IPv6: Netfilter Configuration +# +CONFIG_NF_DEFRAG_IPV6=y +CONFIG_NF_CONNTRACK_IPV6=y +# CONFIG_NF_SOCKET_IPV6 is not set +CONFIG_NF_TABLES_IPV6=y +CONFIG_NFT_CHAIN_ROUTE_IPV6=y +CONFIG_NFT_REJECT_IPV6=y +CONFIG_NFT_DUP_IPV6=y +# CONFIG_NFT_FIB_IPV6 is not set +CONFIG_NF_DUP_IPV6=y +CONFIG_NF_REJECT_IPV6=y +CONFIG_NF_LOG_IPV6=y +CONFIG_NF_NAT_IPV6=y +CONFIG_NFT_CHAIN_NAT_IPV6=y +CONFIG_NF_NAT_MASQUERADE_IPV6=y +CONFIG_NFT_MASQ_IPV6=y +CONFIG_NFT_REDIR_IPV6=y +CONFIG_IP6_NF_IPTABLES=y +CONFIG_IP6_NF_MATCH_AH=y +CONFIG_IP6_NF_MATCH_EUI64=y +CONFIG_IP6_NF_MATCH_FRAG=y +CONFIG_IP6_NF_MATCH_OPTS=y +CONFIG_IP6_NF_MATCH_HL=y +CONFIG_IP6_NF_MATCH_IPV6HEADER=y +CONFIG_IP6_NF_MATCH_MH=y +CONFIG_IP6_NF_MATCH_RPFILTER=y +CONFIG_IP6_NF_MATCH_RT=y +CONFIG_IP6_NF_TARGET_HL=y +CONFIG_IP6_NF_FILTER=y +CONFIG_IP6_NF_TARGET_REJECT=y +CONFIG_IP6_NF_TARGET_SYNPROXY=y +CONFIG_IP6_NF_MANGLE=y +CONFIG_IP6_NF_RAW=y +CONFIG_IP6_NF_SECURITY=y +CONFIG_IP6_NF_NAT=y +CONFIG_IP6_NF_TARGET_MASQUERADE=y +CONFIG_IP6_NF_TARGET_NPT=y +CONFIG_NF_TABLES_BRIDGE=y +CONFIG_NFT_BRIDGE_META=y +CONFIG_NFT_BRIDGE_REJECT=y +CONFIG_NF_LOG_BRIDGE=y +CONFIG_BRIDGE_NF_EBTABLES=y +CONFIG_BRIDGE_EBT_BROUTE=y +CONFIG_BRIDGE_EBT_T_FILTER=y +CONFIG_BRIDGE_EBT_T_NAT=y +CONFIG_BRIDGE_EBT_802_3=y +CONFIG_BRIDGE_EBT_AMONG=y +CONFIG_BRIDGE_EBT_ARP=y +CONFIG_BRIDGE_EBT_IP=y +CONFIG_BRIDGE_EBT_IP6=y +CONFIG_BRIDGE_EBT_LIMIT=y +CONFIG_BRIDGE_EBT_MARK=y +CONFIG_BRIDGE_EBT_PKTTYPE=y +CONFIG_BRIDGE_EBT_STP=y +CONFIG_BRIDGE_EBT_VLAN=y +CONFIG_BRIDGE_EBT_ARPREPLY=y +CONFIG_BRIDGE_EBT_DNAT=y +CONFIG_BRIDGE_EBT_MARK_T=y +CONFIG_BRIDGE_EBT_REDIRECT=y +CONFIG_BRIDGE_EBT_SNAT=y +CONFIG_BRIDGE_EBT_LOG=y +CONFIG_BRIDGE_EBT_NFLOG=y +# CONFIG_IP_DCCP is not set +# CONFIG_IP_SCTP is not set +# CONFIG_RDS is not set +# CONFIG_TIPC is not set +# CONFIG_ATM is not set +CONFIG_L2TP=y +# CONFIG_L2TP_DEBUGFS is not set +# CONFIG_L2TP_V3 is not set +CONFIG_STP=y +CONFIG_BRIDGE=y +CONFIG_BRIDGE_IGMP_SNOOPING=y +CONFIG_BRIDGE_VLAN_FILTERING=y +CONFIG_HAVE_NET_DSA=y +# CONFIG_NET_DSA is not set +CONFIG_VLAN_8021Q=y +# CONFIG_VLAN_8021Q_GVRP is not set +# CONFIG_VLAN_8021Q_MVRP is not set +# CONFIG_DECNET is not set +CONFIG_LLC=y +# CONFIG_LLC2 is not set +# CONFIG_IPX is not set +# CONFIG_ATALK is not set +# CONFIG_X25 is not set +# CONFIG_LAPB is not set +# CONFIG_PHONET is not set +# CONFIG_6LOWPAN is not set +# CONFIG_IEEE802154 is not set +CONFIG_NET_SCHED=y + +# +# Queueing/Scheduling +# +CONFIG_NET_SCH_CBQ=y +CONFIG_NET_SCH_HTB=y +CONFIG_NET_SCH_HFSC=y +CONFIG_NET_SCH_PRIO=y +CONFIG_NET_SCH_MULTIQ=y +CONFIG_NET_SCH_RED=y +CONFIG_NET_SCH_SFB=y +CONFIG_NET_SCH_SFQ=y +CONFIG_NET_SCH_TEQL=y +CONFIG_NET_SCH_TBF=y +CONFIG_NET_SCH_GRED=y +CONFIG_NET_SCH_DSMARK=y +CONFIG_NET_SCH_NETEM=y +CONFIG_NET_SCH_DRR=y +CONFIG_NET_SCH_MQPRIO=y +CONFIG_NET_SCH_CHOKE=y +CONFIG_NET_SCH_QFQ=y +# CONFIG_NET_SCH_CODEL is not set +# CONFIG_NET_SCH_FQ_CODEL is not set +# CONFIG_NET_SCH_FQ is not set +# CONFIG_NET_SCH_HHF is not set +# CONFIG_NET_SCH_PIE is not set +CONFIG_NET_SCH_INGRESS=y +# CONFIG_NET_SCH_PLUG is not set + +# +# Classification +# +CONFIG_NET_CLS=y +CONFIG_NET_CLS_BASIC=y +CONFIG_NET_CLS_TCINDEX=y +CONFIG_NET_CLS_ROUTE4=y +CONFIG_NET_CLS_FW=y +CONFIG_NET_CLS_U32=y +CONFIG_CLS_U32_PERF=y +CONFIG_CLS_U32_MARK=y +CONFIG_NET_CLS_RSVP=y +CONFIG_NET_CLS_RSVP6=y +CONFIG_NET_CLS_FLOW=y +CONFIG_NET_CLS_CGROUP=y +CONFIG_NET_CLS_BPF=y +# CONFIG_NET_CLS_FLOWER is not set +CONFIG_NET_CLS_MATCHALL=y +CONFIG_NET_EMATCH=y +CONFIG_NET_EMATCH_STACK=32 +CONFIG_NET_EMATCH_CMP=y +CONFIG_NET_EMATCH_NBYTE=y +CONFIG_NET_EMATCH_U32=y +CONFIG_NET_EMATCH_META=y +CONFIG_NET_EMATCH_TEXT=y +CONFIG_NET_EMATCH_IPSET=y +CONFIG_NET_CLS_ACT=y +CONFIG_NET_ACT_POLICE=y +CONFIG_NET_ACT_GACT=y +CONFIG_GACT_PROB=y +CONFIG_NET_ACT_MIRRED=y +# CONFIG_NET_ACT_SAMPLE is not set +CONFIG_NET_ACT_IPT=y +CONFIG_NET_ACT_NAT=y +CONFIG_NET_ACT_PEDIT=y +CONFIG_NET_ACT_SIMP=y +CONFIG_NET_ACT_SKBEDIT=y +CONFIG_NET_ACT_CSUM=y +# CONFIG_NET_ACT_VLAN is not set +CONFIG_NET_ACT_BPF=y +# CONFIG_NET_ACT_CONNMARK is not set +# CONFIG_NET_ACT_SKBMOD is not set +# CONFIG_NET_ACT_IFE is not set +# CONFIG_NET_ACT_TUNNEL_KEY is not set +CONFIG_NET_CLS_IND=y +CONFIG_NET_SCH_FIFO=y +# CONFIG_DCB is not set +CONFIG_DNS_RESOLVER=y +# CONFIG_BATMAN_ADV is not set +CONFIG_OPENVSWITCH=y +CONFIG_OPENVSWITCH_GRE=y +CONFIG_OPENVSWITCH_VXLAN=y +CONFIG_OPENVSWITCH_GENEVE=y +CONFIG_VSOCKETS=y +CONFIG_VIRTIO_VSOCKETS=y +CONFIG_VIRTIO_VSOCKETS_COMMON=y +CONFIG_NETLINK_DIAG=y +CONFIG_MPLS=y +CONFIG_NET_MPLS_GSO=y +# CONFIG_MPLS_ROUTING is not set +# CONFIG_HSR is not set +CONFIG_NET_SWITCHDEV=y +CONFIG_NET_L3_MASTER_DEV=y +# CONFIG_NET_NCSI is not set +CONFIG_RPS=y +CONFIG_RFS_ACCEL=y +CONFIG_XPS=y +CONFIG_CGROUP_NET_PRIO=y +CONFIG_CGROUP_NET_CLASSID=y +CONFIG_NET_RX_BUSY_POLL=y +CONFIG_BQL=y +CONFIG_BPF_JIT=y +CONFIG_NET_FLOW_LIMIT=y + +# +# Network testing +# +# CONFIG_NET_PKTGEN is not set +# CONFIG_NET_TCPPROBE is not set +# CONFIG_NET_DROP_MONITOR is not set +# CONFIG_HAMRADIO is not set +# CONFIG_CAN is not set +# CONFIG_IRDA is not set +# CONFIG_BT is not set +# CONFIG_AF_RXRPC is not set +# CONFIG_AF_KCM is not set +# CONFIG_STREAM_PARSER is not set +CONFIG_FIB_RULES=y +# CONFIG_WIRELESS is not set +# CONFIG_WIMAX is not set +# CONFIG_RFKILL is not set +CONFIG_NET_9P=y +CONFIG_NET_9P_VIRTIO=y +# CONFIG_NET_9P_DEBUG is not set +# CONFIG_CAIF is not set +# CONFIG_CEPH_LIB is not set +# CONFIG_NFC is not set +# CONFIG_PSAMPLE is not set +# CONFIG_NET_IFE is not set +CONFIG_LWTUNNEL=y +CONFIG_LWTUNNEL_BPF=y +CONFIG_DST_CACHE=y +CONFIG_GRO_CELLS=y +# CONFIG_NET_DEVLINK is not set +CONFIG_MAY_USE_DEVLINK=y +CONFIG_HAVE_EBPF_JIT=y + +# +# Device Drivers +# + +# +# Generic Driver Options +# +CONFIG_UEVENT_HELPER=y +CONFIG_UEVENT_HELPER_PATH="" +CONFIG_DEVTMPFS=y +# CONFIG_DEVTMPFS_MOUNT is not set +CONFIG_STANDALONE=y +CONFIG_PREVENT_FIRMWARE_BUILD=y +CONFIG_FW_LOADER=y +CONFIG_FIRMWARE_IN_KERNEL=y +CONFIG_EXTRA_FIRMWARE="" +# CONFIG_FW_LOADER_USER_HELPER_FALLBACK is not set +CONFIG_ALLOW_DEV_COREDUMP=y +# CONFIG_DEBUG_DRIVER is not set +# CONFIG_DEBUG_DEVRES is not set +# CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set +# CONFIG_TEST_ASYNC_DRIVER_PROBE is not set +CONFIG_SYS_HYPERVISOR=y +# CONFIG_GENERIC_CPU_DEVICES is not set +CONFIG_GENERIC_CPU_AUTOPROBE=y +CONFIG_REGMAP=y +CONFIG_REGMAP_I2C=y +# CONFIG_DMA_SHARED_BUFFER is not set + +# +# Bus devices +# +CONFIG_CONNECTOR=y +CONFIG_PROC_EVENTS=y +# CONFIG_MTD is not set +# CONFIG_OF is not set +CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y +# CONFIG_PARPORT is not set +CONFIG_PNP=y +# CONFIG_PNP_DEBUG_MESSAGES is not set + +# +# Protocols +# +CONFIG_PNPACPI=y +CONFIG_BLK_DEV=y +# CONFIG_BLK_DEV_NULL_BLK is not set +# CONFIG_BLK_DEV_FD is not set +# CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set +# CONFIG_BLK_CPQ_CISS_DA is not set +# CONFIG_BLK_DEV_DAC960 is not set +# CONFIG_BLK_DEV_UMEM is not set +# CONFIG_BLK_DEV_COW_COMMON is not set +CONFIG_BLK_DEV_LOOP=y +CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 +CONFIG_BLK_DEV_CRYPTOLOOP=y +# CONFIG_BLK_DEV_DRBD is not set +CONFIG_BLK_DEV_NBD=y +# CONFIG_BLK_DEV_SKD is not set +# CONFIG_BLK_DEV_SX8 is not set +# CONFIG_BLK_DEV_RAM is not set +# CONFIG_CDROM_PKTCDVD is not set +CONFIG_ATA_OVER_ETH=y +CONFIG_XEN_BLKDEV_FRONTEND=y +CONFIG_VIRTIO_BLK=y +# CONFIG_VIRTIO_BLK_SCSI is not set +# CONFIG_BLK_DEV_HD is not set +# CONFIG_BLK_DEV_RBD is not set +# CONFIG_BLK_DEV_RSXX is not set +CONFIG_NVME_CORE=y +CONFIG_BLK_DEV_NVME=y +# CONFIG_BLK_DEV_NVME_SCSI is not set +# CONFIG_NVME_FC is not set + +# +# Misc devices +# +# CONFIG_SENSORS_LIS3LV02D is not set +# CONFIG_AD525X_DPOT is not set +# CONFIG_DUMMY_IRQ is not set +# CONFIG_IBM_ASM is not set +# CONFIG_PHANTOM is not set +# CONFIG_SGI_IOC4 is not set +# CONFIG_TIFM_CORE is not set +# CONFIG_ICS932S401 is not set +# CONFIG_ENCLOSURE_SERVICES is not set +# CONFIG_HP_ILO is not set +# CONFIG_APDS9802ALS is not set +# CONFIG_ISL29003 is not set +# CONFIG_ISL29020 is not set +# CONFIG_SENSORS_TSL2550 is not set +# CONFIG_SENSORS_BH1770 is not set +# CONFIG_SENSORS_APDS990X is not set +# CONFIG_HMC6352 is not set +# CONFIG_DS1682 is not set +# CONFIG_USB_SWITCH_FSA9480 is not set +# CONFIG_SRAM is not set +# CONFIG_C2PORT is not set + +# +# EEPROM support +# +# CONFIG_EEPROM_AT24 is not set +# CONFIG_EEPROM_LEGACY is not set +# CONFIG_EEPROM_MAX6875 is not set +# CONFIG_EEPROM_93CX6 is not set +# CONFIG_EEPROM_IDT_89HPESX is not set +# CONFIG_CB710_CORE is not set + +# +# Texas Instruments shared transport line discipline +# +# CONFIG_SENSORS_LIS3_I2C is not set + +# +# Altera FPGA firmware download module +# +# CONFIG_ALTERA_STAPL is not set +# CONFIG_INTEL_MEI is not set +# CONFIG_INTEL_MEI_ME is not set +# CONFIG_INTEL_MEI_TXE is not set +# CONFIG_VMWARE_VMCI is not set + +# +# Intel MIC Bus Driver +# +# CONFIG_INTEL_MIC_BUS is not set + +# +# SCIF Bus Driver +# +# CONFIG_SCIF_BUS is not set + +# +# VOP Bus Driver +# +# CONFIG_VOP_BUS is not set + +# +# Intel MIC Host Driver +# + +# +# Intel MIC Card Driver +# + +# +# SCIF Driver +# + +# +# Intel MIC Coprocessor State Management (COSM) Drivers +# + +# +# VOP Driver +# +# CONFIG_GENWQE is not set +# CONFIG_ECHO is not set +# CONFIG_CXL_BASE is not set +# CONFIG_CXL_AFU_DRIVER_OPS is not set +CONFIG_HAVE_IDE=y +# CONFIG_IDE is not set + +# +# SCSI device support +# +CONFIG_SCSI_MOD=y +# CONFIG_RAID_ATTRS is not set +CONFIG_SCSI=y +CONFIG_SCSI_DMA=y +# CONFIG_SCSI_NETLINK is not set +# CONFIG_SCSI_MQ_DEFAULT is not set +CONFIG_SCSI_PROC_FS=y + +# +# SCSI support type (disk, tape, CD-ROM) +# +CONFIG_BLK_DEV_SD=y +# CONFIG_CHR_DEV_ST is not set +# CONFIG_CHR_DEV_OSST is not set +CONFIG_BLK_DEV_SR=y +# CONFIG_BLK_DEV_SR_VENDOR is not set +CONFIG_CHR_DEV_SG=y +# CONFIG_CHR_DEV_SCH is not set +# CONFIG_SCSI_CONSTANTS is not set +# CONFIG_SCSI_LOGGING is not set +# CONFIG_SCSI_SCAN_ASYNC is not set + +# +# SCSI Transports +# +CONFIG_SCSI_SPI_ATTRS=y +# CONFIG_SCSI_FC_ATTRS is not set +# CONFIG_SCSI_ISCSI_ATTRS is not set +# CONFIG_SCSI_SAS_ATTRS is not set +# CONFIG_SCSI_SAS_LIBSAS is not set +# CONFIG_SCSI_SRP_ATTRS is not set +CONFIG_SCSI_LOWLEVEL=y +# CONFIG_ISCSI_TCP is not set +# CONFIG_ISCSI_BOOT_SYSFS is not set +# CONFIG_SCSI_CXGB3_ISCSI is not set +# CONFIG_SCSI_CXGB4_ISCSI is not set +# CONFIG_SCSI_BNX2_ISCSI is not set +# CONFIG_BE2ISCSI is not set +# CONFIG_BLK_DEV_3W_XXXX_RAID is not set +# CONFIG_SCSI_HPSA is not set +# CONFIG_SCSI_3W_9XXX is not set +# CONFIG_SCSI_3W_SAS is not set +# CONFIG_SCSI_ACARD is not set +# CONFIG_SCSI_AACRAID is not set +# CONFIG_SCSI_AIC7XXX is not set +# CONFIG_SCSI_AIC79XX is not set +# CONFIG_SCSI_AIC94XX is not set +# CONFIG_SCSI_MVSAS is not set +# CONFIG_SCSI_MVUMI is not set +# CONFIG_SCSI_DPT_I2O is not set +# CONFIG_SCSI_ADVANSYS is not set +# CONFIG_SCSI_ARCMSR is not set +# CONFIG_SCSI_ESAS2R is not set +# CONFIG_MEGARAID_NEWGEN is not set +# CONFIG_MEGARAID_LEGACY is not set +# CONFIG_MEGARAID_SAS is not set +# CONFIG_SCSI_MPT3SAS is not set +# CONFIG_SCSI_MPT2SAS is not set +# CONFIG_SCSI_SMARTPQI is not set +# CONFIG_SCSI_UFSHCD is not set +# CONFIG_SCSI_HPTIOP is not set +# CONFIG_SCSI_BUSLOGIC is not set +CONFIG_VMWARE_PVSCSI=y +CONFIG_XEN_SCSI_FRONTEND=y +CONFIG_HYPERV_STORAGE=y +# CONFIG_SCSI_SNIC is not set +# CONFIG_SCSI_DMX3191D is not set +# CONFIG_SCSI_EATA is not set +# CONFIG_SCSI_FUTURE_DOMAIN is not set +# CONFIG_SCSI_GDTH is not set +# CONFIG_SCSI_ISCI is not set +# CONFIG_SCSI_IPS is not set +# CONFIG_SCSI_INITIO is not set +# CONFIG_SCSI_INIA100 is not set +# CONFIG_SCSI_STEX is not set +# CONFIG_SCSI_SYM53C8XX_2 is not set +# CONFIG_SCSI_IPR is not set +# CONFIG_SCSI_QLOGIC_1280 is not set +# CONFIG_SCSI_QLA_ISCSI is not set +# CONFIG_SCSI_DC395x is not set +# CONFIG_SCSI_AM53C974 is not set +# CONFIG_SCSI_WD719X is not set +# CONFIG_SCSI_DEBUG is not set +# CONFIG_SCSI_PMCRAID is not set +# CONFIG_SCSI_PM8001 is not set +CONFIG_SCSI_VIRTIO=y +# CONFIG_SCSI_DH is not set +# CONFIG_SCSI_OSD_INITIATOR is not set +CONFIG_ATA=y +# CONFIG_ATA_NONSTANDARD is not set +# CONFIG_ATA_VERBOSE_ERROR is not set +CONFIG_ATA_ACPI=y +# CONFIG_SATA_ZPODD is not set +# CONFIG_SATA_PMP is not set + +# +# Controllers with non-SFF native interface +# +CONFIG_SATA_AHCI=y +# CONFIG_SATA_AHCI_PLATFORM is not set +# CONFIG_SATA_INIC162X is not set +# CONFIG_SATA_ACARD_AHCI is not set +# CONFIG_SATA_SIL24 is not set +CONFIG_ATA_SFF=y + +# +# SFF controllers with custom DMA interface +# +# CONFIG_PDC_ADMA is not set +# CONFIG_SATA_QSTOR is not set +# CONFIG_SATA_SX4 is not set +CONFIG_ATA_BMDMA=y + +# +# SATA SFF controllers with BMDMA +# +CONFIG_ATA_PIIX=y +CONFIG_SATA_MV=y +CONFIG_SATA_NV=y +CONFIG_SATA_PROMISE=y +CONFIG_SATA_SIL=y +CONFIG_SATA_SIS=y +CONFIG_SATA_SVW=y +CONFIG_SATA_ULI=y +CONFIG_SATA_VIA=y +CONFIG_SATA_VITESSE=y + +# +# PATA SFF controllers with BMDMA +# +# CONFIG_PATA_ALI is not set +# CONFIG_PATA_AMD is not set +# CONFIG_PATA_ARTOP is not set +# CONFIG_PATA_ATIIXP is not set +# CONFIG_PATA_ATP867X is not set +# CONFIG_PATA_CMD64X is not set +# CONFIG_PATA_CYPRESS is not set +# CONFIG_PATA_EFAR is not set +# CONFIG_PATA_HPT366 is not set +# CONFIG_PATA_HPT37X is not set +# CONFIG_PATA_HPT3X2N is not set +# CONFIG_PATA_HPT3X3 is not set +# CONFIG_PATA_IT8213 is not set +# CONFIG_PATA_IT821X is not set +# CONFIG_PATA_JMICRON is not set +# CONFIG_PATA_MARVELL is not set +# CONFIG_PATA_NETCELL is not set +# CONFIG_PATA_NINJA32 is not set +# CONFIG_PATA_NS87415 is not set +# CONFIG_PATA_OLDPIIX is not set +# CONFIG_PATA_OPTIDMA is not set +# CONFIG_PATA_PDC2027X is not set +# CONFIG_PATA_PDC_OLD is not set +# CONFIG_PATA_RADISYS is not set +# CONFIG_PATA_RDC is not set +# CONFIG_PATA_SCH is not set +# CONFIG_PATA_SERVERWORKS is not set +# CONFIG_PATA_SIL680 is not set +CONFIG_PATA_SIS=y +# CONFIG_PATA_TOSHIBA is not set +# CONFIG_PATA_TRIFLEX is not set +# CONFIG_PATA_VIA is not set +# CONFIG_PATA_WINBOND is not set + +# +# PIO-only SFF controllers +# +# CONFIG_PATA_CMD640_PCI is not set +# CONFIG_PATA_MPIIX is not set +# CONFIG_PATA_NS87410 is not set +# CONFIG_PATA_OPTI is not set +# CONFIG_PATA_PLATFORM is not set +# CONFIG_PATA_RZ1000 is not set + +# +# Generic fallback / legacy drivers +# +# CONFIG_PATA_ACPI is not set +CONFIG_ATA_GENERIC=y +# CONFIG_PATA_LEGACY is not set +CONFIG_MD=y +# CONFIG_BLK_DEV_MD is not set +# CONFIG_BCACHE is not set +CONFIG_BLK_DEV_DM_BUILTIN=y +CONFIG_BLK_DEV_DM=y +# CONFIG_DM_MQ_DEFAULT is not set +# CONFIG_DM_DEBUG is not set +CONFIG_DM_BUFIO=y +# CONFIG_DM_DEBUG_BLOCK_MANAGER_LOCKING is not set +CONFIG_DM_BIO_PRISON=y +CONFIG_DM_PERSISTENT_DATA=y +CONFIG_DM_CRYPT=y +CONFIG_DM_SNAPSHOT=y +CONFIG_DM_THIN_PROVISIONING=y +# CONFIG_DM_CACHE is not set +# CONFIG_DM_ERA is not set +# CONFIG_DM_MIRROR is not set +# CONFIG_DM_RAID is not set +# CONFIG_DM_ZERO is not set +# CONFIG_DM_MULTIPATH is not set +# CONFIG_DM_DELAY is not set +# CONFIG_DM_UEVENT is not set +# CONFIG_DM_FLAKEY is not set +# CONFIG_DM_VERITY is not set +# CONFIG_DM_SWITCH is not set +# CONFIG_DM_LOG_WRITES is not set +# CONFIG_TARGET_CORE is not set +CONFIG_FUSION=y +CONFIG_FUSION_SPI=y +# CONFIG_FUSION_SAS is not set +CONFIG_FUSION_MAX_SGE=128 +# CONFIG_FUSION_CTL is not set +# CONFIG_FUSION_LOGGING is not set + +# +# IEEE 1394 (FireWire) support +# +# CONFIG_FIREWIRE is not set +# CONFIG_FIREWIRE_NOSY is not set +# CONFIG_MACINTOSH_DRIVERS is not set +CONFIG_NETDEVICES=y +CONFIG_MII=y +CONFIG_NET_CORE=y +CONFIG_BONDING=y +CONFIG_DUMMY=y +# CONFIG_EQUALIZER is not set +# CONFIG_NET_FC is not set +# CONFIG_IFB is not set +# CONFIG_NET_TEAM is not set +CONFIG_MACVLAN=y +CONFIG_MACVTAP=y +CONFIG_IPVLAN=y +# CONFIG_IPVTAP is not set +CONFIG_VXLAN=y +CONFIG_GENEVE=y +# CONFIG_GTP is not set +# CONFIG_MACSEC is not set +# CONFIG_NETCONSOLE is not set +# CONFIG_NETPOLL is not set +# CONFIG_NET_POLL_CONTROLLER is not set +CONFIG_TUN=y +CONFIG_TAP=y +# CONFIG_TUN_VNET_CROSS_LE is not set +CONFIG_VETH=y +CONFIG_VIRTIO_NET=y +CONFIG_NLMON=y +# CONFIG_NET_VRF is not set +# CONFIG_ARCNET is not set + +# +# CAIF transport drivers +# + +# +# Distributed Switch Architecture drivers +# +CONFIG_ETHERNET=y +CONFIG_MDIO=y +# CONFIG_NET_VENDOR_3COM is not set +# CONFIG_NET_VENDOR_ADAPTEC is not set +# CONFIG_NET_VENDOR_AGERE is not set +CONFIG_NET_VENDOR_ALACRITECH=y +# CONFIG_SLICOSS is not set +# CONFIG_NET_VENDOR_ALTEON is not set +# CONFIG_ALTERA_TSE is not set +CONFIG_NET_VENDOR_AMAZON=y +CONFIG_ENA_ETHERNET=y +# CONFIG_NET_VENDOR_AMD is not set +CONFIG_NET_VENDOR_AQUANTIA=y +# CONFIG_AQTION is not set +# CONFIG_NET_VENDOR_ARC is not set +# CONFIG_NET_VENDOR_ATHEROS is not set +# CONFIG_NET_VENDOR_AURORA is not set +# CONFIG_NET_CADENCE is not set +# CONFIG_NET_VENDOR_BROADCOM is not set +# CONFIG_NET_VENDOR_BROCADE is not set +# CONFIG_NET_VENDOR_CAVIUM is not set +# CONFIG_NET_VENDOR_CHELSIO is not set +# CONFIG_NET_VENDOR_CISCO is not set +# CONFIG_CX_ECAT is not set +# CONFIG_DNET is not set +# CONFIG_NET_VENDOR_DEC is not set +# CONFIG_NET_VENDOR_DLINK is not set +# CONFIG_NET_VENDOR_EMULEX is not set +# CONFIG_NET_VENDOR_EZCHIP is not set +# CONFIG_NET_VENDOR_EXAR is not set +# CONFIG_NET_VENDOR_HP is not set +CONFIG_NET_VENDOR_INTEL=y +# CONFIG_E100 is not set +CONFIG_E1000=y +CONFIG_E1000E=y +CONFIG_E1000E_HWTS=y +CONFIG_IGB=y +CONFIG_IGB_HWMON=y +CONFIG_IGBVF=y +CONFIG_IXGB=y +CONFIG_IXGBE=y +CONFIG_IXGBE_HWMON=y +CONFIG_IXGBEVF=y +# CONFIG_I40E is not set +# CONFIG_I40EVF is not set +# CONFIG_FM10K is not set +# CONFIG_NET_VENDOR_I825XX is not set +# CONFIG_JME is not set +# CONFIG_NET_VENDOR_MARVELL is not set +CONFIG_NET_VENDOR_MELLANOX=y +# CONFIG_MLX4_EN is not set +# CONFIG_MLX4_CORE is not set +# CONFIG_MLX5_CORE is not set +# CONFIG_MLXSW_CORE is not set +# CONFIG_NET_VENDOR_MICREL is not set +# CONFIG_NET_VENDOR_MYRI is not set +# CONFIG_FEALNX is not set +# CONFIG_NET_VENDOR_NATSEMI is not set +CONFIG_NET_VENDOR_NETRONOME=y +# CONFIG_NFP is not set +# CONFIG_NET_VENDOR_NVIDIA is not set +# CONFIG_NET_VENDOR_OKI is not set +# CONFIG_ETHOC is not set +# CONFIG_NET_PACKET_ENGINE is not set +# CONFIG_NET_VENDOR_QLOGIC is not set +# CONFIG_NET_VENDOR_QUALCOMM is not set +CONFIG_NET_VENDOR_REALTEK=y +CONFIG_8139CP=y +# CONFIG_8139TOO is not set +# CONFIG_R8169 is not set +# CONFIG_NET_VENDOR_RENESAS is not set +# CONFIG_NET_VENDOR_RDC is not set +# CONFIG_NET_VENDOR_ROCKER is not set +# CONFIG_NET_VENDOR_SAMSUNG is not set +# CONFIG_NET_VENDOR_SEEQ is not set +# CONFIG_NET_VENDOR_SILAN is not set +# CONFIG_NET_VENDOR_SIS is not set +CONFIG_NET_VENDOR_SOLARFLARE=y +# CONFIG_SFC is not set +# CONFIG_SFC_FALCON is not set +# CONFIG_NET_VENDOR_SMSC is not set +# CONFIG_NET_VENDOR_STMICRO is not set +# CONFIG_NET_VENDOR_SUN is not set +# CONFIG_NET_VENDOR_TEHUTI is not set +# CONFIG_NET_VENDOR_TI is not set +# CONFIG_NET_VENDOR_VIA is not set +# CONFIG_NET_VENDOR_WIZNET is not set +# CONFIG_FDDI is not set +# CONFIG_HIPPI is not set +# CONFIG_NET_SB1000 is not set +# CONFIG_PHYLIB is not set +CONFIG_PPP=y +CONFIG_PPP_BSDCOMP=y +CONFIG_PPP_DEFLATE=y +CONFIG_PPP_FILTER=y +CONFIG_PPP_MPPE=y +CONFIG_PPP_MULTILINK=y +CONFIG_PPPOE=y +CONFIG_PPTP=y +CONFIG_PPPOL2TP=y +CONFIG_PPP_ASYNC=y +CONFIG_PPP_SYNC_TTY=y +# CONFIG_SLIP is not set +CONFIG_SLHC=y + +# +# Host-side USB support is needed for USB Network Adapter support +# +# CONFIG_WLAN is not set + +# +# Enable WiMAX (Networking options) to see the WiMAX drivers +# +# CONFIG_WAN is not set +CONFIG_XEN_NETDEV_FRONTEND=y +CONFIG_VMXNET3=y +# CONFIG_FUJITSU_ES is not set +CONFIG_HYPERV_NET=y +# CONFIG_ISDN is not set +# CONFIG_NVM is not set + +# +# Input device support +# +CONFIG_INPUT=y +CONFIG_INPUT_FF_MEMLESS=y +CONFIG_INPUT_POLLDEV=y +CONFIG_INPUT_SPARSEKMAP=y +# CONFIG_INPUT_MATRIXKMAP is not set + +# +# Userland interfaces +# +CONFIG_INPUT_MOUSEDEV=y +CONFIG_INPUT_MOUSEDEV_PSAUX=y +CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024 +CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768 +CONFIG_INPUT_JOYDEV=y +CONFIG_INPUT_EVDEV=y +# CONFIG_INPUT_EVBUG is not set + +# +# Input Device Drivers +# +CONFIG_INPUT_KEYBOARD=y +# CONFIG_KEYBOARD_ADP5588 is not set +# CONFIG_KEYBOARD_ADP5589 is not set +CONFIG_KEYBOARD_ATKBD=y +# CONFIG_KEYBOARD_QT1070 is not set +# CONFIG_KEYBOARD_QT2160 is not set +# CONFIG_KEYBOARD_LKKBD is not set +# CONFIG_KEYBOARD_TCA6416 is not set +# CONFIG_KEYBOARD_TCA8418 is not set +# CONFIG_KEYBOARD_LM8333 is not set +# CONFIG_KEYBOARD_MAX7359 is not set +# CONFIG_KEYBOARD_MCS is not set +# CONFIG_KEYBOARD_MPR121 is not set +# CONFIG_KEYBOARD_NEWTON is not set +# CONFIG_KEYBOARD_OPENCORES is not set +# CONFIG_KEYBOARD_SAMSUNG is not set +# CONFIG_KEYBOARD_STOWAWAY is not set +# CONFIG_KEYBOARD_SUNKBD is not set +# CONFIG_KEYBOARD_XTKBD is not set +# CONFIG_INPUT_MOUSE is not set +# CONFIG_INPUT_JOYSTICK is not set +# CONFIG_INPUT_TABLET is not set +# CONFIG_INPUT_TOUCHSCREEN is not set +CONFIG_INPUT_MISC=y +# CONFIG_INPUT_AD714X is not set +# CONFIG_INPUT_BMA150 is not set +# CONFIG_INPUT_E3X0_BUTTON is not set +CONFIG_INPUT_PCSPKR=y +# CONFIG_INPUT_MMA8450 is not set +CONFIG_INPUT_ATLAS_BTNS=y +# CONFIG_INPUT_KXTJ9 is not set +CONFIG_INPUT_UINPUT=y +# CONFIG_INPUT_PCF8574 is not set +# CONFIG_INPUT_ADXL34X is not set +# CONFIG_INPUT_CMA3000 is not set +CONFIG_INPUT_XEN_KBDDEV_FRONTEND=y +# CONFIG_INPUT_IDEAPAD_SLIDEBAR is not set +# CONFIG_INPUT_DRV2665_HAPTICS is not set +# CONFIG_INPUT_DRV2667_HAPTICS is not set +# CONFIG_RMI4_CORE is not set + +# +# Hardware I/O ports +# +CONFIG_SERIO=y +CONFIG_ARCH_MIGHT_HAVE_PC_SERIO=y +CONFIG_SERIO_I8042=y +CONFIG_SERIO_SERPORT=y +# CONFIG_SERIO_CT82C710 is not set +CONFIG_SERIO_PCIPS2=y +CONFIG_SERIO_LIBPS2=y +CONFIG_SERIO_RAW=y +# CONFIG_SERIO_ALTERA_PS2 is not set +# CONFIG_SERIO_PS2MULT is not set +# CONFIG_SERIO_ARC_PS2 is not set +CONFIG_HYPERV_KEYBOARD=y +# CONFIG_USERIO is not set +# CONFIG_GAMEPORT is not set + +# +# Character devices +# +CONFIG_TTY=y +CONFIG_VT=y +CONFIG_CONSOLE_TRANSLATIONS=y +CONFIG_VT_CONSOLE=y +CONFIG_VT_CONSOLE_SLEEP=y +CONFIG_HW_CONSOLE=y +CONFIG_VT_HW_CONSOLE_BINDING=y +CONFIG_UNIX98_PTYS=y +# CONFIG_LEGACY_PTYS is not set +# CONFIG_SERIAL_NONSTANDARD is not set +CONFIG_NOZOMI=y +# CONFIG_N_GSM is not set +# CONFIG_TRACE_SINK is not set +CONFIG_DEVMEM=y +# CONFIG_DEVKMEM is not set + +# +# Serial drivers +# +CONFIG_SERIAL_EARLYCON=y +CONFIG_SERIAL_8250=y +CONFIG_SERIAL_8250_DEPRECATED_OPTIONS=y +CONFIG_SERIAL_8250_PNP=y +# CONFIG_SERIAL_8250_FINTEK is not set +CONFIG_SERIAL_8250_CONSOLE=y +CONFIG_SERIAL_8250_PCI=y +CONFIG_SERIAL_8250_EXAR=y +CONFIG_SERIAL_8250_NR_UARTS=32 +CONFIG_SERIAL_8250_RUNTIME_UARTS=4 +# CONFIG_SERIAL_8250_EXTENDED is not set +# CONFIG_SERIAL_8250_FSL is not set +# CONFIG_SERIAL_8250_DW is not set +# CONFIG_SERIAL_8250_RT288X is not set +CONFIG_SERIAL_8250_LPSS=y +# CONFIG_SERIAL_8250_MID is not set +# CONFIG_SERIAL_8250_MOXA is not set + +# +# Non-8250 serial port support +# +# CONFIG_SERIAL_UARTLITE is not set +CONFIG_SERIAL_CORE=y +CONFIG_SERIAL_CORE_CONSOLE=y +# CONFIG_SERIAL_JSM is not set +# CONFIG_SERIAL_SCCNXP is not set +# CONFIG_SERIAL_SC16IS7XX is not set +# CONFIG_SERIAL_ALTERA_JTAGUART is not set +# CONFIG_SERIAL_ALTERA_UART is not set +# CONFIG_SERIAL_ARC is not set +# CONFIG_SERIAL_RP2 is not set +# CONFIG_SERIAL_FSL_LPUART is not set +# CONFIG_SERIAL_DEV_BUS is not set +# CONFIG_TTY_PRINTK is not set +CONFIG_HVC_DRIVER=y +CONFIG_HVC_IRQ=y +CONFIG_HVC_XEN=y +CONFIG_HVC_XEN_FRONTEND=y +CONFIG_VIRTIO_CONSOLE=y +# CONFIG_IPMI_HANDLER is not set +CONFIG_HW_RANDOM=y +CONFIG_HW_RANDOM_TIMERIOMEM=y +CONFIG_HW_RANDOM_INTEL=y +CONFIG_HW_RANDOM_AMD=y +CONFIG_HW_RANDOM_VIA=y +CONFIG_HW_RANDOM_VIRTIO=y +CONFIG_HW_RANDOM_TPM=y +CONFIG_NVRAM=y +# CONFIG_R3964 is not set +# CONFIG_APPLICOM is not set +# CONFIG_MWAVE is not set +# CONFIG_RAW_DRIVER is not set +CONFIG_HPET=y +CONFIG_HPET_MMAP=y +CONFIG_HPET_MMAP_DEFAULT=y +CONFIG_HANGCHECK_TIMER=y +CONFIG_TCG_TPM=y +CONFIG_TCG_TIS_CORE=y +CONFIG_TCG_TIS=y +# CONFIG_TCG_TIS_I2C_ATMEL is not set +# CONFIG_TCG_TIS_I2C_INFINEON is not set +# CONFIG_TCG_TIS_I2C_NUVOTON is not set +# CONFIG_TCG_NSC is not set +# CONFIG_TCG_ATMEL is not set +# CONFIG_TCG_INFINEON is not set +# CONFIG_TCG_XEN is not set +# CONFIG_TCG_CRB is not set +# CONFIG_TCG_VTPM_PROXY is not set +# CONFIG_TCG_TIS_ST33ZP24_I2C is not set +# CONFIG_TELCLOCK is not set +CONFIG_DEVPORT=y +# CONFIG_XILLYBUS is not set + +# +# I2C support +# +CONFIG_I2C=y +CONFIG_ACPI_I2C_OPREGION=y +CONFIG_I2C_BOARDINFO=y +CONFIG_I2C_COMPAT=y +CONFIG_I2C_CHARDEV=y +CONFIG_I2C_MUX=y + +# +# Multiplexer I2C Chip support +# +# CONFIG_I2C_MUX_PCA9541 is not set +# CONFIG_I2C_MUX_REG is not set +# CONFIG_I2C_MUX_MLXCPLD is not set +CONFIG_I2C_HELPER_AUTO=y +CONFIG_I2C_ALGOBIT=y + +# +# I2C Hardware Bus support +# + +# +# PC SMBus host controller drivers +# +# CONFIG_I2C_ALI1535 is not set +# CONFIG_I2C_ALI1563 is not set +# CONFIG_I2C_ALI15X3 is not set +# CONFIG_I2C_AMD756 is not set +# CONFIG_I2C_AMD8111 is not set +# CONFIG_I2C_I801 is not set +# CONFIG_I2C_ISCH is not set +# CONFIG_I2C_ISMT is not set +# CONFIG_I2C_PIIX4 is not set +# CONFIG_I2C_NFORCE2 is not set +# CONFIG_I2C_SIS5595 is not set +# CONFIG_I2C_SIS630 is not set +# CONFIG_I2C_SIS96X is not set +# CONFIG_I2C_VIA is not set +# CONFIG_I2C_VIAPRO is not set + +# +# ACPI drivers +# +# CONFIG_I2C_SCMI is not set + +# +# I2C system bus drivers (mostly embedded / system-on-chip) +# +# CONFIG_I2C_DESIGNWARE_PLATFORM is not set +# CONFIG_I2C_DESIGNWARE_PCI is not set +# CONFIG_I2C_EMEV2 is not set +# CONFIG_I2C_OCORES is not set +# CONFIG_I2C_PCA_PLATFORM is not set +# CONFIG_I2C_PXA_PCI is not set +# CONFIG_I2C_SIMTEC is not set +# CONFIG_I2C_XILINX is not set + +# +# External I2C/SMBus adapter drivers +# +# CONFIG_I2C_PARPORT_LIGHT is not set +# CONFIG_I2C_TAOS_EVM is not set + +# +# Other I2C/SMBus bus drivers +# +# CONFIG_I2C_MLXCPLD is not set +# CONFIG_I2C_STUB is not set +# CONFIG_I2C_SLAVE is not set +# CONFIG_I2C_DEBUG_CORE is not set +# CONFIG_I2C_DEBUG_ALGO is not set +# CONFIG_I2C_DEBUG_BUS is not set +# CONFIG_SPI is not set +# CONFIG_SPMI is not set +# CONFIG_HSI is not set + +# +# PPS support +# +CONFIG_PPS=y +# CONFIG_PPS_DEBUG is not set + +# +# PPS clients support +# +# CONFIG_PPS_CLIENT_KTIMER is not set +# CONFIG_PPS_CLIENT_LDISC is not set +# CONFIG_PPS_CLIENT_GPIO is not set + +# +# PPS generators support +# + +# +# PTP clock support +# +CONFIG_PTP_1588_CLOCK=y + +# +# Enable PHYLIB and NETWORK_PHY_TIMESTAMPING to see the additional clocks. +# +CONFIG_PTP_1588_CLOCK_KVM=y +# CONFIG_GPIOLIB is not set +# CONFIG_W1 is not set +# CONFIG_POWER_AVS is not set +# CONFIG_POWER_RESET is not set +CONFIG_POWER_SUPPLY=y +# CONFIG_POWER_SUPPLY_DEBUG is not set +# CONFIG_PDA_POWER is not set +# CONFIG_TEST_POWER is not set +# CONFIG_BATTERY_DS2780 is not set +# CONFIG_BATTERY_DS2781 is not set +# CONFIG_BATTERY_DS2782 is not set +# CONFIG_BATTERY_SBS is not set +# CONFIG_CHARGER_SBS is not set +# CONFIG_BATTERY_BQ27XXX is not set +# CONFIG_BATTERY_MAX17040 is not set +# CONFIG_BATTERY_MAX17042 is not set +# CONFIG_CHARGER_MAX8903 is not set +# CONFIG_CHARGER_LP8727 is not set +# CONFIG_CHARGER_BQ2415X is not set +# CONFIG_CHARGER_SMB347 is not set +# CONFIG_BATTERY_GAUGE_LTC2941 is not set +CONFIG_HWMON=y +# CONFIG_HWMON_VID is not set +# CONFIG_HWMON_DEBUG_CHIP is not set + +# +# Native drivers +# +# CONFIG_SENSORS_ABITUGURU is not set +# CONFIG_SENSORS_ABITUGURU3 is not set +# CONFIG_SENSORS_AD7414 is not set +# CONFIG_SENSORS_AD7418 is not set +# CONFIG_SENSORS_ADM1021 is not set +# CONFIG_SENSORS_ADM1025 is not set +# CONFIG_SENSORS_ADM1026 is not set +# CONFIG_SENSORS_ADM1029 is not set +# CONFIG_SENSORS_ADM1031 is not set +# CONFIG_SENSORS_ADM9240 is not set +# CONFIG_SENSORS_ADT7410 is not set +# CONFIG_SENSORS_ADT7411 is not set +# CONFIG_SENSORS_ADT7462 is not set +# CONFIG_SENSORS_ADT7470 is not set +# CONFIG_SENSORS_ADT7475 is not set +# CONFIG_SENSORS_ASC7621 is not set +# CONFIG_SENSORS_K8TEMP is not set +# CONFIG_SENSORS_K10TEMP is not set +# CONFIG_SENSORS_FAM15H_POWER is not set +# CONFIG_SENSORS_APPLESMC is not set +# CONFIG_SENSORS_ASB100 is not set +# CONFIG_SENSORS_ATXP1 is not set +# CONFIG_SENSORS_DS620 is not set +# CONFIG_SENSORS_DS1621 is not set +# CONFIG_SENSORS_DELL_SMM is not set +# CONFIG_SENSORS_I5K_AMB is not set +# CONFIG_SENSORS_F71805F is not set +# CONFIG_SENSORS_F71882FG is not set +# CONFIG_SENSORS_F75375S is not set +# CONFIG_SENSORS_FSCHMD is not set +# CONFIG_SENSORS_GL518SM is not set +# CONFIG_SENSORS_GL520SM is not set +# CONFIG_SENSORS_G760A is not set +# CONFIG_SENSORS_G762 is not set +# CONFIG_SENSORS_HIH6130 is not set +# CONFIG_SENSORS_I5500 is not set +# CONFIG_SENSORS_CORETEMP is not set +# CONFIG_SENSORS_IT87 is not set +# CONFIG_SENSORS_JC42 is not set +# CONFIG_SENSORS_POWR1220 is not set +# CONFIG_SENSORS_LINEAGE is not set +# CONFIG_SENSORS_LTC2945 is not set +# CONFIG_SENSORS_LTC2990 is not set +# CONFIG_SENSORS_LTC4151 is not set +# CONFIG_SENSORS_LTC4215 is not set +# CONFIG_SENSORS_LTC4222 is not set +# CONFIG_SENSORS_LTC4245 is not set +# CONFIG_SENSORS_LTC4260 is not set +# CONFIG_SENSORS_LTC4261 is not set +# CONFIG_SENSORS_MAX16065 is not set +# CONFIG_SENSORS_MAX1619 is not set +# CONFIG_SENSORS_MAX1668 is not set +# CONFIG_SENSORS_MAX197 is not set +# CONFIG_SENSORS_MAX6639 is not set +# CONFIG_SENSORS_MAX6642 is not set +# CONFIG_SENSORS_MAX6650 is not set +# CONFIG_SENSORS_MAX6697 is not set +# CONFIG_SENSORS_MAX31790 is not set +# CONFIG_SENSORS_MCP3021 is not set +# CONFIG_SENSORS_TC654 is not set +# CONFIG_SENSORS_LM63 is not set +# CONFIG_SENSORS_LM73 is not set +# CONFIG_SENSORS_LM75 is not set +# CONFIG_SENSORS_LM77 is not set +# CONFIG_SENSORS_LM78 is not set +# CONFIG_SENSORS_LM80 is not set +# CONFIG_SENSORS_LM83 is not set +# CONFIG_SENSORS_LM85 is not set +# CONFIG_SENSORS_LM87 is not set +# CONFIG_SENSORS_LM90 is not set +# CONFIG_SENSORS_LM92 is not set +# CONFIG_SENSORS_LM93 is not set +# CONFIG_SENSORS_LM95234 is not set +# CONFIG_SENSORS_LM95241 is not set +# CONFIG_SENSORS_LM95245 is not set +# CONFIG_SENSORS_PC87360 is not set +# CONFIG_SENSORS_PC87427 is not set +# CONFIG_SENSORS_NTC_THERMISTOR is not set +# CONFIG_SENSORS_NCT6683 is not set +# CONFIG_SENSORS_NCT6775 is not set +# CONFIG_SENSORS_NCT7802 is not set +# CONFIG_SENSORS_NCT7904 is not set +# CONFIG_SENSORS_PCF8591 is not set +# CONFIG_PMBUS is not set +# CONFIG_SENSORS_SHT21 is not set +# CONFIG_SENSORS_SHT3x is not set +# CONFIG_SENSORS_SHTC1 is not set +# CONFIG_SENSORS_SIS5595 is not set +# CONFIG_SENSORS_DME1737 is not set +# CONFIG_SENSORS_EMC1403 is not set +# CONFIG_SENSORS_EMC2103 is not set +# CONFIG_SENSORS_EMC6W201 is not set +# CONFIG_SENSORS_SMSC47M1 is not set +# CONFIG_SENSORS_SMSC47M192 is not set +# CONFIG_SENSORS_SMSC47B397 is not set +# CONFIG_SENSORS_SCH56XX_COMMON is not set +# CONFIG_SENSORS_STTS751 is not set +# CONFIG_SENSORS_SMM665 is not set +# CONFIG_SENSORS_ADC128D818 is not set +# CONFIG_SENSORS_ADS1015 is not set +# CONFIG_SENSORS_ADS7828 is not set +# CONFIG_SENSORS_AMC6821 is not set +# CONFIG_SENSORS_INA209 is not set +# CONFIG_SENSORS_INA2XX is not set +# CONFIG_SENSORS_INA3221 is not set +# CONFIG_SENSORS_TC74 is not set +# CONFIG_SENSORS_THMC50 is not set +# CONFIG_SENSORS_TMP102 is not set +# CONFIG_SENSORS_TMP103 is not set +# CONFIG_SENSORS_TMP108 is not set +# CONFIG_SENSORS_TMP401 is not set +# CONFIG_SENSORS_TMP421 is not set +# CONFIG_SENSORS_VIA_CPUTEMP is not set +# CONFIG_SENSORS_VIA686A is not set +# CONFIG_SENSORS_VT1211 is not set +# CONFIG_SENSORS_VT8231 is not set +# CONFIG_SENSORS_W83781D is not set +# CONFIG_SENSORS_W83791D is not set +# CONFIG_SENSORS_W83792D is not set +# CONFIG_SENSORS_W83793 is not set +# CONFIG_SENSORS_W83795 is not set +# CONFIG_SENSORS_W83L785TS is not set +# CONFIG_SENSORS_W83L786NG is not set +# CONFIG_SENSORS_W83627HF is not set +# CONFIG_SENSORS_W83627EHF is not set +# CONFIG_SENSORS_XGENE is not set + +# +# ACPI drivers +# +# CONFIG_SENSORS_ACPI_POWER is not set +# CONFIG_SENSORS_ATK0110 is not set +CONFIG_THERMAL=y +# CONFIG_THERMAL_HWMON is not set +# CONFIG_THERMAL_WRITABLE_TRIPS is not set +CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y +# CONFIG_THERMAL_DEFAULT_GOV_FAIR_SHARE is not set +# CONFIG_THERMAL_DEFAULT_GOV_USER_SPACE is not set +# CONFIG_THERMAL_DEFAULT_GOV_POWER_ALLOCATOR is not set +# CONFIG_THERMAL_GOV_FAIR_SHARE is not set +CONFIG_THERMAL_GOV_STEP_WISE=y +# CONFIG_THERMAL_GOV_BANG_BANG is not set +# CONFIG_THERMAL_GOV_USER_SPACE is not set +# CONFIG_THERMAL_GOV_POWER_ALLOCATOR is not set +# CONFIG_THERMAL_EMULATION is not set +# CONFIG_INTEL_POWERCLAMP is not set +# CONFIG_INTEL_SOC_DTS_THERMAL is not set + +# +# ACPI INT340X thermal drivers +# +# CONFIG_INT340X_THERMAL is not set +# CONFIG_INTEL_PCH_THERMAL is not set +# CONFIG_WATCHDOG is not set +CONFIG_SSB_POSSIBLE=y + +# +# Sonics Silicon Backplane +# +# CONFIG_SSB is not set +CONFIG_BCMA_POSSIBLE=y + +# +# Broadcom specific AMBA +# +# CONFIG_BCMA is not set + +# +# Multifunction device drivers +# +CONFIG_MFD_CORE=y +# CONFIG_MFD_AS3711 is not set +# CONFIG_PMIC_ADP5520 is not set +# CONFIG_MFD_BCM590XX is not set +# CONFIG_MFD_AXP20X_I2C is not set +# CONFIG_MFD_CROS_EC is not set +# CONFIG_PMIC_DA903X is not set +# CONFIG_MFD_DA9052_I2C is not set +# CONFIG_MFD_DA9055 is not set +# CONFIG_MFD_DA9062 is not set +# CONFIG_MFD_DA9063 is not set +# CONFIG_MFD_DA9150 is not set +# CONFIG_MFD_MC13XXX_I2C is not set +# CONFIG_HTC_PASIC3 is not set +# CONFIG_MFD_INTEL_QUARK_I2C_GPIO is not set +CONFIG_LPC_ICH=y +CONFIG_LPC_SCH=y +# CONFIG_MFD_INTEL_LPSS_ACPI is not set +# CONFIG_MFD_INTEL_LPSS_PCI is not set +# CONFIG_MFD_JANZ_CMODIO is not set +# CONFIG_MFD_KEMPLD is not set +# CONFIG_MFD_88PM800 is not set +# CONFIG_MFD_88PM805 is not set +# CONFIG_MFD_88PM860X is not set +# CONFIG_MFD_MAX14577 is not set +# CONFIG_MFD_MAX77693 is not set +# CONFIG_MFD_MAX77843 is not set +# CONFIG_MFD_MAX8907 is not set +# CONFIG_MFD_MAX8925 is not set +# CONFIG_MFD_MAX8997 is not set +# CONFIG_MFD_MAX8998 is not set +# CONFIG_MFD_MT6397 is not set +# CONFIG_MFD_MENF21BMC is not set +# CONFIG_MFD_RETU is not set +# CONFIG_MFD_PCF50633 is not set +# CONFIG_MFD_RDC321X is not set +# CONFIG_MFD_RTSX_PCI is not set +# CONFIG_MFD_RT5033 is not set +# CONFIG_MFD_RC5T583 is not set +# CONFIG_MFD_SEC_CORE is not set +# CONFIG_MFD_SI476X_CORE is not set +CONFIG_MFD_SM501=y +# CONFIG_MFD_SKY81452 is not set +# CONFIG_MFD_SMSC is not set +# CONFIG_ABX500_CORE is not set +# CONFIG_MFD_SYSCON is not set +# CONFIG_MFD_TI_AM335X_TSCADC is not set +# CONFIG_MFD_LP3943 is not set +# CONFIG_MFD_LP8788 is not set +# CONFIG_MFD_PALMAS is not set +# CONFIG_TPS6105X is not set +# CONFIG_TPS6507X is not set +# CONFIG_MFD_TPS65086 is not set +# CONFIG_MFD_TPS65090 is not set +# CONFIG_MFD_TPS65217 is not set +# CONFIG_MFD_TI_LP873X is not set +# CONFIG_MFD_TPS65218 is not set +# CONFIG_MFD_TPS6586X is not set +# CONFIG_MFD_TPS65912_I2C is not set +# CONFIG_MFD_TPS80031 is not set +# CONFIG_TWL4030_CORE is not set +# CONFIG_TWL6040_CORE is not set +CONFIG_MFD_WL1273_CORE=y +# CONFIG_MFD_LM3533 is not set +# CONFIG_MFD_TMIO is not set +CONFIG_MFD_VX855=y +# CONFIG_MFD_ARIZONA_I2C is not set +# CONFIG_MFD_WM8400 is not set +# CONFIG_MFD_WM831X_I2C is not set +# CONFIG_MFD_WM8350_I2C is not set +# CONFIG_MFD_WM8994 is not set +# CONFIG_REGULATOR is not set +# CONFIG_MEDIA_SUPPORT is not set + +# +# Graphics support +# +# CONFIG_AGP is not set +# CONFIG_VGA_ARB is not set +# CONFIG_VGA_SWITCHEROO is not set +# CONFIG_DRM is not set + +# +# ACP (Audio CoProcessor) Configuration +# +# CONFIG_DRM_LIB_RANDOM is not set + +# +# Frame buffer Devices +# +CONFIG_FB=y +# CONFIG_FIRMWARE_EDID is not set +CONFIG_FB_CMDLINE=y +CONFIG_FB_NOTIFY=y +# CONFIG_FB_DDC is not set +CONFIG_FB_BOOT_VESA_SUPPORT=y +CONFIG_FB_CFB_FILLRECT=y +CONFIG_FB_CFB_COPYAREA=y +CONFIG_FB_CFB_IMAGEBLIT=y +# CONFIG_FB_CFB_REV_PIXELS_IN_BYTE is not set +CONFIG_FB_SYS_FILLRECT=y +CONFIG_FB_SYS_COPYAREA=y +CONFIG_FB_SYS_IMAGEBLIT=y +# CONFIG_FB_PROVIDE_GET_FB_UNMAPPED_AREA is not set +# CONFIG_FB_FOREIGN_ENDIAN is not set +CONFIG_FB_SYS_FOPS=y +CONFIG_FB_DEFERRED_IO=y +# CONFIG_FB_SVGALIB is not set +# CONFIG_FB_MACMODES is not set +# CONFIG_FB_BACKLIGHT is not set +# CONFIG_FB_MODE_HELPERS is not set +# CONFIG_FB_TILEBLITTING is not set + +# +# Frame buffer hardware drivers +# +# CONFIG_FB_CIRRUS is not set +# CONFIG_FB_PM2 is not set +# CONFIG_FB_CYBER2000 is not set +# CONFIG_FB_ARC is not set +# CONFIG_FB_ASILIANT is not set +# CONFIG_FB_IMSTT is not set +# CONFIG_FB_VGA16 is not set +# CONFIG_FB_UVESA is not set +CONFIG_FB_VESA=y +# CONFIG_FB_EFI is not set +# CONFIG_FB_N411 is not set +# CONFIG_FB_HGA is not set +# CONFIG_FB_OPENCORES is not set +# CONFIG_FB_S1D13XXX is not set +# CONFIG_FB_NVIDIA is not set +# CONFIG_FB_RIVA is not set +# CONFIG_FB_I740 is not set +# CONFIG_FB_LE80578 is not set +# CONFIG_FB_MATROX is not set +# CONFIG_FB_RADEON is not set +# CONFIG_FB_ATY128 is not set +# CONFIG_FB_ATY is not set +# CONFIG_FB_S3 is not set +# CONFIG_FB_SAVAGE is not set +# CONFIG_FB_SIS is not set +# CONFIG_FB_NEOMAGIC is not set +# CONFIG_FB_KYRO is not set +# CONFIG_FB_3DFX is not set +# CONFIG_FB_VOODOO1 is not set +# CONFIG_FB_VT8623 is not set +# CONFIG_FB_TRIDENT is not set +# CONFIG_FB_ARK is not set +# CONFIG_FB_PM3 is not set +# CONFIG_FB_CARMINE is not set +# CONFIG_FB_SM501 is not set +# CONFIG_FB_IBM_GXT4500 is not set +# CONFIG_FB_VIRTUAL is not set +CONFIG_XEN_FBDEV_FRONTEND=y +# CONFIG_FB_METRONOME is not set +# CONFIG_FB_MB862XX is not set +# CONFIG_FB_BROADSHEET is not set +# CONFIG_FB_AUO_K190X is not set +CONFIG_FB_HYPERV=y +# CONFIG_FB_SIMPLE is not set +# CONFIG_FB_SM712 is not set +# CONFIG_BACKLIGHT_LCD_SUPPORT is not set +# CONFIG_VGASTATE is not set + +# +# Console display driver support +# +CONFIG_VGA_CONSOLE=y +# CONFIG_VGACON_SOFT_SCROLLBACK is not set +CONFIG_DUMMY_CONSOLE=y +CONFIG_DUMMY_CONSOLE_COLUMNS=80 +CONFIG_DUMMY_CONSOLE_ROWS=25 +CONFIG_FRAMEBUFFER_CONSOLE=y +CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y +# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set +# CONFIG_LOGO is not set +# CONFIG_SOUND is not set + +# +# HID support +# +CONFIG_HID=y +# CONFIG_HID_BATTERY_STRENGTH is not set +# CONFIG_HIDRAW is not set +# CONFIG_UHID is not set +CONFIG_HID_GENERIC=y + +# +# Special HID drivers +# +# CONFIG_HID_A4TECH is not set +# CONFIG_HID_ACRUX is not set +# CONFIG_HID_APPLE is not set +# CONFIG_HID_AUREAL is not set +# CONFIG_HID_BELKIN is not set +# CONFIG_HID_CHERRY is not set +# CONFIG_HID_CHICONY is not set +# CONFIG_HID_CMEDIA is not set +# CONFIG_HID_CYPRESS is not set +# CONFIG_HID_DRAGONRISE is not set +# CONFIG_HID_EMS_FF is not set +# CONFIG_HID_ELECOM is not set +# CONFIG_HID_EZKEY is not set +# CONFIG_HID_GEMBIRD is not set +# CONFIG_HID_GFRM is not set +# CONFIG_HID_KEYTOUCH is not set +# CONFIG_HID_KYE is not set +# CONFIG_HID_WALTOP is not set +# CONFIG_HID_GYRATION is not set +# CONFIG_HID_ICADE is not set +# CONFIG_HID_TWINHAN is not set +# CONFIG_HID_KENSINGTON is not set +# CONFIG_HID_LCPOWER is not set +# CONFIG_HID_LENOVO is not set +# CONFIG_HID_LOGITECH is not set +# CONFIG_HID_MAGICMOUSE is not set +# CONFIG_HID_MAYFLASH is not set +# CONFIG_HID_MICROSOFT is not set +# CONFIG_HID_MONTEREY is not set +# CONFIG_HID_MULTITOUCH is not set +# CONFIG_HID_ORTEK is not set +# CONFIG_HID_PANTHERLORD is not set +# CONFIG_HID_PETALYNX is not set +# CONFIG_HID_PICOLCD is not set +# CONFIG_HID_PLANTRONICS is not set +# CONFIG_HID_PRIMAX is not set +# CONFIG_HID_SAITEK is not set +# CONFIG_HID_SAMSUNG is not set +# CONFIG_HID_SPEEDLINK is not set +# CONFIG_HID_STEELSERIES is not set +# CONFIG_HID_SUNPLUS is not set +# CONFIG_HID_RMI is not set +# CONFIG_HID_GREENASIA is not set +# CONFIG_HID_HYPERV_MOUSE is not set +# CONFIG_HID_SMARTJOYPLUS is not set +# CONFIG_HID_TIVO is not set +# CONFIG_HID_TOPSEED is not set +# CONFIG_HID_THRUSTMASTER is not set +# CONFIG_HID_UDRAW_PS3 is not set +# CONFIG_HID_WACOM is not set +# CONFIG_HID_XINMO is not set +# CONFIG_HID_ZEROPLUS is not set +# CONFIG_HID_ZYDACRON is not set +# CONFIG_HID_SENSOR_HUB is not set +# CONFIG_HID_ALPS is not set + +# +# I2C HID support +# +# CONFIG_I2C_HID is not set + +# +# Intel ISH HID support +# +# CONFIG_INTEL_ISH_HID is not set +CONFIG_USB_OHCI_LITTLE_ENDIAN=y +# CONFIG_USB_SUPPORT is not set +# CONFIG_UWB is not set +# CONFIG_MMC is not set +# CONFIG_MEMSTICK is not set +# CONFIG_NEW_LEDS is not set +# CONFIG_ACCESSIBILITY is not set +# CONFIG_INFINIBAND is not set +CONFIG_EDAC_ATOMIC_SCRUB=y +CONFIG_EDAC_SUPPORT=y +# CONFIG_EDAC is not set +CONFIG_RTC_LIB=y +CONFIG_RTC_MC146818_LIB=y +CONFIG_RTC_CLASS=y +CONFIG_RTC_HCTOSYS=y +CONFIG_RTC_HCTOSYS_DEVICE="rtc0" +CONFIG_RTC_SYSTOHC=y +CONFIG_RTC_SYSTOHC_DEVICE="rtc0" +# CONFIG_RTC_DEBUG is not set + +# +# RTC interfaces +# +CONFIG_RTC_INTF_SYSFS=y +CONFIG_RTC_INTF_PROC=y +CONFIG_RTC_INTF_DEV=y +# CONFIG_RTC_INTF_DEV_UIE_EMUL is not set +# CONFIG_RTC_DRV_TEST is not set + +# +# I2C RTC drivers +# +# CONFIG_RTC_DRV_ABB5ZES3 is not set +# CONFIG_RTC_DRV_ABX80X is not set +# CONFIG_RTC_DRV_DS1307 is not set +# CONFIG_RTC_DRV_DS1374 is not set +# CONFIG_RTC_DRV_DS1672 is not set +# CONFIG_RTC_DRV_MAX6900 is not set +# CONFIG_RTC_DRV_RS5C372 is not set +# CONFIG_RTC_DRV_ISL1208 is not set +# CONFIG_RTC_DRV_ISL12022 is not set +# CONFIG_RTC_DRV_X1205 is not set +# CONFIG_RTC_DRV_PCF8523 is not set +# CONFIG_RTC_DRV_PCF85063 is not set +# CONFIG_RTC_DRV_PCF8563 is not set +# CONFIG_RTC_DRV_PCF8583 is not set +# CONFIG_RTC_DRV_M41T80 is not set +# CONFIG_RTC_DRV_BQ32K is not set +# CONFIG_RTC_DRV_S35390A is not set +# CONFIG_RTC_DRV_FM3130 is not set +# CONFIG_RTC_DRV_RX8010 is not set +# CONFIG_RTC_DRV_RX8581 is not set +# CONFIG_RTC_DRV_RX8025 is not set +# CONFIG_RTC_DRV_EM3027 is not set +# CONFIG_RTC_DRV_RV8803 is not set + +# +# SPI RTC drivers +# +CONFIG_RTC_I2C_AND_SPI=y + +# +# SPI and I2C RTC drivers +# +# CONFIG_RTC_DRV_DS3232 is not set +# CONFIG_RTC_DRV_PCF2127 is not set +# CONFIG_RTC_DRV_RV3029C2 is not set + +# +# Platform RTC drivers +# +CONFIG_RTC_DRV_CMOS=y +# CONFIG_RTC_DRV_DS1286 is not set +# CONFIG_RTC_DRV_DS1511 is not set +# CONFIG_RTC_DRV_DS1553 is not set +# CONFIG_RTC_DRV_DS1685_FAMILY is not set +# CONFIG_RTC_DRV_DS1742 is not set +# CONFIG_RTC_DRV_DS2404 is not set +# CONFIG_RTC_DRV_STK17TA8 is not set +# CONFIG_RTC_DRV_M48T86 is not set +# CONFIG_RTC_DRV_M48T35 is not set +# CONFIG_RTC_DRV_M48T59 is not set +# CONFIG_RTC_DRV_MSM6242 is not set +# CONFIG_RTC_DRV_BQ4802 is not set +# CONFIG_RTC_DRV_RP5C01 is not set +# CONFIG_RTC_DRV_V3020 is not set + +# +# on-CPU RTC drivers +# + +# +# HID Sensor RTC drivers +# +# CONFIG_DMADEVICES is not set + +# +# DMABUF options +# +# CONFIG_SYNC_FILE is not set +# CONFIG_AUXDISPLAY is not set +# CONFIG_UIO is not set +# CONFIG_VIRT_DRIVERS is not set +CONFIG_VIRTIO=y + +# +# Virtio drivers +# +CONFIG_VIRTIO_PCI=y +CONFIG_VIRTIO_PCI_LEGACY=y +CONFIG_VIRTIO_BALLOON=y +CONFIG_VIRTIO_INPUT=y +CONFIG_VIRTIO_MMIO=y +CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y + +# +# Microsoft Hyper-V guest support +# +CONFIG_HYPERV=y +CONFIG_HYPERV_UTILS=y +CONFIG_HYPERV_BALLOON=y + +# +# Xen driver support +# +CONFIG_XEN_BALLOON=y +CONFIG_XEN_BALLOON_MEMORY_HOTPLUG=y +CONFIG_XEN_BALLOON_MEMORY_HOTPLUG_LIMIT=512 +CONFIG_XEN_SCRUB_PAGES=y +CONFIG_XEN_DEV_EVTCHN=y +# CONFIG_XEN_BACKEND is not set +CONFIG_XENFS=y +CONFIG_XEN_COMPAT_XENFS=y +CONFIG_XEN_SYS_HYPERVISOR=y +CONFIG_XEN_XENBUS_FRONTEND=y +CONFIG_XEN_GNTDEV=y +CONFIG_XEN_GRANT_DEV_ALLOC=y +CONFIG_SWIOTLB_XEN=y +CONFIG_XEN_PRIVCMD=y +CONFIG_XEN_ACPI_PROCESSOR=y +CONFIG_XEN_HAVE_PVMMU=y +CONFIG_XEN_EFI=y +CONFIG_XEN_AUTO_XLATE=y +CONFIG_XEN_ACPI=y +# CONFIG_XEN_SYMS is not set +CONFIG_XEN_HAVE_VPMU=y +# CONFIG_STAGING is not set +CONFIG_X86_PLATFORM_DEVICES=y +# CONFIG_ACERHDF is not set +# CONFIG_DELL_WMI is not set +# CONFIG_DELL_WMI_AIO is not set +# CONFIG_DELL_SMO8800 is not set +# CONFIG_FUJITSU_TABLET is not set +# CONFIG_HP_ACCEL is not set +# CONFIG_HP_WIRELESS is not set +# CONFIG_HP_WMI is not set +# CONFIG_SENSORS_HDAPS is not set +# CONFIG_INTEL_MENLOW is not set +# CONFIG_ASUS_WIRELESS is not set +CONFIG_ACPI_WMI=y +# CONFIG_TOPSTAR_LAPTOP is not set +# CONFIG_TOSHIBA_BT_RFKILL is not set +# CONFIG_TOSHIBA_HAPS is not set +# CONFIG_TOSHIBA_WMI is not set +# CONFIG_ACPI_CMPC is not set +# CONFIG_INTEL_HID_EVENT is not set +# CONFIG_INTEL_VBTN is not set +CONFIG_INTEL_IPS=y +# CONFIG_INTEL_PMC_CORE is not set +# CONFIG_IBM_RTL is not set +CONFIG_MXM_WMI=y +# CONFIG_SAMSUNG_Q10 is not set +# CONFIG_INTEL_RST is not set +# CONFIG_INTEL_SMARTCONNECT is not set +# CONFIG_PVPANIC is not set +# CONFIG_INTEL_PMC_IPC is not set +# CONFIG_SURFACE_PRO3_BUTTON is not set +# CONFIG_INTEL_PUNIT_IPC is not set +# CONFIG_MLX_PLATFORM is not set +# CONFIG_MLX_CPLD_PLATFORM is not set +# CONFIG_INTEL_TURBO_MAX_3 is not set +# CONFIG_SILEAD_DMI is not set +CONFIG_PMC_ATOM=y +# CONFIG_CHROME_PLATFORMS is not set +CONFIG_CLKDEV_LOOKUP=y +CONFIG_HAVE_CLK_PREPARE=y +CONFIG_COMMON_CLK=y + +# +# Common Clock Framework +# +# CONFIG_COMMON_CLK_SI5351 is not set +# CONFIG_COMMON_CLK_CDCE706 is not set +# CONFIG_COMMON_CLK_CS2000_CP is not set +# CONFIG_COMMON_CLK_NXP is not set +# CONFIG_COMMON_CLK_PXA is not set +# CONFIG_COMMON_CLK_PIC32 is not set + +# +# Hardware Spinlock drivers +# + +# +# Clock Source drivers +# +CONFIG_CLKEVT_I8253=y +CONFIG_I8253_LOCK=y +CONFIG_CLKBLD_I8253=y +# CONFIG_ATMEL_PIT is not set +# CONFIG_SH_TIMER_CMT is not set +# CONFIG_SH_TIMER_MTU2 is not set +# CONFIG_SH_TIMER_TMU is not set +# CONFIG_EM_TIMER_STI is not set +CONFIG_MAILBOX=y +CONFIG_PCC=y +# CONFIG_ALTERA_MBOX is not set +# CONFIG_IOMMU_SUPPORT is not set + +# +# Remoteproc drivers +# +# CONFIG_REMOTEPROC is not set + +# +# Rpmsg drivers +# + +# +# SOC (System On Chip) specific Drivers +# + +# +# Broadcom SoC drivers +# +# CONFIG_SUNXI_SRAM is not set +# CONFIG_SOC_TI is not set +# CONFIG_SOC_ZTE is not set +CONFIG_PM_DEVFREQ=y + +# +# DEVFREQ Governors +# +CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=y +# CONFIG_DEVFREQ_GOV_PERFORMANCE is not set +# CONFIG_DEVFREQ_GOV_POWERSAVE is not set +# CONFIG_DEVFREQ_GOV_USERSPACE is not set +# CONFIG_DEVFREQ_GOV_PASSIVE is not set + +# +# DEVFREQ Drivers +# +# CONFIG_PM_DEVFREQ_EVENT is not set +# CONFIG_EXTCON is not set +# CONFIG_MEMORY is not set +# CONFIG_IIO is not set +# CONFIG_NTB is not set +# CONFIG_VME_BUS is not set +# CONFIG_PWM is not set +CONFIG_ARM_GIC_MAX_NR=1 +# CONFIG_IPACK_BUS is not set +CONFIG_RESET_CONTROLLER=y +# CONFIG_RESET_ATH79 is not set +# CONFIG_RESET_BERLIN is not set +# CONFIG_RESET_LPC18XX is not set +# CONFIG_RESET_MESON is not set +# CONFIG_RESET_PISTACHIO is not set +# CONFIG_RESET_SOCFPGA is not set +# CONFIG_RESET_STM32 is not set +# CONFIG_RESET_SUNXI is not set +# CONFIG_TI_SYSCON_RESET is not set +# CONFIG_RESET_ZYNQ is not set +# CONFIG_RESET_TEGRA_BPMP is not set +# CONFIG_FMC is not set + +# +# PHY Subsystem +# +CONFIG_GENERIC_PHY=y +# CONFIG_PHY_PXA_28NM_HSIC is not set +# CONFIG_PHY_PXA_28NM_USB2 is not set +# CONFIG_BCM_KONA_USB2_PHY is not set +# CONFIG_POWERCAP is not set +# CONFIG_MCB is not set + +# +# Performance monitor support +# +# CONFIG_RAS is not set +# CONFIG_THUNDERBOLT is not set + +# +# Android +# +# CONFIG_ANDROID is not set +# CONFIG_LIBNVDIMM is not set +# CONFIG_DEV_DAX is not set +# CONFIG_NVMEM is not set +# CONFIG_STM is not set +# CONFIG_INTEL_TH is not set + +# +# FPGA Configuration Support +# +# CONFIG_FPGA is not set + +# +# FSI support +# +# CONFIG_FSI is not set + +# +# Firmware Drivers +# +# CONFIG_EDD is not set +CONFIG_FIRMWARE_MEMMAP=y +# CONFIG_DELL_RBU is not set +# CONFIG_DCDBAS is not set +CONFIG_DMIID=y +CONFIG_DMI_SYSFS=y +CONFIG_DMI_SCAN_MACHINE_NON_EFI_FALLBACK=y +# CONFIG_ISCSI_IBFT_FIND is not set +# CONFIG_FW_CFG_SYSFS is not set +# CONFIG_GOOGLE_FIRMWARE is not set + +# +# EFI (Extensible Firmware Interface) Support +# +CONFIG_EFI_VARS=y +CONFIG_EFI_ESRT=y +CONFIG_EFI_VARS_PSTORE=y +# CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE is not set +# CONFIG_EFI_FAKE_MEMMAP is not set +CONFIG_EFI_RUNTIME_WRAPPERS=y +# CONFIG_EFI_BOOTLOADER_CONTROL is not set +# CONFIG_EFI_CAPSULE_LOADER is not set +# CONFIG_EFI_TEST is not set +# CONFIG_APPLE_PROPERTIES is not set +CONFIG_UEFI_CPER=y +# CONFIG_EFI_DEV_PATH_PARSER is not set + +# +# Tegra firmware driver +# + +# +# File systems +# +CONFIG_DCACHE_WORD_ACCESS=y +CONFIG_FS_IOMAP=y +# CONFIG_EXT2_FS is not set +# CONFIG_EXT3_FS is not set +CONFIG_EXT4_FS=y +CONFIG_EXT4_USE_FOR_EXT2=y +CONFIG_EXT4_FS_POSIX_ACL=y +CONFIG_EXT4_FS_SECURITY=y +# CONFIG_EXT4_ENCRYPTION is not set +# CONFIG_EXT4_DEBUG is not set +CONFIG_JBD2=y +# CONFIG_JBD2_DEBUG is not set +CONFIG_FS_MBCACHE=y +# CONFIG_REISERFS_FS is not set +# CONFIG_JFS_FS is not set +CONFIG_XFS_FS=y +CONFIG_XFS_QUOTA=y +CONFIG_XFS_POSIX_ACL=y +# CONFIG_XFS_RT is not set +# CONFIG_XFS_WARN is not set +# CONFIG_XFS_DEBUG is not set +# CONFIG_GFS2_FS is not set +CONFIG_BTRFS_FS=m +CONFIG_BTRFS_FS_POSIX_ACL=y +# CONFIG_BTRFS_FS_CHECK_INTEGRITY is not set +# CONFIG_BTRFS_FS_RUN_SANITY_TESTS is not set +# CONFIG_BTRFS_DEBUG is not set +# CONFIG_BTRFS_ASSERT is not set +# CONFIG_NILFS2_FS is not set +# CONFIG_F2FS_FS is not set +# CONFIG_FS_DAX is not set +CONFIG_FS_POSIX_ACL=y +CONFIG_EXPORTFS=y +# CONFIG_EXPORTFS_BLOCK_OPS is not set +CONFIG_FILE_LOCKING=y +CONFIG_MANDATORY_FILE_LOCKING=y +CONFIG_FS_ENCRYPTION=y +CONFIG_FSNOTIFY=y +CONFIG_DNOTIFY=y +CONFIG_INOTIFY_USER=y +CONFIG_FANOTIFY=y +# CONFIG_FANOTIFY_ACCESS_PERMISSIONS is not set +CONFIG_QUOTA=y +CONFIG_QUOTA_NETLINK_INTERFACE=y +CONFIG_PRINT_QUOTA_WARNING=y +# CONFIG_QUOTA_DEBUG is not set +# CONFIG_QFMT_V1 is not set +# CONFIG_QFMT_V2 is not set +CONFIG_QUOTACTL=y +CONFIG_QUOTACTL_COMPAT=y +# CONFIG_AUTOFS4_FS is not set +CONFIG_FUSE_FS=y +CONFIG_CUSE=y +CONFIG_OVERLAY_FS=y +# CONFIG_OVERLAY_FS_REDIRECT_DIR is not set + +# +# Caches +# +CONFIG_FSCACHE=y +CONFIG_FSCACHE_STATS=y +# CONFIG_FSCACHE_HISTOGRAM is not set +# CONFIG_FSCACHE_DEBUG is not set +# CONFIG_FSCACHE_OBJECT_LIST is not set +CONFIG_CACHEFILES=y +# CONFIG_CACHEFILES_DEBUG is not set +# CONFIG_CACHEFILES_HISTOGRAM is not set + +# +# CD-ROM/DVD Filesystems +# +CONFIG_ISO9660_FS=y +CONFIG_JOLIET=y +CONFIG_ZISOFS=y +CONFIG_UDF_FS=y +CONFIG_UDF_NLS=y + +# +# DOS/FAT/NT Filesystems +# +CONFIG_FAT_FS=y +CONFIG_MSDOS_FS=y +CONFIG_VFAT_FS=y +CONFIG_FAT_DEFAULT_CODEPAGE=437 +CONFIG_FAT_DEFAULT_IOCHARSET="utf8" +# CONFIG_FAT_DEFAULT_UTF8 is not set +CONFIG_NTFS_FS=y +# CONFIG_NTFS_DEBUG is not set +# CONFIG_NTFS_RW is not set + +# +# Pseudo filesystems +# +CONFIG_PROC_FS=y +CONFIG_PROC_KCORE=y +CONFIG_PROC_SYSCTL=y +CONFIG_PROC_PAGE_MONITOR=y +CONFIG_PROC_CHILDREN=y +CONFIG_KERNFS=y +CONFIG_SYSFS=y +CONFIG_TMPFS=y +# CONFIG_TMPFS_POSIX_ACL is not set +CONFIG_TMPFS_XATTR=y +CONFIG_HUGETLBFS=y +CONFIG_HUGETLB_PAGE=y +CONFIG_ARCH_HAS_GIGANTIC_PAGE=y +# CONFIG_CONFIGFS_FS is not set +# CONFIG_EFIVAR_FS is not set +CONFIG_MISC_FILESYSTEMS=y +# CONFIG_ORANGEFS_FS is not set +# CONFIG_ADFS_FS is not set +# CONFIG_AFFS_FS is not set +# CONFIG_ECRYPT_FS is not set +# CONFIG_HFS_FS is not set +# CONFIG_HFSPLUS_FS is not set +# CONFIG_BEFS_FS is not set +# CONFIG_BFS_FS is not set +# CONFIG_EFS_FS is not set +# CONFIG_CRAMFS is not set +# CONFIG_SQUASHFS is not set +# CONFIG_VXFS_FS is not set +# CONFIG_MINIX_FS is not set +# CONFIG_OMFS_FS is not set +# CONFIG_HPFS_FS is not set +# CONFIG_QNX4FS_FS is not set +# CONFIG_QNX6FS_FS is not set +# CONFIG_ROMFS_FS is not set +CONFIG_PSTORE=y +CONFIG_PSTORE_ZLIB_COMPRESS=y +# CONFIG_PSTORE_LZO_COMPRESS is not set +# CONFIG_PSTORE_LZ4_COMPRESS is not set +# CONFIG_PSTORE_CONSOLE is not set +# CONFIG_PSTORE_PMSG is not set +# CONFIG_PSTORE_FTRACE is not set +# CONFIG_PSTORE_RAM is not set +# CONFIG_SYSV_FS is not set +# CONFIG_UFS_FS is not set +CONFIG_NETWORK_FILESYSTEMS=y +CONFIG_NFS_FS=y +# CONFIG_NFS_V2 is not set +CONFIG_NFS_V3=y +# CONFIG_NFS_V3_ACL is not set +CONFIG_NFS_V4=y +# CONFIG_NFS_SWAP is not set +CONFIG_NFS_V4_1=y +CONFIG_NFS_V4_2=y +CONFIG_PNFS_FILE_LAYOUT=y +CONFIG_PNFS_BLOCK=y +CONFIG_PNFS_FLEXFILE_LAYOUT=m +CONFIG_NFS_V4_1_IMPLEMENTATION_ID_DOMAIN="kernel.org" +# CONFIG_NFS_V4_1_MIGRATION is not set +CONFIG_NFS_V4_SECURITY_LABEL=y +# CONFIG_ROOT_NFS is not set +CONFIG_NFS_FSCACHE=y +# CONFIG_NFS_USE_LEGACY_DNS is not set +CONFIG_NFS_USE_KERNEL_DNS=y +CONFIG_NFSD=y +CONFIG_NFSD_V3=y +# CONFIG_NFSD_V3_ACL is not set +CONFIG_NFSD_V4=y +# CONFIG_NFSD_BLOCKLAYOUT is not set +# CONFIG_NFSD_SCSILAYOUT is not set +# CONFIG_NFSD_FLEXFILELAYOUT is not set +# CONFIG_NFSD_V4_SECURITY_LABEL is not set +# CONFIG_NFSD_FAULT_INJECTION is not set +CONFIG_GRACE_PERIOD=y +CONFIG_LOCKD=y +CONFIG_LOCKD_V4=y +CONFIG_NFS_COMMON=y +CONFIG_SUNRPC=y +CONFIG_SUNRPC_GSS=y +CONFIG_SUNRPC_BACKCHANNEL=y +CONFIG_RPCSEC_GSS_KRB5=y +# CONFIG_SUNRPC_DEBUG is not set +# CONFIG_CEPH_FS is not set +CONFIG_CIFS=y +# CONFIG_CIFS_STATS is not set +# CONFIG_CIFS_WEAK_PW_HASH is not set +# CONFIG_CIFS_UPCALL is not set +CONFIG_CIFS_XATTR=y +CONFIG_CIFS_POSIX=y +# CONFIG_CIFS_ACL is not set +CONFIG_CIFS_DEBUG=y +# CONFIG_CIFS_DEBUG2 is not set +CONFIG_CIFS_DFS_UPCALL=y +CONFIG_CIFS_SMB2=y +# CONFIG_CIFS_SMB311 is not set +CONFIG_CIFS_FSCACHE=y +# CONFIG_NCP_FS is not set +# CONFIG_CODA_FS is not set +# CONFIG_AFS_FS is not set +CONFIG_9P_FS=y +CONFIG_9P_FSCACHE=y +CONFIG_9P_FS_POSIX_ACL=y +CONFIG_9P_FS_SECURITY=y +CONFIG_NLS=y +CONFIG_NLS_DEFAULT="iso8859-1" +CONFIG_NLS_CODEPAGE_437=y +# CONFIG_NLS_CODEPAGE_737 is not set +# CONFIG_NLS_CODEPAGE_775 is not set +# CONFIG_NLS_CODEPAGE_850 is not set +# CONFIG_NLS_CODEPAGE_852 is not set +# CONFIG_NLS_CODEPAGE_855 is not set +# CONFIG_NLS_CODEPAGE_857 is not set +# CONFIG_NLS_CODEPAGE_860 is not set +# CONFIG_NLS_CODEPAGE_861 is not set +# CONFIG_NLS_CODEPAGE_862 is not set +# CONFIG_NLS_CODEPAGE_863 is not set +# CONFIG_NLS_CODEPAGE_864 is not set +# CONFIG_NLS_CODEPAGE_865 is not set +# CONFIG_NLS_CODEPAGE_866 is not set +# CONFIG_NLS_CODEPAGE_869 is not set +# CONFIG_NLS_CODEPAGE_936 is not set +# CONFIG_NLS_CODEPAGE_950 is not set +# CONFIG_NLS_CODEPAGE_932 is not set +# CONFIG_NLS_CODEPAGE_949 is not set +# CONFIG_NLS_CODEPAGE_874 is not set +# CONFIG_NLS_ISO8859_8 is not set +# CONFIG_NLS_CODEPAGE_1250 is not set +# CONFIG_NLS_CODEPAGE_1251 is not set +CONFIG_NLS_ASCII=y +CONFIG_NLS_ISO8859_1=y +# CONFIG_NLS_ISO8859_2 is not set +# CONFIG_NLS_ISO8859_3 is not set +# CONFIG_NLS_ISO8859_4 is not set +# CONFIG_NLS_ISO8859_5 is not set +# CONFIG_NLS_ISO8859_6 is not set +# CONFIG_NLS_ISO8859_7 is not set +# CONFIG_NLS_ISO8859_9 is not set +# CONFIG_NLS_ISO8859_13 is not set +# CONFIG_NLS_ISO8859_14 is not set +# CONFIG_NLS_ISO8859_15 is not set +# CONFIG_NLS_KOI8_R is not set +# CONFIG_NLS_KOI8_U is not set +# CONFIG_NLS_MAC_ROMAN is not set +# CONFIG_NLS_MAC_CELTIC is not set +# CONFIG_NLS_MAC_CENTEURO is not set +# CONFIG_NLS_MAC_CROATIAN is not set +# CONFIG_NLS_MAC_CYRILLIC is not set +# CONFIG_NLS_MAC_GAELIC is not set +# CONFIG_NLS_MAC_GREEK is not set +# CONFIG_NLS_MAC_ICELAND is not set +# CONFIG_NLS_MAC_INUIT is not set +# CONFIG_NLS_MAC_ROMANIAN is not set +# CONFIG_NLS_MAC_TURKISH is not set +CONFIG_NLS_UTF8=y + +# +# Kernel hacking +# +CONFIG_TRACE_IRQFLAGS_SUPPORT=y + +# +# printk and dmesg options +# +CONFIG_PRINTK_TIME=y +CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7 +CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4 +# CONFIG_BOOT_PRINTK_DELAY is not set +# CONFIG_DYNAMIC_DEBUG is not set + +# +# Compile-time checks and compiler options +# +CONFIG_DEBUG_INFO=y +# CONFIG_DEBUG_INFO_REDUCED is not set +CONFIG_DEBUG_INFO_SPLIT=y +# CONFIG_DEBUG_INFO_DWARF4 is not set +# CONFIG_GDB_SCRIPTS is not set +# CONFIG_ENABLE_WARN_DEPRECATED is not set +# CONFIG_ENABLE_MUST_CHECK is not set +CONFIG_FRAME_WARN=1024 +# CONFIG_STRIP_ASM_SYMS is not set +# CONFIG_READABLE_ASM is not set +# CONFIG_UNUSED_SYMBOLS is not set +# CONFIG_PAGE_OWNER is not set +CONFIG_DEBUG_FS=y +# CONFIG_HEADERS_CHECK is not set +# CONFIG_DEBUG_SECTION_MISMATCH is not set +CONFIG_SECTION_MISMATCH_WARN_ONLY=y +CONFIG_ARCH_WANT_FRAME_POINTERS=y +# CONFIG_FRAME_POINTER is not set +# CONFIG_STACK_VALIDATION is not set +# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set +CONFIG_MAGIC_SYSRQ=y +CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1 +CONFIG_MAGIC_SYSRQ_SERIAL=y +CONFIG_DEBUG_KERNEL=y + +# +# Memory Debugging +# +CONFIG_PAGE_EXTENSION=y +# CONFIG_DEBUG_PAGEALLOC is not set +CONFIG_PAGE_POISONING=y +CONFIG_PAGE_POISONING_NO_SANITY=y +CONFIG_PAGE_POISONING_ZERO=y +# CONFIG_DEBUG_PAGE_REF is not set +# CONFIG_DEBUG_RODATA_TEST is not set +# CONFIG_DEBUG_OBJECTS is not set +# CONFIG_DEBUG_SLAB is not set +CONFIG_HAVE_DEBUG_KMEMLEAK=y +# CONFIG_DEBUG_KMEMLEAK is not set +# CONFIG_DEBUG_STACK_USAGE is not set +# CONFIG_DEBUG_VM is not set +CONFIG_ARCH_HAS_DEBUG_VIRTUAL=y +# CONFIG_DEBUG_VIRTUAL is not set +CONFIG_DEBUG_MEMORY_INIT=y +# CONFIG_DEBUG_PER_CPU_MAPS is not set +CONFIG_HAVE_DEBUG_STACKOVERFLOW=y +# CONFIG_DEBUG_STACKOVERFLOW is not set +CONFIG_HAVE_ARCH_KMEMCHECK=y +CONFIG_HAVE_ARCH_KASAN=y +# CONFIG_KASAN is not set +CONFIG_ARCH_HAS_KCOV=y +# CONFIG_KCOV is not set +# CONFIG_DEBUG_SHIRQ is not set + +# +# Debug Lockups and Hangs +# +CONFIG_LOCKUP_DETECTOR=y +CONFIG_HARDLOCKUP_DETECTOR=y +# CONFIG_BOOTPARAM_HARDLOCKUP_PANIC is not set +CONFIG_BOOTPARAM_HARDLOCKUP_PANIC_VALUE=0 +# CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC is not set +CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE=0 +CONFIG_DETECT_HUNG_TASK=y +CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120 +# CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set +CONFIG_BOOTPARAM_HUNG_TASK_PANIC_VALUE=0 +CONFIG_WQ_WATCHDOG=y +CONFIG_PANIC_ON_OOPS=y +CONFIG_PANIC_ON_OOPS_VALUE=1 +CONFIG_PANIC_TIMEOUT=0 +CONFIG_SCHED_DEBUG=y +CONFIG_SCHED_INFO=y +# CONFIG_SCHEDSTATS is not set +# CONFIG_SCHED_STACK_END_CHECK is not set +# CONFIG_DEBUG_TIMEKEEPING is not set + +# +# Lock Debugging (spinlocks, mutexes, etc...) +# +# CONFIG_DEBUG_RT_MUTEXES is not set +# CONFIG_DEBUG_SPINLOCK is not set +# CONFIG_DEBUG_MUTEXES is not set +# CONFIG_DEBUG_WW_MUTEX_SLOWPATH is not set +# CONFIG_DEBUG_LOCK_ALLOC is not set +# CONFIG_PROVE_LOCKING is not set +# CONFIG_LOCK_STAT is not set +# CONFIG_DEBUG_ATOMIC_SLEEP is not set +# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set +# CONFIG_LOCK_TORTURE_TEST is not set +# CONFIG_WW_MUTEX_SELFTEST is not set +CONFIG_STACKTRACE=y +# CONFIG_DEBUG_KOBJECT is not set +CONFIG_DEBUG_BUGVERBOSE=y +CONFIG_DEBUG_LIST=y +# CONFIG_DEBUG_PI_LIST is not set +# CONFIG_DEBUG_SG is not set +CONFIG_DEBUG_NOTIFIERS=y +CONFIG_DEBUG_CREDENTIALS=y + +# +# RCU Debugging +# +# CONFIG_PROVE_RCU is not set +# CONFIG_SPARSE_RCU_POINTER is not set +# CONFIG_TORTURE_TEST is not set +# CONFIG_RCU_PERF_TEST is not set +# CONFIG_RCU_TORTURE_TEST is not set +CONFIG_RCU_CPU_STALL_TIMEOUT=60 +# CONFIG_RCU_TRACE is not set +# CONFIG_RCU_EQS_DEBUG is not set +# CONFIG_DEBUG_WQ_FORCE_RR_CPU is not set +# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set +# CONFIG_CPU_HOTPLUG_STATE_CONTROL is not set +# CONFIG_NOTIFIER_ERROR_INJECTION is not set +# CONFIG_FAULT_INJECTION is not set +# CONFIG_LATENCYTOP is not set +CONFIG_USER_STACKTRACE_SUPPORT=y +CONFIG_NOP_TRACER=y +CONFIG_HAVE_FUNCTION_TRACER=y +CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y +CONFIG_HAVE_DYNAMIC_FTRACE=y +CONFIG_HAVE_DYNAMIC_FTRACE_WITH_REGS=y +CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y +CONFIG_HAVE_SYSCALL_TRACEPOINTS=y +CONFIG_HAVE_FENTRY=y +CONFIG_HAVE_C_RECORDMCOUNT=y +CONFIG_TRACE_CLOCK=y +CONFIG_RING_BUFFER=y +CONFIG_EVENT_TRACING=y +CONFIG_CONTEXT_SWITCH_TRACER=y +CONFIG_RING_BUFFER_ALLOW_SWAP=y +CONFIG_TRACING=y +CONFIG_GENERIC_TRACER=y +CONFIG_TRACING_SUPPORT=y +CONFIG_FTRACE=y +CONFIG_FUNCTION_TRACER=y +CONFIG_FUNCTION_GRAPH_TRACER=y +# CONFIG_IRQSOFF_TRACER is not set +# CONFIG_SCHED_TRACER is not set +# CONFIG_HWLAT_TRACER is not set +CONFIG_FTRACE_SYSCALLS=y +# CONFIG_TRACER_SNAPSHOT is not set +CONFIG_BRANCH_PROFILE_NONE=y +# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set +# CONFIG_PROFILE_ALL_BRANCHES is not set +CONFIG_STACK_TRACER=y +CONFIG_BLK_DEV_IO_TRACE=y +CONFIG_KPROBE_EVENTS=y +# CONFIG_UPROBE_EVENTS is not set +CONFIG_BPF_EVENTS=y +CONFIG_PROBE_EVENTS=y +CONFIG_DYNAMIC_FTRACE=y +CONFIG_DYNAMIC_FTRACE_WITH_REGS=y +CONFIG_FUNCTION_PROFILER=y +CONFIG_FTRACE_MCOUNT_RECORD=y +# CONFIG_FTRACE_STARTUP_TEST is not set +CONFIG_MMIOTRACE=y +# CONFIG_HIST_TRIGGERS is not set +# CONFIG_MMIOTRACE_TEST is not set +# CONFIG_TRACEPOINT_BENCHMARK is not set +# CONFIG_RING_BUFFER_BENCHMARK is not set +# CONFIG_RING_BUFFER_STARTUP_TEST is not set +# CONFIG_TRACE_ENUM_MAP_FILE is not set + +# +# Runtime Testing +# +# CONFIG_LKDTM is not set +# CONFIG_TEST_LIST_SORT is not set +# CONFIG_TEST_SORT is not set +# CONFIG_KPROBES_SANITY_TEST is not set +# CONFIG_BACKTRACE_SELF_TEST is not set +# CONFIG_RBTREE_TEST is not set +# CONFIG_INTERVAL_TREE_TEST is not set +# CONFIG_PERCPU_TEST is not set +# CONFIG_ATOMIC64_SELFTEST is not set +# CONFIG_TEST_HEXDUMP is not set +# CONFIG_TEST_STRING_HELPERS is not set +# CONFIG_TEST_KSTRTOX is not set +# CONFIG_TEST_PRINTF is not set +# CONFIG_TEST_BITMAP is not set +# CONFIG_TEST_UUID is not set +# CONFIG_TEST_RHASHTABLE is not set +# CONFIG_TEST_HASH is not set +# CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set +# CONFIG_DMA_API_DEBUG is not set +# CONFIG_TEST_LKM is not set +# CONFIG_TEST_USER_COPY is not set +# CONFIG_TEST_BPF is not set +# CONFIG_TEST_FIRMWARE is not set +# CONFIG_TEST_UDELAY is not set +# CONFIG_MEMTEST is not set +# CONFIG_TEST_STATIC_KEYS is not set +# CONFIG_BUG_ON_DATA_CORRUPTION is not set +# CONFIG_SAMPLES is not set +CONFIG_HAVE_ARCH_KGDB=y +# CONFIG_KGDB is not set +CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y +# CONFIG_ARCH_WANTS_UBSAN_NO_NULL is not set +CONFIG_UBSAN=y +# CONFIG_UBSAN_SANITIZE_ALL is not set +# CONFIG_UBSAN_ALIGNMENT is not set +# CONFIG_UBSAN_NULL is not set +CONFIG_ARCH_HAS_DEVMEM_IS_ALLOWED=y +CONFIG_STRICT_DEVMEM=y +CONFIG_IO_STRICT_DEVMEM=y +CONFIG_X86_VERBOSE_BOOTUP=y +CONFIG_EARLY_PRINTK=y +# CONFIG_EARLY_PRINTK_DBGP is not set +# CONFIG_EARLY_PRINTK_EFI is not set +# CONFIG_X86_PTDUMP_CORE is not set +# CONFIG_X86_PTDUMP is not set +# CONFIG_EFI_PGT_DUMP is not set +# CONFIG_DEBUG_WX is not set +CONFIG_DOUBLEFAULT=y +# CONFIG_DEBUG_TLBFLUSH is not set +# CONFIG_IOMMU_STRESS is not set +CONFIG_HAVE_MMIOTRACE_SUPPORT=y +# CONFIG_X86_DECODER_SELFTEST is not set +CONFIG_IO_DELAY_TYPE_0X80=0 +CONFIG_IO_DELAY_TYPE_0XED=1 +CONFIG_IO_DELAY_TYPE_UDELAY=2 +CONFIG_IO_DELAY_TYPE_NONE=3 +CONFIG_IO_DELAY_0X80=y +# CONFIG_IO_DELAY_0XED is not set +# CONFIG_IO_DELAY_UDELAY is not set +# CONFIG_IO_DELAY_NONE is not set +CONFIG_DEFAULT_IO_DELAY_TYPE=0 +# CONFIG_DEBUG_BOOT_PARAMS is not set +# CONFIG_CPA_DEBUG is not set +CONFIG_OPTIMIZE_INLINING=y +# CONFIG_DEBUG_ENTRY is not set +# CONFIG_DEBUG_NMI_SELFTEST is not set +CONFIG_X86_DEBUG_FPU=y +# CONFIG_PUNIT_ATOM_DEBUG is not set + +# +# Security options +# +CONFIG_KEYS=y +CONFIG_PERSISTENT_KEYRINGS=y +CONFIG_BIG_KEYS=y +# CONFIG_TRUSTED_KEYS is not set +CONFIG_ENCRYPTED_KEYS=y +CONFIG_KEY_DH_OPERATIONS=y +CONFIG_SECURITY_DMESG_RESTRICT=y +CONFIG_SECURITY=y +# CONFIG_SECURITY_WRITABLE_HOOKS is not set +CONFIG_SECURITYFS=y +CONFIG_SECURITY_NETWORK=y +CONFIG_SECURITY_NETWORK_XFRM=y +CONFIG_SECURITY_PATH=y +CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y +CONFIG_HAVE_ARCH_HARDENED_USERCOPY=y +CONFIG_HARDENED_USERCOPY=y +# CONFIG_HARDENED_USERCOPY_PAGESPAN is not set +# CONFIG_STATIC_USERMODEHELPER is not set +# CONFIG_SECURITY_SELINUX is not set +# CONFIG_SECURITY_SMACK is not set +# CONFIG_SECURITY_TOMOYO is not set +# CONFIG_SECURITY_APPARMOR is not set +# CONFIG_SECURITY_LOADPIN is not set +CONFIG_SECURITY_YAMA=y +CONFIG_INTEGRITY=y +# CONFIG_INTEGRITY_SIGNATURE is not set +CONFIG_INTEGRITY_AUDIT=y +CONFIG_IMA=y +CONFIG_IMA_MEASURE_PCR_IDX=10 +# CONFIG_IMA_TEMPLATE is not set +CONFIG_IMA_NG_TEMPLATE=y +# CONFIG_IMA_SIG_TEMPLATE is not set +CONFIG_IMA_DEFAULT_TEMPLATE="ima-ng" +# CONFIG_IMA_DEFAULT_HASH_SHA1 is not set +CONFIG_IMA_DEFAULT_HASH_SHA256=y +# CONFIG_IMA_DEFAULT_HASH_SHA512 is not set +# CONFIG_IMA_DEFAULT_HASH_WP512 is not set +CONFIG_IMA_DEFAULT_HASH="sha256" +CONFIG_IMA_WRITE_POLICY=y +CONFIG_IMA_READ_POLICY=y +CONFIG_IMA_APPRAISE=y +CONFIG_IMA_PER_NAMESPACE=y +# CONFIG_EVM is not set +CONFIG_DEFAULT_SECURITY_DAC=y +CONFIG_DEFAULT_SECURITY="" +CONFIG_XOR_BLOCKS=m +CONFIG_CRYPTO=y + +# +# Crypto core or helper +# +CONFIG_CRYPTO_ALGAPI=y +CONFIG_CRYPTO_ALGAPI2=y +CONFIG_CRYPTO_AEAD=y +CONFIG_CRYPTO_AEAD2=y +CONFIG_CRYPTO_BLKCIPHER=y +CONFIG_CRYPTO_BLKCIPHER2=y +CONFIG_CRYPTO_HASH=y +CONFIG_CRYPTO_HASH2=y +CONFIG_CRYPTO_RNG=y +CONFIG_CRYPTO_RNG2=y +CONFIG_CRYPTO_RNG_DEFAULT=y +CONFIG_CRYPTO_AKCIPHER2=y +CONFIG_CRYPTO_AKCIPHER=y +CONFIG_CRYPTO_KPP2=y +CONFIG_CRYPTO_ACOMP2=y +CONFIG_CRYPTO_RSA=y +# CONFIG_CRYPTO_DH is not set +# CONFIG_CRYPTO_ECDH is not set +CONFIG_CRYPTO_MANAGER=y +CONFIG_CRYPTO_MANAGER2=y +CONFIG_CRYPTO_USER=y +CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y +CONFIG_CRYPTO_GF128MUL=y +CONFIG_CRYPTO_NULL=y +CONFIG_CRYPTO_NULL2=y +# CONFIG_CRYPTO_PCRYPT is not set +CONFIG_CRYPTO_WORKQUEUE=y +CONFIG_CRYPTO_CRYPTD=y +# CONFIG_CRYPTO_MCRYPTD is not set +CONFIG_CRYPTO_AUTHENC=y +# CONFIG_CRYPTO_TEST is not set +CONFIG_CRYPTO_ABLK_HELPER=y +CONFIG_CRYPTO_SIMD=y +CONFIG_CRYPTO_GLUE_HELPER_X86=y +CONFIG_CRYPTO_ENGINE=m + +# +# Authenticated Encryption with Associated Data +# +CONFIG_CRYPTO_CCM=y +CONFIG_CRYPTO_GCM=y +CONFIG_CRYPTO_CHACHA20POLY1305=y +CONFIG_CRYPTO_SEQIV=y +CONFIG_CRYPTO_ECHAINIV=y + +# +# Block modes +# +CONFIG_CRYPTO_CBC=y +CONFIG_CRYPTO_CTR=y +CONFIG_CRYPTO_CTS=y +CONFIG_CRYPTO_ECB=y +CONFIG_CRYPTO_LRW=y +CONFIG_CRYPTO_PCBC=y +CONFIG_CRYPTO_XTS=y +CONFIG_CRYPTO_KEYWRAP=y + +# +# Hash modes +# +CONFIG_CRYPTO_CMAC=y +CONFIG_CRYPTO_HMAC=y +CONFIG_CRYPTO_XCBC=y +CONFIG_CRYPTO_VMAC=y + +# +# Digest +# +CONFIG_CRYPTO_CRC32C=y +CONFIG_CRYPTO_CRC32C_INTEL=y +CONFIG_CRYPTO_CRC32=y +CONFIG_CRYPTO_CRC32_PCLMUL=y +CONFIG_CRYPTO_CRCT10DIF=y +# CONFIG_CRYPTO_CRCT10DIF_PCLMUL is not set +CONFIG_CRYPTO_GHASH=y +CONFIG_CRYPTO_POLY1305=y +CONFIG_CRYPTO_POLY1305_X86_64=y +CONFIG_CRYPTO_MD4=y +CONFIG_CRYPTO_MD5=y +CONFIG_CRYPTO_MICHAEL_MIC=y +CONFIG_CRYPTO_RMD128=y +CONFIG_CRYPTO_RMD160=y +CONFIG_CRYPTO_RMD256=y +CONFIG_CRYPTO_RMD320=y +CONFIG_CRYPTO_SHA1=y +CONFIG_CRYPTO_SHA1_SSSE3=y +CONFIG_CRYPTO_SHA256_SSSE3=y +CONFIG_CRYPTO_SHA512_SSSE3=y +# CONFIG_CRYPTO_SHA1_MB is not set +# CONFIG_CRYPTO_SHA256_MB is not set +# CONFIG_CRYPTO_SHA512_MB is not set +CONFIG_CRYPTO_SHA256=y +CONFIG_CRYPTO_SHA512=y +# CONFIG_CRYPTO_SHA3 is not set +CONFIG_CRYPTO_TGR192=y +CONFIG_CRYPTO_WP512=y +CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL=y + +# +# Ciphers +# +CONFIG_CRYPTO_AES=y +# CONFIG_CRYPTO_AES_TI is not set +CONFIG_CRYPTO_AES_X86_64=y +CONFIG_CRYPTO_AES_NI_INTEL=y +CONFIG_CRYPTO_ANUBIS=y +CONFIG_CRYPTO_ARC4=y +CONFIG_CRYPTO_BLOWFISH=y +CONFIG_CRYPTO_BLOWFISH_COMMON=y +CONFIG_CRYPTO_BLOWFISH_X86_64=y +CONFIG_CRYPTO_CAMELLIA=y +CONFIG_CRYPTO_CAMELLIA_X86_64=y +CONFIG_CRYPTO_CAMELLIA_AESNI_AVX_X86_64=y +CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64=y +CONFIG_CRYPTO_CAST_COMMON=y +CONFIG_CRYPTO_CAST5=y +CONFIG_CRYPTO_CAST5_AVX_X86_64=y +CONFIG_CRYPTO_CAST6=y +CONFIG_CRYPTO_CAST6_AVX_X86_64=y +CONFIG_CRYPTO_DES=y +CONFIG_CRYPTO_DES3_EDE_X86_64=y +CONFIG_CRYPTO_FCRYPT=y +CONFIG_CRYPTO_KHAZAD=y +CONFIG_CRYPTO_SALSA20=y +CONFIG_CRYPTO_SALSA20_X86_64=y +CONFIG_CRYPTO_CHACHA20=y +CONFIG_CRYPTO_CHACHA20_X86_64=y +CONFIG_CRYPTO_SEED=y +CONFIG_CRYPTO_SERPENT=y +CONFIG_CRYPTO_SERPENT_SSE2_X86_64=y +CONFIG_CRYPTO_SERPENT_AVX_X86_64=y +CONFIG_CRYPTO_SERPENT_AVX2_X86_64=y +CONFIG_CRYPTO_TEA=y +CONFIG_CRYPTO_TWOFISH=y +CONFIG_CRYPTO_TWOFISH_COMMON=y +CONFIG_CRYPTO_TWOFISH_X86_64=y +CONFIG_CRYPTO_TWOFISH_X86_64_3WAY=y +CONFIG_CRYPTO_TWOFISH_AVX_X86_64=y + +# +# Compression +# +CONFIG_CRYPTO_DEFLATE=y +CONFIG_CRYPTO_LZO=y +CONFIG_CRYPTO_842=y +CONFIG_CRYPTO_LZ4=y +CONFIG_CRYPTO_LZ4HC=y + +# +# Random Number Generation +# +CONFIG_CRYPTO_ANSI_CPRNG=y +CONFIG_CRYPTO_DRBG_MENU=y +CONFIG_CRYPTO_DRBG_HMAC=y +# CONFIG_CRYPTO_DRBG_HASH is not set +# CONFIG_CRYPTO_DRBG_CTR is not set +CONFIG_CRYPTO_DRBG=y +CONFIG_CRYPTO_JITTERENTROPY=y +CONFIG_CRYPTO_USER_API=y +CONFIG_CRYPTO_USER_API_HASH=y +CONFIG_CRYPTO_USER_API_SKCIPHER=y +CONFIG_CRYPTO_USER_API_RNG=y +CONFIG_CRYPTO_USER_API_AEAD=y +CONFIG_CRYPTO_HASH_INFO=y +CONFIG_CRYPTO_HW=y +CONFIG_CRYPTO_DEV_PADLOCK=y +CONFIG_CRYPTO_DEV_PADLOCK_AES=y +CONFIG_CRYPTO_DEV_PADLOCK_SHA=y +# CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API_DESC is not set +# CONFIG_CRYPTO_DEV_CCP is not set +# CONFIG_CRYPTO_DEV_QAT_DH895xCC is not set +# CONFIG_CRYPTO_DEV_QAT_C3XXX is not set +# CONFIG_CRYPTO_DEV_QAT_C62X is not set +# CONFIG_CRYPTO_DEV_QAT_DH895xCCVF is not set +# CONFIG_CRYPTO_DEV_QAT_C3XXXVF is not set +# CONFIG_CRYPTO_DEV_QAT_C62XVF is not set +CONFIG_CRYPTO_DEV_VIRTIO=m +CONFIG_ASYMMETRIC_KEY_TYPE=y +CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y +CONFIG_X509_CERTIFICATE_PARSER=y +CONFIG_PKCS7_MESSAGE_PARSER=y + +# +# Certificates for signature checking +# +# CONFIG_SYSTEM_TRUSTED_KEYRING is not set +CONFIG_HAVE_KVM=y +# CONFIG_VIRTUALIZATION is not set +CONFIG_BINARY_PRINTF=y + +# +# Library routines +# +CONFIG_RAID6_PQ=m +CONFIG_BITREVERSE=y +# CONFIG_HAVE_ARCH_BITREVERSE is not set +CONFIG_RATIONAL=y +CONFIG_GENERIC_STRNCPY_FROM_USER=y +CONFIG_GENERIC_STRNLEN_USER=y +CONFIG_GENERIC_NET_UTILS=y +CONFIG_GENERIC_FIND_FIRST_BIT=y +CONFIG_GENERIC_PCI_IOMAP=y +CONFIG_GENERIC_IOMAP=y +CONFIG_GENERIC_IO=y +CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y +CONFIG_ARCH_HAS_FAST_MULTIPLIER=y +CONFIG_CRC_CCITT=y +CONFIG_CRC16=y +CONFIG_CRC_T10DIF=y +CONFIG_CRC_ITU_T=y +CONFIG_CRC32=y +# CONFIG_CRC32_SELFTEST is not set +CONFIG_CRC32_SLICEBY8=y +# CONFIG_CRC32_SLICEBY4 is not set +# CONFIG_CRC32_SARWATE is not set +# CONFIG_CRC32_BIT is not set +# CONFIG_CRC7 is not set +CONFIG_LIBCRC32C=y +# CONFIG_CRC8 is not set +# CONFIG_AUDIT_ARCH_COMPAT_GENERIC is not set +# CONFIG_RANDOM32_SELFTEST is not set +CONFIG_842_COMPRESS=y +CONFIG_842_DECOMPRESS=y +CONFIG_ZLIB_INFLATE=y +CONFIG_ZLIB_DEFLATE=y +CONFIG_LZO_COMPRESS=y +CONFIG_LZO_DECOMPRESS=y +CONFIG_LZ4_COMPRESS=y +CONFIG_LZ4HC_COMPRESS=y +CONFIG_LZ4_DECOMPRESS=y +CONFIG_XZ_DEC=y +CONFIG_XZ_DEC_X86=y +CONFIG_XZ_DEC_POWERPC=y +CONFIG_XZ_DEC_IA64=y +CONFIG_XZ_DEC_ARM=y +CONFIG_XZ_DEC_ARMTHUMB=y +CONFIG_XZ_DEC_SPARC=y +CONFIG_XZ_DEC_BCJ=y +# CONFIG_XZ_DEC_TEST is not set +CONFIG_DECOMPRESS_GZIP=y +CONFIG_GENERIC_ALLOCATOR=y +CONFIG_TEXTSEARCH=y +CONFIG_TEXTSEARCH_KMP=y +CONFIG_TEXTSEARCH_BM=y +CONFIG_TEXTSEARCH_FSM=y +CONFIG_RADIX_TREE_MULTIORDER=y +CONFIG_ASSOCIATIVE_ARRAY=y +CONFIG_HAS_IOMEM=y +CONFIG_HAS_IOPORT_MAP=y +CONFIG_HAS_DMA=y +# CONFIG_DMA_NOOP_OPS is not set +# CONFIG_DMA_VIRT_OPS is not set +CONFIG_CPU_RMAP=y +CONFIG_DQL=y +CONFIG_GLOB=y +# CONFIG_GLOB_SELFTEST is not set +CONFIG_NLATTR=y +CONFIG_CLZ_TAB=y +# CONFIG_CORDIC is not set +# CONFIG_DDR is not set +# CONFIG_IRQ_POLL is not set +CONFIG_MPILIB=y +CONFIG_OID_REGISTRY=y +CONFIG_UCS2_STRING=y +CONFIG_FONT_SUPPORT=y +# CONFIG_FONTS is not set +CONFIG_FONT_8x8=y +CONFIG_FONT_8x16=y +# CONFIG_SG_SPLIT is not set +CONFIG_SG_POOL=y +CONFIG_ARCH_HAS_SG_CHAIN=y +CONFIG_ARCH_HAS_PMEM_API=y +CONFIG_ARCH_HAS_MMIO_FLUSH=y +CONFIG_SBITMAP=y diff --git a/projects/ima-namespace/kernel/kernel_config.debug b/projects/ima-namespace/kernel/kernel_config.debug new file mode 100644 index 000000000..00e73d577 --- /dev/null +++ b/projects/ima-namespace/kernel/kernel_config.debug @@ -0,0 +1,26 @@ + + +## LinuxKit DEBUG OPTIONS ## + +CONFIG_LOCKDEP=y +CONFIG_FRAME_POINTER=y +CONFIG_LOCKUP_DETECTOR=y +CONFIG_DETECT_HUNG_TASK=y +CONFIG_DEBUG_TIMEKEEPING=y +CONFIG_DEBUG_RT_MUTEXES=y +CONFIG_DEBUG_SPINLOCK=y +CONFIG_DEBUG_MUTEXES=y +CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y +CONFIG_DEBUG_LOCK_ALLOC=y +CONFIG_PROVE_LOCKING=y +CONFIG_LOCK_STAT=y +CONFIG_DEBUG_ATOMIC_SLEEP=y +CONFIG_DEBUG_LIST=y +CONFIG_DEBUG_NOTIFIERS=y +CONFIG_PROVE_RCU=y +CONFIG_RCU_TRACE=y +CONFIG_KGDB=y +CONFIG_KGDB_SERIAL_CONSOLE=y +CONFIG_KGDBOC=y +CONFIG_DEBUG_RODATA_TEST=y +CONFIG_DEBUG_WX=y diff --git a/projects/ima-namespace/kernel/patches-4.11.x/0001-ima-qualify-pathname-in-audit-info-record.patch b/projects/ima-namespace/kernel/patches-4.11.x/0001-ima-qualify-pathname-in-audit-info-record.patch new file mode 100644 index 000000000..0e286e664 --- /dev/null +++ b/projects/ima-namespace/kernel/patches-4.11.x/0001-ima-qualify-pathname-in-audit-info-record.patch @@ -0,0 +1,44 @@ +From 9d601ff5f8a643bf2d9995e073fa5ba2f5a5e9db Mon Sep 17 00:00:00 2001 +From: Guilherme Magalhaes +Date: Tue, 9 May 2017 10:34:10 -0300 +Subject: [PATCH 01/11] ima: qualify pathname in audit info record + +Adding new field (mount namespace id, along with already existent file +inode and device name) to uniquely identify a pathname considering +different mount namespaces. The file inode on a given device is unique +and these fields are required to identify a namespace id since this +id can be released and later reused by a different namespace. + +Signed-off-by: Guilherme Magalhaes +--- + security/integrity/integrity_audit.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/security/integrity/integrity_audit.c b/security/integrity/integrity_audit.c +index 90987d1..e675e42 100644 +--- a/security/integrity/integrity_audit.c ++++ b/security/integrity/integrity_audit.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include "integrity.h" + + static int integrity_audit_info; +@@ -52,8 +53,12 @@ void integrity_audit_msg(int audit_msgno, struct inode *inode, + audit_log_format(ab, " comm="); + audit_log_untrustedstring(ab, get_task_comm(name, current)); + if (fname) { ++ struct ns_common *ns; + audit_log_format(ab, " name="); + audit_log_untrustedstring(ab, fname); ++ ns = mntns_operations.get(current); ++ audit_log_format(ab, " mnt_ns=%u", ns->inum); ++ mntns_operations.put(ns); + } + if (inode) { + audit_log_format(ab, " dev="); +-- +2.9.3 + diff --git a/projects/ima-namespace/kernel/patches-4.11.x/0002-ima-qualify-pathname-in-audit-measurement-record.patch b/projects/ima-namespace/kernel/patches-4.11.x/0002-ima-qualify-pathname-in-audit-measurement-record.patch new file mode 100644 index 000000000..f85e9c52f --- /dev/null +++ b/projects/ima-namespace/kernel/patches-4.11.x/0002-ima-qualify-pathname-in-audit-measurement-record.patch @@ -0,0 +1,52 @@ +From 9eb525d553c6aa296f9396e192a37e453b30d5f9 Mon Sep 17 00:00:00 2001 +From: Guilherme Magalhaes +Date: Tue, 9 May 2017 10:36:16 -0300 +Subject: [PATCH 02/11] ima: qualify pathname in audit measurement record + +Adding new fields (mount namespace id, file inode and device name) to +uniquely identify a pathname considering different mount namespaces. +The file inode on a given device is unique and these fields are +required to identify a namespace id since this id can be released +and later reused by a different namespace. + +Signed-off-by: Guilherme Magalhaes +--- + security/integrity/ima/ima_api.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c +index c2edba8..b05c1fd 100644 +--- a/security/integrity/ima/ima_api.c ++++ b/security/integrity/ima/ima_api.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + + #include "ima.h" + +@@ -293,6 +294,7 @@ void ima_audit_measurement(struct integrity_iint_cache *iint, + char hash[(iint->ima_hash->length * 2) + 1]; + const char *algo_name = hash_algo_name[iint->ima_hash->algo]; + char algo_hash[sizeof(hash) + strlen(algo_name) + 2]; ++ struct ns_common *ns; + int i; + + if (iint->flags & IMA_AUDITED) +@@ -312,6 +314,12 @@ void ima_audit_measurement(struct integrity_iint_cache *iint, + audit_log_format(ab, " hash="); + snprintf(algo_hash, sizeof(algo_hash), "%s:%s", algo_name, hash); + audit_log_untrustedstring(ab, algo_hash); ++ ns = mntns_operations.get(current); ++ audit_log_format(ab, " mnt_ns=%u", ns->inum); ++ mntns_operations.put(ns); ++ audit_log_format(ab, " dev="); ++ audit_log_untrustedstring(ab, iint->inode->i_sb->s_id); ++ audit_log_format(ab, " ino=%lu", iint->inode->i_ino); + + audit_log_task_info(ab, current); + audit_log_end(ab); +-- +2.9.3 + diff --git a/projects/ima-namespace/kernel/patches-4.11.x/0003-ima-qualify-pathname-in-measurement-file.patch b/projects/ima-namespace/kernel/patches-4.11.x/0003-ima-qualify-pathname-in-measurement-file.patch new file mode 100644 index 000000000..b6990aa2c --- /dev/null +++ b/projects/ima-namespace/kernel/patches-4.11.x/0003-ima-qualify-pathname-in-measurement-file.patch @@ -0,0 +1,210 @@ +From e96e10b725a11c2d563caa3907212b149355b70f Mon Sep 17 00:00:00 2001 +From: Guilherme Magalhaes +Date: Tue, 9 May 2017 11:09:04 -0300 +Subject: [PATCH 03/11] ima: qualify pathname in measurement file + +Adding new fields (mount namespace id, file inode and device name) to +uniquely identify a pathname in the measurement file considering +multiple mount namespaces. The file inode on a given device is unique +and these fields are required to identify a namespace id since this +id can be released and later reused by a different namespace. +These new fields are added to all measurement templates if +CONFIG_IMA_PER_NAMESPACE is defined. +There will still be one single measurement file even with multiple +namespaces, since for the remote attestion a single and complete list +is required. + +Signed-off-by: Guilherme Magalhaes +--- + security/integrity/ima/Kconfig | 8 ++++ + security/integrity/ima/ima.h | 12 ++++++ + security/integrity/ima/ima_template.c | 10 ++++- + security/integrity/ima/ima_template_lib.c | 70 +++++++++++++++++++++++++++++++ + security/integrity/ima/ima_template_lib.h | 13 ++++++ + 5 files changed, 111 insertions(+), 2 deletions(-) + +diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig +index 370eb2f..7331ff6 100644 +--- a/security/integrity/ima/Kconfig ++++ b/security/integrity/ima/Kconfig +@@ -219,3 +219,11 @@ config IMA_APPRAISE_SIGNED_INIT + default n + help + This option requires user-space init to be signed. ++ ++config IMA_PER_NAMESPACE ++ bool "Enable per mount-namespace handling of IMA policy." ++ depends on IMA ++ default n ++ help ++ This option enables another API in securityfs allowing IMA policies to ++ be defined per mount namespace. +diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h +index b563fbd..42fb91ba 100644 +--- a/security/integrity/ima/ima.h ++++ b/security/integrity/ima/ima.h +@@ -47,7 +47,19 @@ enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 }; + #define IMA_TEMPLATE_NUM_FIELDS_MAX 15 + + #define IMA_TEMPLATE_IMA_NAME "ima" ++#define IMA_TEMPLATE_IMA_NG_NAME "ima-ng" ++#define IMA_TEMPLATE_IMA_SIG_NAME "ima-sig" ++ ++#ifndef CONFIG_IMA_PER_NAMESPACE + #define IMA_TEMPLATE_IMA_FMT "d|n" ++#define IMA_TEMPLATE_IMA_NG_FMT "d-ng|n-ng" ++#define IMA_TEMPLATE_IMA_SIG_FMT "d-ng|n-ng|sig" ++#else ++#define IMA_TEMPLATE_IMA_FMT "nid|fi|dev|d|n" ++#define IMA_TEMPLATE_IMA_NG_FMT "nid|fi|dev|d-ng|n-ng" ++#define IMA_TEMPLATE_IMA_SIG_FMT "nid|fi|dev|d-ng|n-ng|sig" ++#endif ++ + + /* current content of the policy */ + extern int ima_policy_flag; +diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c +index cebb37c..db65c09 100644 +--- a/security/integrity/ima/ima_template.c ++++ b/security/integrity/ima/ima_template.c +@@ -21,8 +21,8 @@ + + static struct ima_template_desc builtin_templates[] = { + {.name = IMA_TEMPLATE_IMA_NAME, .fmt = IMA_TEMPLATE_IMA_FMT}, +- {.name = "ima-ng", .fmt = "d-ng|n-ng"}, +- {.name = "ima-sig", .fmt = "d-ng|n-ng|sig"}, ++ {.name = IMA_TEMPLATE_IMA_NG_NAME, .fmt = IMA_TEMPLATE_IMA_NG_FMT}, ++ {.name = IMA_TEMPLATE_IMA_SIG_NAME, .fmt = IMA_TEMPLATE_IMA_SIG_FMT}, + {.name = "", .fmt = ""}, /* placeholder for a custom format */ + }; + +@@ -40,6 +40,12 @@ static struct ima_template_field supported_fields[] = { + .field_show = ima_show_template_string}, + {.field_id = "sig", .field_init = ima_eventsig_init, + .field_show = ima_show_template_sig}, ++ {.field_id = "nid", .field_init = ima_namespaceid_init, ++ .field_show = ima_show_namespaceid}, ++ {.field_id = "fi", .field_init = ima_filei_init, ++ .field_show = ima_show_filei}, ++ {.field_id = "dev", .field_init = ima_dev_init, ++ .field_show = ima_show_dev}, + }; + #define MAX_TEMPLATE_NAME_LEN 15 + +diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c +index f9ba37b..50cde10 100644 +--- a/security/integrity/ima/ima_template_lib.c ++++ b/security/integrity/ima/ima_template_lib.c +@@ -14,6 +14,8 @@ + */ + + #include "ima_template_lib.h" ++#include ++#include + + static bool ima_template_hash_algo_allowed(u8 algo) + { +@@ -330,3 +332,71 @@ int ima_eventsig_init(struct ima_event_data *event_data, + out: + return rc; + } ++ ++int ima_namespaceid_init(struct ima_event_data *event_data, ++ struct ima_field_data *field_data) ++{ ++ u8 tmpbuf[64]; ++ struct ns_common *ns; ++ ++ ns = mntns_operations.get(current); ++ snprintf(tmpbuf, sizeof(tmpbuf), "mnt-ns=%u", ns->inum); ++ mntns_operations.put(ns); ++ ++ return ima_write_template_field_data(tmpbuf, strlen(tmpbuf), DATA_FMT_STRING, field_data); ++} ++ ++void ima_show_namespaceid(struct seq_file *m, enum ima_show_type show, ++ struct ima_field_data *field_data) ++{ ++ ima_show_template_field_data(m, show, DATA_FMT_STRING, field_data); ++} ++ ++int ima_filei_init(struct ima_event_data *event_data, ++ struct ima_field_data *field_data) ++{ ++ u8 tmpbuf[64]; ++ struct inode *inode; ++ int rc = 0; ++ ++ if (event_data->file) { ++ inode = file_inode(event_data->file); ++ snprintf(tmpbuf, sizeof(tmpbuf), "inode=%lu", inode->i_ino); ++ rc = ima_write_template_field_data(tmpbuf, strlen(tmpbuf), DATA_FMT_STRING, field_data); ++ } else { ++ pr_info("IMA: event file is NULL\n"); ++ } ++ ++ return rc; ++} ++ ++void ima_show_filei(struct seq_file *m, enum ima_show_type show, ++ struct ima_field_data *field_data) ++{ ++ ima_show_template_field_data(m, show, DATA_FMT_STRING, field_data); ++} ++ ++int ima_dev_init(struct ima_event_data *event_data, ++ struct ima_field_data *field_data) ++{ ++ u8 tmpbuf[64]; ++ struct inode *inode; ++ int rc = 0; ++ ++ if (event_data->file) { ++ inode = file_inode(event_data->file); ++ snprintf(tmpbuf, sizeof(tmpbuf), "dev=%s", inode->i_sb->s_id); //TODO: check untrusted string? see audit_log_n_untrustedstring() ++ tmpbuf[sizeof(tmpbuf) - 1] = 0; ++ rc = ima_write_template_field_data(tmpbuf, strlen(tmpbuf), DATA_FMT_STRING, field_data); ++ } else { ++ pr_info("IMA: event file is NULL\n"); ++ } ++ ++ return rc; ++} ++ ++void ima_show_dev(struct seq_file *m, enum ima_show_type show, ++ struct ima_field_data *field_data) ++{ ++ ima_show_template_field_data(m, show, DATA_FMT_STRING, field_data); ++} +diff --git a/security/integrity/ima/ima_template_lib.h b/security/integrity/ima/ima_template_lib.h +index c344530..cf6a6c7 100644 +--- a/security/integrity/ima/ima_template_lib.h ++++ b/security/integrity/ima/ima_template_lib.h +@@ -26,6 +26,12 @@ void ima_show_template_string(struct seq_file *m, enum ima_show_type show, + struct ima_field_data *field_data); + void ima_show_template_sig(struct seq_file *m, enum ima_show_type show, + struct ima_field_data *field_data); ++void ima_show_namespaceid(struct seq_file *m, enum ima_show_type show, ++ struct ima_field_data *field_data); ++void ima_show_filei(struct seq_file *m, enum ima_show_type show, ++ struct ima_field_data *field_data); ++void ima_show_dev(struct seq_file *m, enum ima_show_type show, ++ struct ima_field_data *field_data); + int ima_eventdigest_init(struct ima_event_data *event_data, + struct ima_field_data *field_data); + int ima_eventname_init(struct ima_event_data *event_data, +@@ -36,4 +42,11 @@ int ima_eventname_ng_init(struct ima_event_data *event_data, + struct ima_field_data *field_data); + int ima_eventsig_init(struct ima_event_data *event_data, + struct ima_field_data *field_data); ++int ima_namespaceid_init(struct ima_event_data *event_data, ++ struct ima_field_data *field_data); ++int ima_filei_init(struct ima_event_data *event_data, ++ struct ima_field_data *field_data); ++int ima_dev_init(struct ima_event_data *event_data, ++ struct ima_field_data *field_data); ++ + #endif /* __LINUX_IMA_TEMPLATE_LIB_H */ +-- +2.9.3 + diff --git a/projects/ima-namespace/kernel/patches-4.11.x/0004-ima-add-support-to-namespace-securityfs-file.patch b/projects/ima-namespace/kernel/patches-4.11.x/0004-ima-add-support-to-namespace-securityfs-file.patch new file mode 100644 index 000000000..e25dac922 --- /dev/null +++ b/projects/ima-namespace/kernel/patches-4.11.x/0004-ima-add-support-to-namespace-securityfs-file.patch @@ -0,0 +1,262 @@ +From 3966bcc59bbb0d43b4b2bf8b005788cad75cf65d Mon Sep 17 00:00:00 2001 +From: Guilherme Magalhaes +Date: Tue, 9 May 2017 13:41:24 -0300 +Subject: [PATCH 04/11] ima: add support to namespace securityfs file + +Creating the namespace securityfs file under ima folder. When a mount +namespace id is written to the namespace file, a new folder is created and +with a policy file for that specified namespace. Then, user defined policy +for namespaces may be set by writing rules to this namespace policy file. +With this interface, there is no need to give visibility for the securityfs +inside mount namespaces or containers in userspace. + +Signed-off-by: Guilherme Magalhaes +--- + security/integrity/ima/ima.h | 4 + + security/integrity/ima/ima_fs.c | 183 ++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 187 insertions(+) + +diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h +index 42fb91ba..6e8ca8e 100644 +--- a/security/integrity/ima/ima.h ++++ b/security/integrity/ima/ima.h +@@ -326,4 +326,8 @@ static inline int security_filter_rule_match(u32 secid, u32 field, u32 op, + #define POLICY_FILE_FLAGS S_IWUSR + #endif /* CONFIG_IMA_WRITE_POLICY */ + ++#ifdef CONFIG_IMA_PER_NAMESPACE ++#define NAMESPACES_FILE_FLAGS S_IWUSR ++#endif ++ + #endif /* __LINUX_IMA_H */ +diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c +index ca303e5..6456407 100644 +--- a/security/integrity/ima/ima_fs.c ++++ b/security/integrity/ima/ima_fs.c +@@ -23,6 +23,8 @@ + #include + #include + #include ++#include ++#include + + #include "ima.h" + +@@ -272,6 +274,40 @@ static const struct file_operations ima_ascii_measurements_ops = { + .release = seq_release, + }; + ++#ifdef CONFIG_IMA_PER_NAMESPACE ++/* ++ * check_mntns: check a mount namespace is valid ++ * ++ * @ns_id: namespace id to be checked ++ * Returns 0 if the namespace is valid. ++ * ++ * Note: a better way to implement this check is needed. There are ++ * cases where the namespace id is valid but not in use by any process ++ * and then this implementation misses this case. Could we use an ++ * interface similar to what setns implements? ++ */ ++static int check_mntns(unsigned int ns_id) ++{ ++ struct task_struct *p; ++ int result = 1; ++ struct ns_common *ns; ++ ++ rcu_read_lock(); ++ for_each_process(p) { ++ ns = mntns_operations.get(p); ++ if (ns->inum == ns_id) { ++ result = 0; ++ mntns_operations.put(ns); ++ break; ++ } ++ mntns_operations.put(ns); ++ } ++ rcu_read_unlock(); ++ ++ return result; ++} ++#endif ++ + static ssize_t ima_read_policy(char *path) + { + void *data; +@@ -366,6 +402,9 @@ static struct dentry *ascii_runtime_measurements; + static struct dentry *runtime_measurements_count; + static struct dentry *violations; + static struct dentry *ima_policy; ++#ifdef CONFIG_IMA_PER_NAMESPACE ++static struct dentry *ima_namespaces; ++#endif + + enum ima_fs_flags { + IMA_FS_BUSY, +@@ -451,6 +490,139 @@ static const struct file_operations ima_measure_policy_ops = { + .llseek = generic_file_llseek, + }; + ++#ifdef CONFIG_IMA_PER_NAMESPACE ++/* ++ * Assumes namespace id is in use by some process and this mapping ++ * does not exist in the map table. ++ */ ++static int create_mnt_ns_directory(unsigned int ns_id) ++{ ++ int result; ++ struct dentry *ns_dir, *ns_policy; ++ char dir_name[64]; ++ ++ snprintf(dir_name, sizeof(dir_name), "%u", ns_id); ++ ++ ns_dir = securityfs_create_dir(dir_name, ima_dir); ++ if (IS_ERR(ns_dir)) { ++ result = PTR_ERR(ns_dir); ++ goto out; ++ } ++ ++ ns_policy = securityfs_create_file("policy", POLICY_FILE_FLAGS, ++ ns_dir, NULL, ++ &ima_measure_policy_ops); ++ if (IS_ERR(ns_policy)) { ++ result = PTR_ERR(ns_policy); ++ securityfs_remove(ns_dir); ++ goto out; ++ } ++ ++ result = 0; ++ ++out: ++ return result; ++} ++ ++static ssize_t handle_new_namespace_policy(const char *data, size_t datalen) ++{ ++ unsigned int ns_id; ++ ssize_t result; ++ ++ result = -EINVAL; ++ ++ if (sscanf(data, "%u", &ns_id) != 1) { ++ pr_err("IMA: invalid namespace id: %s\n", data); ++ goto out; ++ } ++ ++ if (check_mntns(ns_id)) { ++ result = -ENOENT; ++ pr_err("IMA: unused namespace id %u\n", ns_id); ++ goto out; ++ } ++ ++ result = create_mnt_ns_directory(ns_id); ++ if (result != 0) { ++ pr_err("IMA: namespace id %u directory creation failed\n", ns_id); ++ goto out; ++ } ++ ++ result = datalen; ++ pr_info("IMA: directory created for namespace id %u\n", ns_id); ++ ++out: ++ return result; ++} ++ ++static ssize_t ima_write_namespaces(struct file *file, const char __user *buf, ++ size_t datalen, loff_t *ppos) ++{ ++ char *data; ++ ssize_t result; ++ ++ if (datalen >= PAGE_SIZE) ++ datalen = PAGE_SIZE - 1; ++ ++ /* No partial writes. */ ++ result = -EINVAL; ++ if (*ppos != 0) ++ goto out; ++ ++ result = -ENOMEM; ++ data = kmalloc(datalen + 1, GFP_KERNEL); ++ if (!data) ++ goto out; ++ ++ *(data + datalen) = '\0'; ++ ++ result = -EFAULT; ++ if (copy_from_user(data, buf, datalen)) ++ goto out_free; ++ ++ result = mutex_lock_interruptible(&ima_write_mutex); ++ if (result < 0) ++ goto out_free; ++ ++ result = handle_new_namespace_policy(data, datalen); ++ ++ mutex_unlock(&ima_write_mutex); ++ ++out_free: ++ kfree(data); ++out: ++ return result; ++} ++ ++static int ima_open_namespaces(struct inode *inode, struct file *filp) ++{ ++ if (!(filp->f_flags & O_WRONLY)) ++ return -EACCES; ++ ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ ++ if (test_and_set_bit(IMA_FS_BUSY, &ima_fs_flags)) ++ return -EBUSY; ++ return 0; ++} ++ ++static int ima_release_namespaces(struct inode *inode, struct file *file) ++{ ++ clear_bit(IMA_FS_BUSY, &ima_fs_flags); ++ ++ return 0; ++} ++ ++static const struct file_operations ima_namespaces_ops = { ++ .open = ima_open_namespaces, ++ .write = ima_write_namespaces, ++ .read = seq_read, ++ .release = ima_release_namespaces, ++ .llseek = generic_file_llseek, ++}; ++#endif ++ + int __init ima_fs_init(void) + { + ima_dir = securityfs_create_dir("ima", NULL); +@@ -490,6 +662,14 @@ int __init ima_fs_init(void) + if (IS_ERR(ima_policy)) + goto out; + ++#ifdef CONFIG_IMA_PER_NAMESPACE ++ ima_namespaces = securityfs_create_file("namespaces", NAMESPACES_FILE_FLAGS, ++ ima_dir, NULL, ++ &ima_namespaces_ops); ++ if (IS_ERR(ima_namespaces)) ++ goto out; ++#endif ++ + return 0; + out: + securityfs_remove(violations); +@@ -498,5 +678,8 @@ int __init ima_fs_init(void) + securityfs_remove(binary_runtime_measurements); + securityfs_remove(ima_dir); + securityfs_remove(ima_policy); ++#ifdef CONFIG_IMA_PER_NAMESPACE ++ securityfs_remove(ima_namespaces); ++#endif + return -1; + } +-- +2.9.3 + diff --git a/projects/ima-namespace/kernel/patches-4.11.x/0005-ima-store-new-namespace-policy-structure-in-a-radix-.patch b/projects/ima-namespace/kernel/patches-4.11.x/0005-ima-store-new-namespace-policy-structure-in-a-radix-.patch new file mode 100644 index 000000000..edcce8bf6 --- /dev/null +++ b/projects/ima-namespace/kernel/patches-4.11.x/0005-ima-store-new-namespace-policy-structure-in-a-radix-.patch @@ -0,0 +1,301 @@ +From 9f1840db5abfabeaeb7835bc277a75ac23c4b188 Mon Sep 17 00:00:00 2001 +From: Guilherme Magalhaes +Date: Tue, 9 May 2017 16:24:05 -0300 +Subject: [PATCH 05/11] ima: store new namespace policy structure in a radix + tree + +New ima_ns_policy structure to describe IMA policy data per namespace. +Using a radix tree to map namespace ids to a respective ima_ns_policy +structure. +When it is needed to retrieve IMA policy rules/flags, the target +ima_ns_policy structure is retrieved from the radix tree by getting the +namespace id from the current context. + +Signed-off-by: Guilherme Magalhaes +--- + security/integrity/ima/ima.h | 37 +++++++++++++++++ + security/integrity/ima/ima_fs.c | 79 ++++++++++++++++++++++++++++++++++--- + security/integrity/ima/ima_init.c | 2 + + security/integrity/ima/ima_policy.c | 29 +++++++++----- + 4 files changed, 133 insertions(+), 14 deletions(-) + +diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h +index 6e8ca8e..1c5c875 100644 +--- a/security/integrity/ima/ima.h ++++ b/security/integrity/ima/ima.h +@@ -140,6 +140,21 @@ static inline void ima_load_kexec_buffer(void) {} + */ + extern bool ima_canonical_fmt; + ++/* Namespace policy globals */ ++struct ima_ns_policy { ++ struct dentry *policy_dentry; ++ struct dentry *ns_dentry; ++ struct list_head *ima_rules; ++ struct list_head ima_policy_rules; ++ int ima_policy_flag; ++ int ima_appraise; ++}; ++ ++#ifdef CONFIG_IMA_PER_NAMESPACE ++extern spinlock_t ima_ns_policy_lock; ++extern struct radix_tree_root ima_ns_policy_mapping; ++#endif ++ + /* Internal IMA function definitions */ + int ima_init(void); + int ima_fs_init(void); +@@ -166,6 +181,27 @@ int ima_measurements_show(struct seq_file *m, void *v); + unsigned long ima_get_binary_runtime_size(void); + int ima_init_template(void); + void ima_init_template_list(void); ++#ifdef CONFIG_IMA_PER_NAMESPACE ++static inline void ima_namespace_lock_init(void) { ++ spin_lock_init(&ima_ns_policy_lock); ++} ++static inline void ima_namespace_lock(void) { ++ spin_lock(&ima_ns_policy_lock); ++} ++static inline void ima_namespace_unlock(void) { ++ spin_unlock(&ima_ns_policy_lock); ++} ++#else ++static inline void ima_namespace_lock_init(void) { ++ return; ++} ++static inline void ima_namespace_lock(void) { ++ return; ++} ++static inline void ima_namespace_unlock(void) { ++ return; ++} ++#endif + + /* + * used to protect h_table and sha_table +@@ -226,6 +262,7 @@ void ima_update_policy(void); + void ima_update_policy_flag(void); + ssize_t ima_parse_add_rule(char *); + void ima_delete_rules(void); ++void ima_free_policy_rules(struct list_head *policy_rules); + int ima_check_policy(void); + void *ima_policy_start(struct seq_file *m, loff_t *pos); + void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos); +diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c +index 6456407..ce6dcdf 100644 +--- a/security/integrity/ima/ima_fs.c ++++ b/security/integrity/ima/ima_fs.c +@@ -275,6 +275,48 @@ static const struct file_operations ima_ascii_measurements_ops = { + }; + + #ifdef CONFIG_IMA_PER_NAMESPACE ++/* used for namespace policy rules initialization */ ++static LIST_HEAD(empty_policy); ++ ++static int allocate_namespace_policy(struct ima_ns_policy **ins, ++ struct dentry *policy_dentry, struct dentry *ns_dentry) ++{ ++ int result; ++ struct ima_ns_policy *p; ++ ++ p = kmalloc(sizeof(struct ima_ns_policy), GFP_KERNEL); ++ if (!p) { ++ result = -ENOMEM; ++ goto out; ++ } ++ ++ p->policy_dentry = policy_dentry; ++ p->ns_dentry = ns_dentry; ++ p->ima_appraise = 0; ++ p->ima_policy_flag = 0; ++ INIT_LIST_HEAD(&p->ima_policy_rules); ++ /* namespace starts with empty rules and not pointing to ++ * ima_policy_rules */ ++ p->ima_rules = &empty_policy; ++ ++ result = 0; ++ *ins = p; ++ ++out: ++ return result; ++} ++ ++static void free_namespace_policy(struct ima_ns_policy *ins) ++{ ++ if (ins->policy_dentry) ++ securityfs_remove(ins->policy_dentry); ++ securityfs_remove(ins->ns_dentry); ++ ++ ima_free_policy_rules(&ins->ima_policy_rules); ++ ++ kfree(ins); ++} ++ + /* + * check_mntns: check a mount namespace is valid + * +@@ -476,9 +518,11 @@ static int ima_release_policy(struct inode *inode, struct file *file) + #ifndef CONFIG_IMA_WRITE_POLICY + securityfs_remove(ima_policy); + ima_policy = NULL; +-#else +- clear_bit(IMA_FS_BUSY, &ima_fs_flags); + #endif ++ ++ /* always clear the busy flag so other namespaces can use it */ ++ clear_bit(IMA_FS_BUSY, &ima_fs_flags); ++ + return 0; + } + +@@ -500,11 +544,14 @@ static int create_mnt_ns_directory(unsigned int ns_id) + int result; + struct dentry *ns_dir, *ns_policy; + char dir_name[64]; ++ struct ima_ns_policy *ins; + + snprintf(dir_name, sizeof(dir_name), "%u", ns_id); + + ns_dir = securityfs_create_dir(dir_name, ima_dir); + if (IS_ERR(ns_dir)) { ++ /* TODO: handle EEXIST error, remove the folder and ++ continue the procedure */ + result = PTR_ERR(ns_dir); + goto out; + } +@@ -518,7 +565,15 @@ static int create_mnt_ns_directory(unsigned int ns_id) + goto out; + } + +- result = 0; ++ result = allocate_namespace_policy(&ins, ns_policy, ns_dir); ++ if (!result) { ++ result = radix_tree_insert(&ima_ns_policy_mapping, ns_id, ins); ++ if (result) ++ free_namespace_policy(ins); ++ } else { ++ securityfs_remove(ns_policy); ++ securityfs_remove(ns_dir); ++ } + + out: + return result; +@@ -528,6 +583,7 @@ static ssize_t handle_new_namespace_policy(const char *data, size_t datalen) + { + unsigned int ns_id; + ssize_t result; ++ struct ima_ns_policy *ins; + + result = -EINVAL; + +@@ -536,21 +592,34 @@ static ssize_t handle_new_namespace_policy(const char *data, size_t datalen) + goto out; + } + ++ rcu_read_lock(); ++ ins = radix_tree_lookup(&ima_ns_policy_mapping, ns_id); ++ rcu_read_unlock(); ++ if (ins) { ++ pr_info("IMA: directory for namespace id %u already created\n", ns_id); ++ result = datalen; ++ goto out; ++ } ++ ++ ima_namespace_lock(); + if (check_mntns(ns_id)) { + result = -ENOENT; + pr_err("IMA: unused namespace id %u\n", ns_id); +- goto out; ++ goto out_unlock; + } + + result = create_mnt_ns_directory(ns_id); + if (result != 0) { + pr_err("IMA: namespace id %u directory creation failed\n", ns_id); +- goto out; ++ goto out_unlock; + } + + result = datalen; + pr_info("IMA: directory created for namespace id %u\n", ns_id); + ++out_unlock: ++ ima_namespace_unlock(); ++ + out: + return result; + } +diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c +index 2967d49..b557ee3 100644 +--- a/security/integrity/ima/ima_init.c ++++ b/security/integrity/ima/ima_init.c +@@ -135,6 +135,8 @@ int __init ima_init(void) + if (rc != 0) + return rc; + ++ ima_namespace_lock_init(); ++ + ima_init_policy(); + + return ima_fs_init(); +diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c +index aed47b7..2e8c3b7 100644 +--- a/security/integrity/ima/ima_policy.c ++++ b/security/integrity/ima/ima_policy.c +@@ -47,6 +47,12 @@ + int ima_policy_flag; + static int temp_ima_appraise; + ++#ifdef CONFIG_IMA_PER_NAMESPACE ++/* policy namespace map entries except the initial namespace policy */ ++RADIX_TREE(ima_ns_policy_mapping, GFP_ATOMIC); ++spinlock_t ima_ns_policy_lock; ++#endif ++ + #define MAX_LSM_RULES 6 + enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE, + LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE +@@ -863,19 +869,12 @@ ssize_t ima_parse_add_rule(char *rule) + return len; + } + +-/** +- * ima_delete_rules() called to cleanup invalid in-flight policy. +- * We don't need locking as we operate on the temp list, which is +- * different from the active one. There is also only one user of +- * ima_delete_rules() at a time. +- */ +-void ima_delete_rules(void) ++void ima_free_policy_rules(struct list_head *policy_rules) + { + struct ima_rule_entry *entry, *tmp; + int i; + +- temp_ima_appraise = 0; +- list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) { ++ list_for_each_entry_safe(entry, tmp, policy_rules, list) { + for (i = 0; i < MAX_LSM_RULES; i++) + kfree(entry->lsm[i].args_p); + +@@ -884,6 +883,18 @@ void ima_delete_rules(void) + } + } + ++/** ++ * ima_delete_rules() called to cleanup invalid in-flight policy. ++ * We don't need locking as we operate on the temp list, which is ++ * different from the active one. There is also only one user of ++ * ima_delete_rules() at a time. ++ */ ++void ima_delete_rules(void) ++{ ++ temp_ima_appraise = 0; ++ ima_free_policy_rules(&ima_temp_rules); ++} ++ + #ifdef CONFIG_IMA_READ_POLICY + enum { + mask_exec = 0, mask_write, mask_read, mask_append +-- +2.9.3 + diff --git a/projects/ima-namespace/kernel/patches-4.11.x/0006-ima-fs-release-namespace-policy-resources.patch b/projects/ima-namespace/kernel/patches-4.11.x/0006-ima-fs-release-namespace-policy-resources.patch new file mode 100644 index 000000000..46b867921 --- /dev/null +++ b/projects/ima-namespace/kernel/patches-4.11.x/0006-ima-fs-release-namespace-policy-resources.patch @@ -0,0 +1,104 @@ +From 49c15686df3676edcc354a02c666f66b81bbb348 Mon Sep 17 00:00:00 2001 +From: Guilherme Magalhaes +Date: Tue, 9 May 2017 16:50:01 -0300 +Subject: [PATCH 06/11] ima, fs: release namespace policy resources + +Release all namespace IMA policy resources when the mount namespace is +released. +This is the suggested mechanism to release namespace policy resources, +but we still can discuss other methods to avoid cross-component changes. + +Signed-off-by: Guilherme Magalhaes +--- + fs/namespace.c | 4 ++++ + include/linux/integrity.h | 9 +++++++++ + security/integrity/ima/ima_fs.c | 26 ++++++++++++++++++++++++++ + 3 files changed, 39 insertions(+) + +diff --git a/fs/namespace.c b/fs/namespace.c +index cc1375ef..80940998 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + #include /* init_rootfs */ +@@ -3283,6 +3284,9 @@ void put_mnt_ns(struct mnt_namespace *ns) + { + if (!atomic_dec_and_test(&ns->count)) + return; ++ ++ ima_mnt_namespace_dying(ns->ns.inum); ++ + drop_collected_mounts(&ns->root->mnt); + free_mnt_ns(ns); + } +diff --git a/include/linux/integrity.h b/include/linux/integrity.h +index c2d6082..034d082 100644 +--- a/include/linux/integrity.h ++++ b/include/linux/integrity.h +@@ -43,4 +43,13 @@ static inline void integrity_load_keys(void) + } + #endif /* CONFIG_INTEGRITY */ + ++#ifdef CONFIG_IMA_PER_NAMESPACE ++extern void ima_mnt_namespace_dying(unsigned int ns_id); ++#else ++static inline void ima_mnt_namespace_dying(unsigned int ns_id) ++{ ++ return; ++} ++#endif /* CONFIG_IMA_PER_NAMESPACE */ ++ + #endif /* _LINUX_INTEGRITY_H */ +diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c +index ce6dcdf..56ba0ff 100644 +--- a/security/integrity/ima/ima_fs.c ++++ b/security/integrity/ima/ima_fs.c +@@ -423,6 +423,7 @@ static ssize_t ima_write_policy(struct file *file, const char __user *buf, + integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL, + "policy_update", "signed policy required", + 1, 0); ++ + if (ima_appraise & IMA_APPRAISE_ENFORCE) + result = -EACCES; + } else { +@@ -579,6 +580,31 @@ static int create_mnt_ns_directory(unsigned int ns_id) + return result; + } + ++/* ++ * ima_mnt_namespace_dying - releases all namespace policy resources ++ * It is called automatically when the namespace is released. ++ * @ns_id namespace id to be released ++ * ++ * Note: This function is called by put_mnt_ns() in the context ++ * of a namespace release. We need to make sure that a lock on ++ * this path is allowed. ++ */ ++void ima_mnt_namespace_dying(unsigned int ns_id) ++{ ++ struct ima_ns_policy *p; ++ ++ spin_lock(&ima_ns_policy_lock); ++ p = radix_tree_delete(&ima_ns_policy_mapping, ns_id); ++ ++ if (!p) { ++ spin_unlock(&ima_ns_policy_lock); ++ return; ++ } ++ ++ free_namespace_policy(p); ++ spin_unlock(&ima_ns_policy_lock); ++} ++ + static ssize_t handle_new_namespace_policy(const char *data, size_t datalen) + { + unsigned int ns_id; +-- +2.9.3 + diff --git a/projects/ima-namespace/kernel/patches-4.11.x/0007-ima-new-namespace-policy-structure-to-track-initial-.patch b/projects/ima-namespace/kernel/patches-4.11.x/0007-ima-new-namespace-policy-structure-to-track-initial-.patch new file mode 100644 index 000000000..e518ece15 --- /dev/null +++ b/projects/ima-namespace/kernel/patches-4.11.x/0007-ima-new-namespace-policy-structure-to-track-initial-.patch @@ -0,0 +1,313 @@ +From ffefef30c066f49ca03045aeb0f92635e998c385 Mon Sep 17 00:00:00 2001 +From: Guilherme Magalhaes +Date: Tue, 9 May 2017 17:04:38 -0300 +Subject: [PATCH 07/11] ima: new namespace policy structure to track initial + namespace policy data + +Adding the global ima_initial_namespace_policy which will be used when the +initial namespace IMA policy data must be referred or when +CONFIG_IMA_PER_NAMESPACE is not defined. +New functions which will be used to retrieve the correct namespace IMA +policy data from the radix tree map or from the ima_initial_namespace_policy. +If the given namespace has not yet defined a private IMA policy, the IMA +policy for that namespace falls back to the initial IMA policy by using +ima_initial_namespace_policy. + +Signed-off-by: Guilherme Magalhaes +--- + security/integrity/ima/ima.h | 6 ++ + security/integrity/ima/ima_fs.c | 112 +++++++++++++++++++++++++++++------- + security/integrity/ima/ima_policy.c | 72 +++++++++++++++++++++++ + 3 files changed, 170 insertions(+), 20 deletions(-) + +diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h +index 1c5c875..20b927e 100644 +--- a/security/integrity/ima/ima.h ++++ b/security/integrity/ima/ima.h +@@ -150,6 +150,7 @@ struct ima_ns_policy { + int ima_appraise; + }; + ++extern struct ima_ns_policy ima_initial_namespace_policy; + #ifdef CONFIG_IMA_PER_NAMESPACE + extern spinlock_t ima_ns_policy_lock; + extern struct radix_tree_root ima_ns_policy_mapping; +@@ -203,6 +204,11 @@ static inline void ima_namespace_unlock(void) { + } + #endif + ++/* IMA namespace function definitions */ ++struct ima_ns_policy *ima_get_current_namespace_policy(void); ++struct ima_ns_policy *ima_get_namespace_policy_from_inode(struct inode *inode); ++struct ima_ns_policy *ima_get_policy_from_namespace(unsigned int ns_id); ++ + /* + * used to protect h_table and sha_table + */ +diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c +index 56ba0ff..61f8da1 100644 +--- a/security/integrity/ima/ima_fs.c ++++ b/security/integrity/ima/ima_fs.c +@@ -274,6 +274,22 @@ static const struct file_operations ima_ascii_measurements_ops = { + .release = seq_release, + }; + ++static struct dentry *ima_dir; ++static struct dentry *binary_runtime_measurements; ++static struct dentry *ascii_runtime_measurements; ++static struct dentry *runtime_measurements_count; ++static struct dentry *violations; ++static struct dentry *ima_policy_initial_ns; ++#ifdef CONFIG_IMA_PER_NAMESPACE ++static struct dentry *ima_namespaces; ++#endif ++ ++enum ima_fs_flags { ++ IMA_FS_BUSY, ++}; ++ ++static unsigned long ima_fs_flags; ++ + #ifdef CONFIG_IMA_PER_NAMESPACE + /* used for namespace policy rules initialization */ + static LIST_HEAD(empty_policy); +@@ -348,6 +364,76 @@ static int check_mntns(unsigned int ns_id) + + return result; + } ++ ++/* ++ * ima_find_namespace_id_from_inode ++ * @policy_inode: the inode of the securityfs policy file for a given ++ * namespace ++ * ++ * Return 0 if the namespace id is not found in ima_ns_policy_mapping ++ */ ++static unsigned int find_namespace_id_from_inode(struct inode *policy_inode) ++{ ++ unsigned int ns_id = 0; ++#ifdef CONFIG_IMA_PER_NAMESPACE ++ struct ima_ns_policy *ins; ++ void **slot; ++ struct radix_tree_iter iter; ++ ++ rcu_read_lock(); ++ radix_tree_for_each_slot(slot, &ima_ns_policy_mapping, &iter, 0) { ++ ins = radix_tree_deref_slot(slot); ++ if (unlikely(!ins)) ++ continue; ++ if (radix_tree_deref_retry(ins)) { ++ slot = radix_tree_iter_retry(&iter); ++ continue; ++ } ++ ++ if (ins->policy_dentry && ins->policy_dentry->d_inode == policy_inode) { ++ ns_id = iter.index; ++ break; ++ } ++ } ++ rcu_read_unlock(); ++#endif ++ ++ return ns_id; ++} ++ ++/* ++ * get_namespace_policy_from_inode - Finds namespace mapping from ++ * securityfs policy file ++ * It is called to get the namespace policy reference when a seurityfs ++ * file such as the namespace or policy files are read or written. ++ * @inode: inode of the securityfs policy file under a namespace ++ * folder ++ * Expects the ima_ns_policy_lock already held ++ * ++ * Returns NULL if the namespace policy reference is not reliable once it ++ * probably was already released after a concurrent namespace release. ++ * Otherwise, the namespace policy reference is returned. ++ */ ++struct ima_ns_policy *ima_get_namespace_policy_from_inode(struct inode *inode) ++{ ++ unsigned int ns_id; ++ struct ima_ns_policy *ins; ++ ++ ns_id = find_namespace_id_from_inode(inode); ++#ifdef CONFIG_IMA_PER_NAMESPACE ++ if (ns_id == 0 && ++ (!ima_policy_initial_ns || inode != ima_policy_initial_ns->d_inode)) { ++ /* ns_id == 0 refers to initial namespace, but inode refers to a ++ * namespaced policy file. It might be a race condition with ++ * namespace release, return invalid reference. */ ++ return NULL; ++ } ++#endif ++ ++ ins = ima_get_policy_from_namespace(ns_id); ++ ++ return ins; ++} + #endif + + static ssize_t ima_read_policy(char *path) +@@ -439,22 +525,6 @@ static ssize_t ima_write_policy(struct file *file, const char __user *buf, + return result; + } + +-static struct dentry *ima_dir; +-static struct dentry *binary_runtime_measurements; +-static struct dentry *ascii_runtime_measurements; +-static struct dentry *runtime_measurements_count; +-static struct dentry *violations; +-static struct dentry *ima_policy; +-#ifdef CONFIG_IMA_PER_NAMESPACE +-static struct dentry *ima_namespaces; +-#endif +- +-enum ima_fs_flags { +- IMA_FS_BUSY, +-}; +- +-static unsigned long ima_fs_flags; +- + #ifdef CONFIG_IMA_READ_POLICY + static const struct seq_operations ima_policy_seqops = { + .start = ima_policy_start, +@@ -517,7 +587,7 @@ static int ima_release_policy(struct inode *inode, struct file *file) + + ima_update_policy(); + #ifndef CONFIG_IMA_WRITE_POLICY +- securityfs_remove(ima_policy); ++ securityfs_remove(ima_policy_initial_ns); + ima_policy = NULL; + #endif + +@@ -539,6 +609,8 @@ static const struct file_operations ima_measure_policy_ops = { + /* + * Assumes namespace id is in use by some process and this mapping + * does not exist in the map table. ++ * @ns_id namespace id ++ * Expects ima_ns_policy_lock already held + */ + static int create_mnt_ns_directory(unsigned int ns_id) + { +@@ -751,10 +823,10 @@ int __init ima_fs_init(void) + if (IS_ERR(violations)) + goto out; + +- ima_policy = securityfs_create_file("policy", POLICY_FILE_FLAGS, ++ ima_policy_initial_ns = securityfs_create_file("policy", POLICY_FILE_FLAGS, + ima_dir, NULL, + &ima_measure_policy_ops); +- if (IS_ERR(ima_policy)) ++ if (IS_ERR(ima_policy_initial_ns)) + goto out; + + #ifdef CONFIG_IMA_PER_NAMESPACE +@@ -772,7 +844,7 @@ int __init ima_fs_init(void) + securityfs_remove(ascii_runtime_measurements); + securityfs_remove(binary_runtime_measurements); + securityfs_remove(ima_dir); +- securityfs_remove(ima_policy); ++ securityfs_remove(ima_policy_initial_ns); + #ifdef CONFIG_IMA_PER_NAMESPACE + securityfs_remove(ima_namespaces); + #endif +diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c +index 2e8c3b7..8c0d4c9 100644 +--- a/security/integrity/ima/ima_policy.c ++++ b/security/integrity/ima/ima_policy.c +@@ -20,6 +20,8 @@ + #include + #include + #include ++#include ++#include + + #include "ima.h" + +@@ -53,6 +55,17 @@ RADIX_TREE(ima_ns_policy_mapping, GFP_ATOMIC); + spinlock_t ima_ns_policy_lock; + #endif + ++/* initial namespace map entry, not added to the ima_ns_policy_mapping ++ * Used as policy fallback for namespaces without policy settings */ ++struct ima_ns_policy ima_initial_namespace_policy = { ++ .policy_dentry = NULL, ++ .ns_dentry = NULL, ++ .ima_rules = NULL, ++ .ima_policy_rules = LIST_HEAD_INIT(ima_initial_namespace_policy.ima_policy_rules), ++ .ima_policy_flag = 0, ++ .ima_appraise = 0 ++ }; ++ + #define MAX_LSM_RULES 6 + enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE, + LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE +@@ -191,6 +204,65 @@ static int __init default_appraise_policy_setup(char *str) + __setup("ima_appraise_tcb", default_appraise_policy_setup); + + /* ++ * ima_get_policy_from_namespace - Finds the ns_id mapping to namespace ++ * policy structure ++ * @ns_id: mount namespace id to look for in the policy mapping tree ++ * ++ * Returns either the given namespace policy data if mapped or the initial ++ * namespace data instead. ++ * ++ * Note that if a namespace has not a specific policy defined, it will ++ * fall back to the initial namespace policy. ++ */ ++struct ima_ns_policy *ima_get_policy_from_namespace(unsigned int ns_id) ++{ ++ struct ima_ns_policy *ins; ++ ++#ifdef CONFIG_IMA_PER_NAMESPACE ++ rcu_read_lock(); ++ ins = radix_tree_lookup(&ima_ns_policy_mapping, ns_id); ++ rcu_read_unlock(); ++ ++ if (!ins) { ++ ins = &ima_initial_namespace_policy; ++ } ++#else ++ ins = &ima_initial_namespace_policy; ++#endif ++ ++ return ins; ++} ++ ++/* ++ * ima_get_current_namespace_policy - Finds the namespace policy mapping ++ * for the current task ++ * This function is called on the context of a syscall and then the namespace ++ * in use will not be released during this context. ++ */ ++struct ima_ns_policy *ima_get_current_namespace_policy(void) ++{ ++ struct ima_ns_policy *ins = NULL; ++#ifdef CONFIG_IMA_PER_NAMESPACE ++ struct ns_common *ns; ++ ++ ns = mntns_operations.get(current); ++ if (ns) { ++ ins = ima_get_policy_from_namespace(ns->inum); ++ mntns_operations.put(ns); ++ } ++ if (!ins || (ins->ima_rules != &ins->ima_policy_rules)) { ++ /* if current namespace has no IMA policy, get the ++ * initial namespace policy */ ++ ins = &ima_initial_namespace_policy; ++ } ++#else ++ ins = &ima_initial_namespace_policy; ++#endif ++ ++ return ins; ++} ++ ++/* + * The LSM policy can be reloaded, leaving the IMA LSM based rules referring + * to the old, stale LSM policy. Update the IMA LSM based rules to reflect + * the reloaded LSM policy. We assume the rules still exist; and BUG_ON() if +-- +2.9.3 + diff --git a/projects/ima-namespace/kernel/patches-4.11.x/0008-ima-block-initial-namespace-id-on-the-namespace-poli.patch b/projects/ima-namespace/kernel/patches-4.11.x/0008-ima-block-initial-namespace-id-on-the-namespace-poli.patch new file mode 100644 index 000000000..85e4cf6f2 --- /dev/null +++ b/projects/ima-namespace/kernel/patches-4.11.x/0008-ima-block-initial-namespace-id-on-the-namespace-poli.patch @@ -0,0 +1,61 @@ +From 0a3ac1bcf03b07940dff18ce29cd05ced91155c0 Mon Sep 17 00:00:00 2001 +From: Guilherme Magalhaes +Date: Tue, 9 May 2017 17:19:57 -0300 +Subject: [PATCH 08/11] ima: block initial namespace id on the namespace policy + interface + +The initial namespace policy is set through the existent interface +in the ima/policy securityfs file. Block the initial namespace +id when it is written to the ima/namespace securityfs file. + +Signed-off-by: Guilherme Magalhaes +--- + security/integrity/ima/ima_fs.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c +index 61f8da1..65c43e7 100644 +--- a/security/integrity/ima/ima_fs.c ++++ b/security/integrity/ima/ima_fs.c +@@ -365,6 +365,16 @@ static int check_mntns(unsigned int ns_id) + return result; + } + ++static unsigned int initial_mntns_id; ++static void get_initial_mntns_id(void) ++{ ++ struct ns_common *ns; ++ ++ ns = mntns_operations.get(&init_task); ++ initial_mntns_id = ns->inum; ++ mntns_operations.put(ns); ++} ++ + /* + * ima_find_namespace_id_from_inode + * @policy_inode: the inode of the securityfs policy file for a given +@@ -699,6 +709,12 @@ static ssize_t handle_new_namespace_policy(const char *data, size_t datalen) + goto out; + } + ++ if (ns_id == initial_mntns_id) { ++ pr_err("IMA: invalid use of the initial mount namespace\n"); ++ result = -EINVAL; ++ goto out; ++ } ++ + ima_namespace_lock(); + if (check_mntns(ns_id)) { + result = -ENOENT; +@@ -835,6 +851,8 @@ int __init ima_fs_init(void) + &ima_namespaces_ops); + if (IS_ERR(ima_namespaces)) + goto out; ++ ++ get_initial_mntns_id(); + #endif + + return 0; +-- +2.9.3 + diff --git a/projects/ima-namespace/kernel/patches-4.11.x/0009-ima-delete-namespace-policy-securityfs-file-in-write.patch b/projects/ima-namespace/kernel/patches-4.11.x/0009-ima-delete-namespace-policy-securityfs-file-in-write.patch new file mode 100644 index 000000000..b1a21dc02 --- /dev/null +++ b/projects/ima-namespace/kernel/patches-4.11.x/0009-ima-delete-namespace-policy-securityfs-file-in-write.patch @@ -0,0 +1,70 @@ +From 825422c8d524f3500b7a09cda2cf39e28b4999ea Mon Sep 17 00:00:00 2001 +From: Guilherme Magalhaes +Date: Tue, 9 May 2017 17:31:22 -0300 +Subject: [PATCH 09/11] ima: delete namespace policy securityfs file in + write-once mode + +When policy file is written and write-once is enabled, the policy file +must be deleted. Select the namespace policy structure to get the correct +policy file descriptor. + +Signed-off-by: Guilherme Magalhaes +--- + security/integrity/ima/ima_fs.c | 27 +++++++++++++++++++++++++-- + 1 file changed, 25 insertions(+), 2 deletions(-) + +diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c +index 65c43e7..94e89fe 100644 +--- a/security/integrity/ima/ima_fs.c ++++ b/security/integrity/ima/ima_fs.c +@@ -575,6 +575,7 @@ static int ima_open_policy(struct inode *inode, struct file *filp) + static int ima_release_policy(struct inode *inode, struct file *file) + { + const char *cause = valid_policy ? "completed" : "failed"; ++ struct ima_ns_policy *ins; + + if ((file->f_flags & O_ACCMODE) == O_RDONLY) + return seq_release(inode, file); +@@ -595,15 +596,37 @@ static int ima_release_policy(struct inode *inode, struct file *file) + return 0; + } + ++ /* get the namespace id from file->inode (policy file inode). ++ * We also need to synchronize this operation with concurrent namespace ++ * releasing. */ ++ ima_namespace_lock(); ++ ins = ima_get_namespace_policy_from_inode(inode); ++ if (!ins) { ++ /* the namespace is not valid anymore, discard new policy ++ * rules and exit */ ++ ima_delete_rules(); ++ valid_policy = 1; ++ clear_bit(IMA_FS_BUSY, &ima_fs_flags); ++ ima_namespace_unlock(); ++ return 0; ++ } ++ + ima_update_policy(); + #ifndef CONFIG_IMA_WRITE_POLICY +- securityfs_remove(ima_policy_initial_ns); +- ima_policy = NULL; ++ if (ins == &ima_initial_namespace_policy) { ++ securityfs_remove(ima_policy_initial_ns); ++ ima_policy_initial_ns = NULL; ++ } else { ++ securityfs_remove(ins->policy_dentry); ++ ins->policy_dentry = NULL; ++ } + #endif + + /* always clear the busy flag so other namespaces can use it */ + clear_bit(IMA_FS_BUSY, &ima_fs_flags); + ++ ima_namespace_unlock(); ++ + return 0; + } + +-- +2.9.3 + diff --git a/projects/ima-namespace/kernel/patches-4.11.x/0010-ima-handling-all-policy-flags-per-namespace-using-im.patch b/projects/ima-namespace/kernel/patches-4.11.x/0010-ima-handling-all-policy-flags-per-namespace-using-im.patch new file mode 100644 index 000000000..b6a6a84f0 --- /dev/null +++ b/projects/ima-namespace/kernel/patches-4.11.x/0010-ima-handling-all-policy-flags-per-namespace-using-im.patch @@ -0,0 +1,689 @@ +From c424a95ccee13d974fa54e92ca50cec5b19a9e94 Mon Sep 17 00:00:00 2001 +From: Guilherme Magalhaes +Date: Tue, 9 May 2017 18:00:55 -0300 +Subject: [PATCH 10/11] ima: handling all policy flags per namespace using + ima_ns_policy structure + +Global ima_appraise still saves the initial appraise mode and it is used to +initialize namespace.ima_appraise flag when a user defined policy is set. +Globals moved into ima_ns_policy structure (namespace IMA policy private data): + - ima_policy_flag + - ima_appraise + - ima_rules + - ima_policy_rules +Functions changed to take as parameter the correct ima_ns_policy structure. +ima_initial_namespace_policy is initialized in ima_init_policy and stores the +initial namespace IMA policy data. +Replacing direct uses of ima_ns_policy lock with the ima_namespace_lock() and +ima_namespace_unlock() functions. + +Signed-off-by: Guilherme Magalhaes +--- + security/integrity/ima/ima.h | 17 +++--- + security/integrity/ima/ima_api.c | 6 +- + security/integrity/ima/ima_appraise.c | 21 +++++-- + security/integrity/ima/ima_fs.c | 26 ++++++--- + security/integrity/ima/ima_init.c | 11 +++- + security/integrity/ima/ima_main.c | 36 ++++++++---- + security/integrity/ima/ima_policy.c | 100 +++++++++++++++++++++++++--------- + 7 files changed, 150 insertions(+), 67 deletions(-) + +diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h +index 20b927e..fd5cfe9 100644 +--- a/security/integrity/ima/ima.h ++++ b/security/integrity/ima/ima.h +@@ -61,9 +61,6 @@ enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 }; + #endif + + +-/* current content of the policy */ +-extern int ima_policy_flag; +- + /* set during initialization */ + extern int ima_initialized; + extern int ima_used_chip; +@@ -149,7 +146,6 @@ struct ima_ns_policy { + int ima_policy_flag; + int ima_appraise; + }; +- + extern struct ima_ns_policy ima_initial_namespace_policy; + #ifdef CONFIG_IMA_PER_NAMESPACE + extern spinlock_t ima_ns_policy_lock; +@@ -241,7 +237,7 @@ enum ima_hooks { + + /* LIM API function definitions */ + int ima_get_action(struct inode *inode, int mask, +- enum ima_hooks func, int *pcr); ++ enum ima_hooks func, int *pcr, struct ima_ns_policy *ins); + int ima_must_measure(struct inode *inode, int mask, enum ima_hooks func); + int ima_collect_measurement(struct integrity_iint_cache *iint, + struct file *file, void *buf, loff_t size, +@@ -262,10 +258,10 @@ const char *ima_d_path(const struct path *path, char **pathbuf, char *filename); + + /* IMA policy related functions */ + int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask, +- int flags, int *pcr); ++ int flags, int *pcr, struct ima_ns_policy *ins); + void ima_init_policy(void); +-void ima_update_policy(void); +-void ima_update_policy_flag(void); ++void ima_update_policy(struct ima_ns_policy *ins); ++void ima_update_policy_flag(struct ima_ns_policy *ins); + ssize_t ima_parse_add_rule(char *); + void ima_delete_rules(void); + void ima_free_policy_rules(struct list_head *policy_rules); +@@ -283,12 +279,13 @@ int ima_policy_show(struct seq_file *m, void *v); + #define IMA_APPRAISE_FIRMWARE 0x10 + #define IMA_APPRAISE_POLICY 0x20 + ++ + #ifdef CONFIG_IMA_APPRAISE + int ima_appraise_measurement(enum ima_hooks func, + struct integrity_iint_cache *iint, + struct file *file, const unsigned char *filename, + struct evm_ima_xattr_data *xattr_value, +- int xattr_len, int opened); ++ int xattr_len, int opened, struct ima_ns_policy *ins); + int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func); + void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file); + enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint, +@@ -304,7 +301,7 @@ static inline int ima_appraise_measurement(enum ima_hooks func, + struct file *file, + const unsigned char *filename, + struct evm_ima_xattr_data *xattr_value, +- int xattr_len, int opened) ++ int xattr_len, int opened, struct ima_ns_policy *ins) + { + return INTEGRITY_UNKNOWN; + } +diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c +index b05c1fd..9aba542 100644 +--- a/security/integrity/ima/ima_api.c ++++ b/security/integrity/ima/ima_api.c +@@ -173,13 +173,13 @@ void ima_add_violation(struct file *file, const unsigned char *filename, + * Returns IMA_MEASURE, IMA_APPRAISE mask. + * + */ +-int ima_get_action(struct inode *inode, int mask, enum ima_hooks func, int *pcr) ++int ima_get_action(struct inode *inode, int mask, enum ima_hooks func, int *pcr, struct ima_ns_policy *ins) + { + int flags = IMA_MEASURE | IMA_AUDIT | IMA_APPRAISE; + +- flags &= ima_policy_flag; ++ flags &= ins->ima_policy_flag; + +- return ima_match_policy(inode, func, mask, flags, pcr); ++ return ima_match_policy(inode, func, mask, flags, pcr, ins); + } + + /* +diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c +index 1fd9539..510bb2f 100644 +--- a/security/integrity/ima/ima_appraise.c ++++ b/security/integrity/ima/ima_appraise.c +@@ -26,6 +26,7 @@ static int __init default_appraise_setup(char *str) + ima_appraise = IMA_APPRAISE_LOG; + else if (strncmp(str, "fix", 3) == 0) + ima_appraise = IMA_APPRAISE_FIX; ++ + return 1; + } + +@@ -38,10 +39,12 @@ __setup("ima_appraise=", default_appraise_setup); + */ + int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func) + { +- if (!ima_appraise) ++ struct ima_ns_policy *ins = ima_get_current_namespace_policy(); ++ ++ if (!ins->ima_appraise) + return 0; + +- return ima_match_policy(inode, func, mask, IMA_APPRAISE, NULL); ++ return ima_match_policy(inode, func, mask, IMA_APPRAISE, NULL, ins); + } + + static int ima_fix_xattr(struct dentry *dentry, +@@ -189,7 +192,7 @@ int ima_appraise_measurement(enum ima_hooks func, + struct integrity_iint_cache *iint, + struct file *file, const unsigned char *filename, + struct evm_ima_xattr_data *xattr_value, +- int xattr_len, int opened) ++ int xattr_len, int opened, struct ima_ns_policy *ins) + { + static const char op[] = "appraise_data"; + char *cause = "unknown"; +@@ -273,7 +276,7 @@ int ima_appraise_measurement(enum ima_hooks func, + + out: + if (status != INTEGRITY_PASS) { +- if ((ima_appraise & IMA_APPRAISE_FIX) && ++ if ((ins->ima_appraise & IMA_APPRAISE_FIX) && + (!xattr_value || + xattr_value->type != EVM_IMA_XATTR_DIGSIG)) { + if (!ima_fix_xattr(dentry, iint)) +@@ -326,8 +329,11 @@ void ima_inode_post_setattr(struct dentry *dentry) + struct inode *inode = d_backing_inode(dentry); + struct integrity_iint_cache *iint; + int must_appraise; ++ struct ima_ns_policy *ins; + +- if (!(ima_policy_flag & IMA_APPRAISE) || !S_ISREG(inode->i_mode) ++ ins = ima_get_current_namespace_policy(); ++ ++ if (!(ins->ima_policy_flag & IMA_APPRAISE) || !S_ISREG(inode->i_mode) + || !(inode->i_opflags & IOP_XATTR)) + return; + +@@ -363,8 +369,11 @@ static int ima_protect_xattr(struct dentry *dentry, const char *xattr_name, + static void ima_reset_appraise_flags(struct inode *inode, int digsig) + { + struct integrity_iint_cache *iint; ++ struct ima_ns_policy *ins; ++ ++ ins = ima_get_current_namespace_policy(); + +- if (!(ima_policy_flag & IMA_APPRAISE) || !S_ISREG(inode->i_mode)) ++ if (!(ins->ima_policy_flag & IMA_APPRAISE) || !S_ISREG(inode->i_mode)) + return; + + iint = integrity_iint_find(inode); +diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c +index 94e89fe..bc18722 100644 +--- a/security/integrity/ima/ima_fs.c ++++ b/security/integrity/ima/ima_fs.c +@@ -308,7 +308,7 @@ static int allocate_namespace_policy(struct ima_ns_policy **ins, + + p->policy_dentry = policy_dentry; + p->ns_dentry = ns_dentry; +- p->ima_appraise = 0; ++ p->ima_appraise = ima_appraise; + p->ima_policy_flag = 0; + INIT_LIST_HEAD(&p->ima_policy_rules); + /* namespace starts with empty rules and not pointing to +@@ -488,6 +488,7 @@ static ssize_t ima_write_policy(struct file *file, const char __user *buf, + { + char *data; + ssize_t result; ++ struct ima_ns_policy *ins; + + if (datalen >= PAGE_SIZE) + datalen = PAGE_SIZE - 1; +@@ -512,19 +513,30 @@ static ssize_t ima_write_policy(struct file *file, const char __user *buf, + if (result < 0) + goto out_free; + ++ ima_namespace_lock(); ++ ins = ima_get_namespace_policy_from_inode(file->f_inode); ++ if (!ins) { ++ /* the namespace is not valid anymore, indicate the error ++ * and exit */ ++ result = -EINVAL; ++ goto out_unlock; ++ } ++ + if (data[0] == '/') { + result = ima_read_policy(data); +- } else if (ima_appraise & IMA_APPRAISE_POLICY) { ++ } else if (ins->ima_appraise & IMA_APPRAISE_POLICY) { + pr_err("IMA: signed policy file (specified as an absolute pathname) required\n"); + integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL, + "policy_update", "signed policy required", + 1, 0); + +- if (ima_appraise & IMA_APPRAISE_ENFORCE) ++ if (ins->ima_appraise & IMA_APPRAISE_ENFORCE) + result = -EACCES; + } else { + result = ima_parse_add_rule(data); + } ++out_unlock: ++ ima_namespace_unlock(); + mutex_unlock(&ima_write_mutex); + out_free: + kfree(data); +@@ -611,7 +623,7 @@ static int ima_release_policy(struct inode *inode, struct file *file) + return 0; + } + +- ima_update_policy(); ++ ima_update_policy(ins); + #ifndef CONFIG_IMA_WRITE_POLICY + if (ins == &ima_initial_namespace_policy) { + securityfs_remove(ima_policy_initial_ns); +@@ -698,16 +710,16 @@ void ima_mnt_namespace_dying(unsigned int ns_id) + { + struct ima_ns_policy *p; + +- spin_lock(&ima_ns_policy_lock); ++ ima_namespace_lock(); + p = radix_tree_delete(&ima_ns_policy_mapping, ns_id); + + if (!p) { +- spin_unlock(&ima_ns_policy_lock); ++ ima_namespace_unlock(); + return; + } + + free_namespace_policy(p); +- spin_unlock(&ima_ns_policy_lock); ++ ima_namespace_unlock(); + } + + static ssize_t handle_new_namespace_policy(const char *data, size_t datalen) +diff --git a/security/integrity/ima/ima_init.c b/security/integrity/ima/ima_init.c +index b557ee3..f0bb196 100644 +--- a/security/integrity/ima/ima_init.c ++++ b/security/integrity/ima/ima_init.c +@@ -96,11 +96,16 @@ static int __init ima_add_boot_aggregate(void) + #ifdef CONFIG_IMA_LOAD_X509 + void __init ima_load_x509(void) + { +- int unset_flags = ima_policy_flag & IMA_APPRAISE; ++ int unset_flags; ++ struct ima_ns_policy *ins; + +- ima_policy_flag &= ~unset_flags; ++ ins = ima_get_current_namespace_policy(); ++ ++ unset_flags = ins->ima_policy_flag & IMA_APPRAISE; ++ ++ ins->ima_policy_flag &= ~unset_flags; + integrity_load_x509(INTEGRITY_KEYRING_IMA, CONFIG_IMA_X509_PATH); +- ima_policy_flag |= unset_flags; ++ ins->ima_policy_flag |= unset_flags; + } + #endif + +diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c +index 2aebb79..1b995bb 100644 +--- a/security/integrity/ima/ima_main.c ++++ b/security/integrity/ima/ima_main.c +@@ -30,6 +30,7 @@ + int ima_initialized; + + #ifdef CONFIG_IMA_APPRAISE ++/* Used during IMA initialization only */ + int ima_appraise = IMA_APPRAISE_ENFORCE; + #else + int ima_appraise; +@@ -144,9 +145,13 @@ void ima_file_free(struct file *file) + { + struct inode *inode = file_inode(file); + struct integrity_iint_cache *iint; ++ struct ima_ns_policy *ins; + +- if (!ima_policy_flag || !S_ISREG(inode->i_mode)) ++ ins = ima_get_current_namespace_policy(); ++ ++ if (!ins->ima_policy_flag || !S_ISREG(inode->i_mode)) { + return; ++ } + + iint = integrity_iint_find(inode); + if (!iint) +@@ -170,17 +175,20 @@ static int process_measurement(struct file *file, char *buf, loff_t size, + int xattr_len = 0; + bool violation_check; + enum hash_algo hash_algo; ++ struct ima_ns_policy *ins; + +- if (!ima_policy_flag || !S_ISREG(inode->i_mode)) ++ ins = ima_get_current_namespace_policy(); ++ ++ if (!ins->ima_policy_flag || !S_ISREG(inode->i_mode)) + return 0; + + /* Return an IMA_MEASURE, IMA_APPRAISE, IMA_AUDIT action + * bitmask based on the appraise/audit/measurement policy. + * Included is the appraise submask. + */ +- action = ima_get_action(inode, mask, func, &pcr); ++ action = ima_get_action(inode, mask, func, &pcr, ins); + violation_check = ((func == FILE_CHECK || func == MMAP_CHECK) && +- (ima_policy_flag & IMA_MEASURE)); ++ (ins->ima_policy_flag & IMA_MEASURE)); + if (!action && !violation_check) + return 0; + +@@ -249,7 +257,7 @@ static int process_measurement(struct file *file, char *buf, loff_t size, + xattr_value, xattr_len, pcr); + if (action & IMA_APPRAISE_SUBMASK) + rc = ima_appraise_measurement(func, iint, file, pathname, +- xattr_value, xattr_len, opened); ++ xattr_value, xattr_len, opened, ins); + if (action & IMA_AUDIT) + ima_audit_measurement(iint, pathname); + +@@ -263,7 +271,7 @@ static int process_measurement(struct file *file, char *buf, loff_t size, + __putname(pathbuf); + out: + inode_unlock(inode); +- if ((rc && must_appraise) && (ima_appraise & IMA_APPRAISE_ENFORCE)) ++ if ((rc && must_appraise) && (ins->ima_appraise & IMA_APPRAISE_ENFORCE)) + return -EACCES; + return 0; + } +@@ -361,8 +369,10 @@ int ima_read_file(struct file *file, enum kernel_read_file_id read_id) + { + if (!file && read_id == READING_MODULE) { + #ifndef CONFIG_MODULE_SIG_FORCE +- if ((ima_appraise & IMA_APPRAISE_MODULES) && +- (ima_appraise & IMA_APPRAISE_ENFORCE)) ++ struct ima_ns_policy *ins; ++ ins = ima_get_current_namespace_policy(); ++ if ((ins->ima_appraise & IMA_APPRAISE_MODULES) && ++ (ins->ima_appraise & IMA_APPRAISE_ENFORCE)) + return -EACCES; /* INTEGRITY_UNKNOWN */ + #endif + return 0; /* We rely on module signature checking */ +@@ -395,10 +405,13 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size, + enum kernel_read_file_id read_id) + { + enum ima_hooks func; ++ struct ima_ns_policy *ins; ++ ++ ins = ima_get_current_namespace_policy(); + + if (!file && read_id == READING_FIRMWARE) { +- if ((ima_appraise & IMA_APPRAISE_FIRMWARE) && +- (ima_appraise & IMA_APPRAISE_ENFORCE)) ++ if ((ins->ima_appraise & IMA_APPRAISE_FIRMWARE) && ++ (ins->ima_appraise & IMA_APPRAISE_ENFORCE)) + return -EACCES; /* INTEGRITY_UNKNOWN */ + return 0; + } +@@ -407,7 +420,7 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size, + return 0; + + if (!file || !buf || size == 0) { /* should never happen */ +- if (ima_appraise & IMA_APPRAISE_ENFORCE) ++ if (ins->ima_appraise & IMA_APPRAISE_ENFORCE) + return -EACCES; + return 0; + } +@@ -425,7 +438,6 @@ static int __init init_ima(void) + error = ima_init(); + if (!error) { + ima_initialized = 1; +- ima_update_policy_flag(); + } + return error; + } +diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c +index 8c0d4c9..4ffb4ad 100644 +--- a/security/integrity/ima/ima_policy.c ++++ b/security/integrity/ima/ima_policy.c +@@ -46,7 +46,7 @@ + #define INVALID_PCR(a) (((a) < 0) || \ + (a) >= (FIELD_SIZEOF(struct integrity_iint_cache, measured_pcrs) * 8)) + +-int ima_policy_flag; ++/* used only during policy initialization and policy change */ + static int temp_ima_appraise; + + #ifdef CONFIG_IMA_PER_NAMESPACE +@@ -66,6 +66,7 @@ struct ima_ns_policy ima_initial_namespace_policy = { + .ima_appraise = 0 + }; + ++ + #define MAX_LSM_RULES 6 + enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE, + LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE +@@ -166,11 +167,12 @@ static struct ima_rule_entry default_appraise_rules[] = { + #endif + }; + ++/* used only during policy setup of the initial namespace */ + static LIST_HEAD(ima_default_rules); +-static LIST_HEAD(ima_policy_rules); ++/* used during policy setting and cleaned up for the next policy setting */ + static LIST_HEAD(ima_temp_rules); +-static struct list_head *ima_rules; + ++/* only used during setup of the initial namespace policy */ + static int ima_policy __initdata; + + static int __init default_measure_policy_setup(char *str) +@@ -268,13 +270,14 @@ struct ima_ns_policy *ima_get_current_namespace_policy(void) + * the reloaded LSM policy. We assume the rules still exist; and BUG_ON() if + * they don't. + */ +-static void ima_lsm_update_rules(void) ++static void ima_lsm_update_rules(struct ima_ns_policy *ins) + { + struct ima_rule_entry *entry; + int result; + int i; + +- list_for_each_entry(entry, &ima_policy_rules, list) { ++ rcu_read_lock(); ++ list_for_each_entry_rcu(entry, &ins->ima_policy_rules, list) { + for (i = 0; i < MAX_LSM_RULES; i++) { + if (!entry->lsm[i].rule) + continue; +@@ -285,6 +288,7 @@ static void ima_lsm_update_rules(void) + BUG_ON(!entry->lsm[i].rule); + } + } ++ rcu_read_unlock(); + } + + /** +@@ -297,7 +301,7 @@ static void ima_lsm_update_rules(void) + * Returns true on rule match, false on failure. + */ + static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, +- enum ima_hooks func, int mask) ++ enum ima_hooks func, int mask, struct ima_ns_policy *ins) + { + struct task_struct *tsk = current; + const struct cred *cred = current_cred(); +@@ -365,7 +369,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, + } + if ((rc < 0) && (!retried)) { + retried = 1; +- ima_lsm_update_rules(); ++ ima_lsm_update_rules(ins); + goto retry; + } + if (!rc) +@@ -412,18 +416,18 @@ static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func) + * than writes so ima_match_policy() is classical RCU candidate. + */ + int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask, +- int flags, int *pcr) ++ int flags, int *pcr, struct ima_ns_policy *ins) + { + struct ima_rule_entry *entry; + int action = 0, actmask = flags | (flags << 1); + + rcu_read_lock(); +- list_for_each_entry_rcu(entry, ima_rules, list) { ++ list_for_each_entry_rcu(entry, ins->ima_rules, list) { + + if (!(entry->action & actmask)) + continue; + +- if (!ima_match_rules(entry, inode, func, mask)) ++ if (!ima_match_rules(entry, inode, func, mask, ins)) + continue; + + action |= entry->flags & IMA_ACTION_FLAGS; +@@ -454,18 +458,20 @@ int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask, + * out of a function or not call the function in the first place + * can be made earlier. + */ +-void ima_update_policy_flag(void) ++void ima_update_policy_flag(struct ima_ns_policy *ins) + { + struct ima_rule_entry *entry; + +- list_for_each_entry(entry, ima_rules, list) { ++ rcu_read_lock(); ++ list_for_each_entry_rcu(entry, ins->ima_rules, list) { + if (entry->action & IMA_DO_MASK) +- ima_policy_flag |= entry->action; ++ ins->ima_policy_flag |= entry->action; + } ++ rcu_read_unlock(); + +- ima_appraise |= temp_ima_appraise; +- if (!ima_appraise) +- ima_policy_flag &= ~IMA_APPRAISE; ++ ins->ima_appraise |= temp_ima_appraise; ++ if (!ins->ima_appraise) ++ ins->ima_policy_flag &= ~IMA_APPRAISE; + } + + /** +@@ -477,6 +483,7 @@ void ima_update_policy_flag(void) + void __init ima_init_policy(void) + { + int i, measure_entries, appraise_entries; ++ struct ima_ns_policy *ins; + + /* if !ima_policy set entries = 0 so we load NO default rules */ + measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0; +@@ -507,8 +514,13 @@ void __init ima_init_policy(void) + temp_ima_appraise |= IMA_APPRAISE_POLICY; + } + +- ima_rules = &ima_default_rules; +- ima_update_policy_flag(); ++ ins = &ima_initial_namespace_policy; ++ ++ ins->ima_rules = &ima_default_rules; ++ ins->ima_appraise = ima_appraise; ++ ++ ima_update_policy_flag(ins); ++ temp_ima_appraise = 0; + } + + /* Make sure we have a valid policy, at least containing some rules. */ +@@ -530,14 +542,14 @@ int ima_check_policy(void) + * Policy rules are never deleted so ima_policy_flag gets zeroed only once when + * we switch from the default policy to user defined. + */ +-void ima_update_policy(void) ++void ima_update_policy(struct ima_ns_policy *ins) + { + struct list_head *first, *last, *policy; + + /* append current policy with the new rules */ + first = (&ima_temp_rules)->next; + last = (&ima_temp_rules)->prev; +- policy = &ima_policy_rules; ++ policy = &ins->ima_policy_rules; + + synchronize_rcu(); + +@@ -549,11 +561,14 @@ void ima_update_policy(void) + /* prepare for the next policy rules addition */ + INIT_LIST_HEAD(&ima_temp_rules); + +- if (ima_rules != policy) { +- ima_policy_flag = 0; +- ima_rules = policy; ++ if (ins->ima_rules != policy) { ++ ins->ima_policy_flag = 0; ++ ins->ima_rules = policy; ++ ins->ima_appraise = ima_appraise; + } +- ima_update_policy_flag(); ++ ++ ima_update_policy_flag(ins); ++ temp_ima_appraise = 0; + } + + enum { +@@ -964,6 +979,7 @@ void ima_free_policy_rules(struct list_head *policy_rules) + void ima_delete_rules(void) + { + temp_ima_appraise = 0; ++ + ima_free_policy_rules(&ima_temp_rules); + } + +@@ -1002,28 +1018,49 @@ void *ima_policy_start(struct seq_file *m, loff_t *pos) + { + loff_t l = *pos; + struct ima_rule_entry *entry; ++ struct ima_ns_policy *ins; ++ ++ ima_namespace_lock(); ++ ins = ima_get_namespace_policy_from_inode(m->file->f_inode); ++ if (!ins) { ++ ima_namespace_unlock(); ++ return NULL; ++ } + + rcu_read_lock(); +- list_for_each_entry_rcu(entry, ima_rules, list) { ++ list_for_each_entry_rcu(entry, ins->ima_rules, list) { + if (!l--) { + rcu_read_unlock(); ++ ima_namespace_unlock(); + return entry; + } + } + rcu_read_unlock(); ++ ima_namespace_unlock(); + return NULL; + } + + void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos) + { + struct ima_rule_entry *entry = v; ++ struct ima_ns_policy *ins; ++ void *p; ++ ++ ima_namespace_lock(); ++ ins = ima_get_namespace_policy_from_inode(m->file->f_inode); ++ if (!ins) { ++ ima_namespace_unlock(); ++ return NULL; ++ } + + rcu_read_lock(); + entry = list_entry_rcu(entry->list.next, struct ima_rule_entry, list); + rcu_read_unlock(); + (*pos)++; + +- return (&entry->list == ima_rules) ? NULL : entry; ++ p = (&entry->list == ins->ima_rules) ? NULL : entry; ++ ima_namespace_unlock(); ++ return p; + } + + void ima_policy_stop(struct seq_file *m, void *v) +@@ -1082,6 +1119,16 @@ int ima_policy_show(struct seq_file *m, void *v) + struct ima_rule_entry *entry = v; + int i; + char tbuf[64] = {0,}; ++ struct ima_ns_policy *ins; ++ ++ ima_namespace_lock(); ++ ins = ima_get_namespace_policy_from_inode(m->file->f_inode); ++ if (!ins) { ++ /* this namespace was release and the policy entry is not valid ++ * anymore */ ++ ima_namespace_unlock(); ++ return 0; ++ } + + rcu_read_lock(); + +@@ -1184,6 +1231,7 @@ int ima_policy_show(struct seq_file *m, void *v) + seq_puts(m, "permit_directio "); + rcu_read_unlock(); + seq_puts(m, "\n"); ++ ima_namespace_unlock(); + return 0; + } + #endif /* CONFIG_IMA_READ_POLICY */ +-- +2.9.3 + diff --git a/projects/ima-namespace/kernel/patches-4.11.x/0011-ima-appraise-mode-per-namespace-with-new-enforce_ns-.patch b/projects/ima-namespace/kernel/patches-4.11.x/0011-ima-appraise-mode-per-namespace-with-new-enforce_ns-.patch new file mode 100644 index 000000000..ebfb3d183 --- /dev/null +++ b/projects/ima-namespace/kernel/patches-4.11.x/0011-ima-appraise-mode-per-namespace-with-new-enforce_ns-.patch @@ -0,0 +1,141 @@ +From c2ef1411f1671f0b5121392e69954977b7a76789 Mon Sep 17 00:00:00 2001 +From: Guilherme Magalhaes +Date: Tue, 9 May 2017 18:04:16 -0300 +Subject: [PATCH 11/11] ima: appraise mode per namespace with new enforce_ns + appraise mode + +Global ima_appraise renamed to ima_appraise_mode and it saves the initial +appraise mode. It is used to initialize the ima_appraise ima_ns_policy field +when the policy is defined by user the first time for a namespace. +New 'enforce_ns' appraise mode created. On this new appraise mode, the initial +appraise mode works in 'enforce' mode, but for new namespaces the appraise +mode is set to 'fix' until a policy is defined for the new namespace and then +the appraise mode is automatically set to 'enforce'. +This new mode is useful to keep the initial namespace appraise mode clearly in +'enforce' mode while namespaces can set their appraise modes separatedly. + +Signed-off-by: Guilherme Magalhaes +--- + security/integrity/ima/ima.h | 6 +++++- + security/integrity/ima/ima_appraise.c | 11 +++++++---- + security/integrity/ima/ima_fs.c | 7 ++++++- + security/integrity/ima/ima_main.c | 4 ++-- + security/integrity/ima/ima_policy.c | 13 +++++++++++-- + 5 files changed, 31 insertions(+), 10 deletions(-) + +diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h +index fd5cfe9..9d451fd 100644 +--- a/security/integrity/ima/ima.h ++++ b/security/integrity/ima/ima.h +@@ -65,7 +65,7 @@ enum tpm_pcrs { TPM_PCR0 = 0, TPM_PCR8 = 8 }; + extern int ima_initialized; + extern int ima_used_chip; + extern int ima_hash_algo; +-extern int ima_appraise; ++extern int ima_appraise_mode; + + /* IMA event related data */ + struct ima_event_data { +@@ -278,6 +278,10 @@ int ima_policy_show(struct seq_file *m, void *v); + #define IMA_APPRAISE_MODULES 0x08 + #define IMA_APPRAISE_FIRMWARE 0x10 + #define IMA_APPRAISE_POLICY 0x20 ++#ifdef CONFIG_IMA_PER_NAMESPACE ++#define IMA_APPRAISE_NAMESPACE 0x40 ++#define IMA_APPRAISE_ENFORCE_NS (IMA_APPRAISE_ENFORCE | IMA_APPRAISE_NAMESPACE) ++#endif + + + #ifdef CONFIG_IMA_APPRAISE +diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c +index 510bb2f..4b94c2a 100644 +--- a/security/integrity/ima/ima_appraise.c ++++ b/security/integrity/ima/ima_appraise.c +@@ -21,12 +21,15 @@ + static int __init default_appraise_setup(char *str) + { + if (strncmp(str, "off", 3) == 0) +- ima_appraise = 0; ++ ima_appraise_mode = 0; + else if (strncmp(str, "log", 3) == 0) +- ima_appraise = IMA_APPRAISE_LOG; ++ ima_appraise_mode = IMA_APPRAISE_LOG; + else if (strncmp(str, "fix", 3) == 0) +- ima_appraise = IMA_APPRAISE_FIX; +- ++ ima_appraise_mode = IMA_APPRAISE_FIX; ++#ifdef CONFIG_IMA_PER_NAMESPACE ++ else if (strncmp(str, "enforce_ns", 10) == 0) ++ ima_appraise_mode = IMA_APPRAISE_ENFORCE_NS; ++#endif + return 1; + } + +diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c +index bc18722..91cafb5 100644 +--- a/security/integrity/ima/ima_fs.c ++++ b/security/integrity/ima/ima_fs.c +@@ -308,7 +308,12 @@ static int allocate_namespace_policy(struct ima_ns_policy **ins, + + p->policy_dentry = policy_dentry; + p->ns_dentry = ns_dentry; +- p->ima_appraise = ima_appraise; ++ if (ima_appraise_mode == IMA_APPRAISE_ENFORCE_NS) ++ /* For now, on the enforce_ns mode, a new namespace starts in ++ * fix mode */ ++ p->ima_appraise = IMA_APPRAISE_FIX; ++ else ++ p->ima_appraise = ima_appraise_mode; + p->ima_policy_flag = 0; + INIT_LIST_HEAD(&p->ima_policy_rules); + /* namespace starts with empty rules and not pointing to +diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c +index 1b995bb..1938c74 100644 +--- a/security/integrity/ima/ima_main.c ++++ b/security/integrity/ima/ima_main.c +@@ -31,9 +31,9 @@ int ima_initialized; + + #ifdef CONFIG_IMA_APPRAISE + /* Used during IMA initialization only */ +-int ima_appraise = IMA_APPRAISE_ENFORCE; ++int ima_appraise_mode = IMA_APPRAISE_ENFORCE; + #else +-int ima_appraise; ++int ima_appraise_mode; + #endif + + int ima_hash_algo = HASH_ALGO_SHA1; +diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c +index 4ffb4ad..bd67a08 100644 +--- a/security/integrity/ima/ima_policy.c ++++ b/security/integrity/ima/ima_policy.c +@@ -517,7 +517,7 @@ void __init ima_init_policy(void) + ins = &ima_initial_namespace_policy; + + ins->ima_rules = &ima_default_rules; +- ins->ima_appraise = ima_appraise; ++ ins->ima_appraise = ima_appraise_mode; + + ima_update_policy_flag(ins); + temp_ima_appraise = 0; +@@ -564,7 +564,16 @@ void ima_update_policy(struct ima_ns_policy *ins) + if (ins->ima_rules != policy) { + ins->ima_policy_flag = 0; + ins->ima_rules = policy; +- ins->ima_appraise = ima_appraise; ++ ins->ima_appraise = ima_appraise_mode; ++#ifdef CONFIG_IMA_PER_NAMESPACE ++ if (ins != &ima_initial_namespace_policy && ++ ima_appraise_mode == IMA_APPRAISE_ENFORCE_NS) { ++ /* For now, on the enforce_ns mode, switch to enforce mode ++ * when new policy is set for a namespace and for the first ++ * time */ ++ ins->ima_appraise = IMA_APPRAISE_ENFORCE; ++ } ++#endif + } + + ima_update_policy_flag(ins); +-- +2.9.3 +