Development June 2020

development@lists.ipfire.org

10 participants
81 discussions

[PATCH] kernel: enable CONFIG_SLUB_DEBUG on aarch64 and armv5tel
by Peter Müller 11 Jun '20

11 Jun '20

Fixes: #12377 Cc: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 2 +- config/kernel/kernel.config.armv5tel-ipfire-multi | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index e0f2f6df8..35f071bda 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -211,7 +211,7 @@ CONFIG_HAVE_PERF_EVENTS=y CONFIG_PERF_EVENTS=y # CONFIG_DEBUG_PERF_USE_VMALLOC is not set CONFIG_VM_EVENT_COUNTERS=y -# CONFIG_SLUB_DEBUG is not set +CONFIG_SLUB_DEBUG=y # CONFIG_SLUB_MEMCG_SYSFS_ON is not set # CONFIG_COMPAT_BRK is not set # CONFIG_SLAB is not set diff --git a/config/kernel/kernel.config.armv5tel-ipfire-multi b/config/kernel/kernel.config.armv5tel-ipfire-multi index 15183300f..762963351 100644 --- a/config/kernel/kernel.config.armv5tel-ipfire-multi +++ b/config/kernel/kernel.config.armv5tel-ipfire-multi @@ -208,7 +208,7 @@ CONFIG_PERF_USE_VMALLOC=y CONFIG_PERF_EVENTS=y # CONFIG_DEBUG_PERF_USE_VMALLOC is not set CONFIG_VM_EVENT_COUNTERS=y -# CONFIG_SLUB_DEBUG is not set +CONFIG_SLUB_DEBUG=y # CONFIG_SLUB_MEMCG_SYSFS_ON is not set # CONFIG_COMPAT_BRK is not set # CONFIG_SLAB is not set -- 2.26.2

2 1

[PATCH] kernel: enable CONFIG_FORTIFY_SOUCRE on aarch64
by Peter Müller 11 Jun '20

11 Jun '20

Partially fixes: #12369 Cc: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index e0f2f6df8..1e6c89b6c 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -6543,7 +6543,7 @@ CONFIG_SECURITY_NETWORK_XFRM=y CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y CONFIG_HARDENED_USERCOPY=y CONFIG_HARDENED_USERCOPY_PAGESPAN=y -# CONFIG_FORTIFY_SOURCE is not set +CONFIG_FORTIFY_SOURCE=y # CONFIG_STATIC_USERMODEHELPER is not set # CONFIG_SECURITY_SMACK is not set # CONFIG_SECURITY_TOMOYO is not set -- 2.26.2

2 1

Work in progress
by Matthias Fischer 10 Jun '20

10 Jun '20

Hi, FYI: Just building: squid 4.12 At work: gnutls 3.6.14 gmp 6.2.0 borgbackup 1.1.13 Just in case that someone is working at these updates, too. Unfortunately I'm not 100% sure about the gmp-rootfiles for the different architectures. Otherwise I would upload these updates within the next days. Opinions? Best, Matthias

2 2

[PATCH] kernel: disable CONFIG_UPROBES
by Peter Müller 10 Jun '20

10 Jun '20

Quoted from #12433: > Uprobes is the user-space counterpart to kprobes: they enable instrumentation > applications (such as 'perf probe') to establish unintrusive probes in > user-space binaries and libraries, by executing handler functions when the > probes are hit by user-space applications. > > ( These probes come in the form of single-byte breakpoints, managed by the > kernel and kept transparent to the probed application. ) IMHO this can be safely disabled, as there is little if any need to debug userspace programs _that_ deeply on an IPFire machine. Fixes: #12433 Cc: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 2 +- config/kernel/kernel.config.armv5tel-ipfire-multi | 2 +- config/kernel/kernel.config.i586-ipfire | 2 +- config/kernel/kernel.config.x86_64-ipfire | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index e0f2f6df8..b746fe428 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -227,7 +227,7 @@ CONFIG_TRACEPOINTS=y # CONFIG_KPROBES is not set CONFIG_JUMP_LABEL=y CONFIG_STATIC_KEYS_SELFTEST=y -CONFIG_UPROBES=y +# CONFIG_UPROBES is not set # CONFIG_HAVE_64BIT_ALIGNED_ACCESS is not set CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y CONFIG_HAVE_KPROBES=y diff --git a/config/kernel/kernel.config.armv5tel-ipfire-multi b/config/kernel/kernel.config.armv5tel-ipfire-multi index 15183300f..858cd0109 100644 --- a/config/kernel/kernel.config.armv5tel-ipfire-multi +++ b/config/kernel/kernel.config.armv5tel-ipfire-multi @@ -225,7 +225,7 @@ CONFIG_HAVE_OPROFILE=y # CONFIG_KPROBES is not set CONFIG_JUMP_LABEL=y CONFIG_STATIC_KEYS_SELFTEST=y -CONFIG_UPROBES=y +# CONFIG_UPROBES is not set # CONFIG_HAVE_64BIT_ALIGNED_ACCESS is not set CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y CONFIG_ARCH_USE_BUILTIN_BSWAP=y diff --git a/config/kernel/kernel.config.i586-ipfire b/config/kernel/kernel.config.i586-ipfire index 578931497..32a5f5544 100644 --- a/config/kernel/kernel.config.i586-ipfire +++ b/config/kernel/kernel.config.i586-ipfire @@ -242,7 +242,7 @@ CONFIG_OPROFILE_NMI_TIMER=y # CONFIG_KPROBES is not set CONFIG_JUMP_LABEL=y CONFIG_STATIC_KEYS_SELFTEST=y -CONFIG_UPROBES=y +# CONFIG_UPROBES is not set # CONFIG_HAVE_64BIT_ALIGNED_ACCESS is not set CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y CONFIG_ARCH_USE_BUILTIN_BSWAP=y diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 6a5fbbfe9..666a76597 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -251,7 +251,7 @@ CONFIG_OPROFILE_NMI_TIMER=y # CONFIG_KPROBES is not set CONFIG_JUMP_LABEL=y CONFIG_STATIC_KEYS_SELFTEST=y -CONFIG_UPROBES=y +# CONFIG_UPROBES is not set # CONFIG_HAVE_64BIT_ALIGNED_ACCESS is not set CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y CONFIG_ARCH_USE_BUILTIN_BSWAP=y -- 2.26.2

2 1

[PATCH] debian: Also build for sid.
by Stefan Schantl 10 Jun '20

10 Jun '20

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- debian/build.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian/build.sh b/debian/build.sh index 449e3a5..4385455 100644 --- a/debian/build.sh +++ b/debian/build.sh @@ -1,7 +1,7 @@ #!/bin/bash ARCHITECTURES=( amd64 arm64 i386 armhf ) -RELEASES=( buster bullseye ) +RELEASES=( buster bullseye sid ) CHROOT_PATH="/var/tmp" -- 2.26.1

1 0

[PATCH 1/2] kernel: enable CONFIG_SECURITY_LOADPIN
by Peter Müller 10 Jun '20

10 Jun '20

Quoted from #12432: > For every boot, any file read through the kernel file reading interface can > be pinned to the first filesystem used for loading. If you try to load any > file that comes from other filesystem will be rejected. IMHO this can be safely enabled as there is no legitimate reason to swap filesystems on an IPFire machine during runtime. Partially fixes: #12432 Cc: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 2 +- config/kernel/kernel.config.armv5tel-ipfire-multi | 2 +- config/kernel/kernel.config.i586-ipfire | 2 +- config/kernel/kernel.config.x86_64-ipfire | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index e0f2f6df8..62b518977 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -6548,7 +6548,7 @@ CONFIG_HARDENED_USERCOPY_PAGESPAN=y # CONFIG_SECURITY_SMACK is not set # CONFIG_SECURITY_TOMOYO is not set # CONFIG_SECURITY_APPARMOR is not set -# CONFIG_SECURITY_LOADPIN is not set +CONFIG_SECURITY_LOADPIN=y # CONFIG_SECURITY_YAMA is not set CONFIG_INTEGRITY=y # CONFIG_INTEGRITY_SIGNATURE is not set diff --git a/config/kernel/kernel.config.armv5tel-ipfire-multi b/config/kernel/kernel.config.armv5tel-ipfire-multi index 15183300f..4e0ca0460 100644 --- a/config/kernel/kernel.config.armv5tel-ipfire-multi +++ b/config/kernel/kernel.config.armv5tel-ipfire-multi @@ -7030,7 +7030,7 @@ CONFIG_HARDENED_USERCOPY_PAGESPAN=y # CONFIG_SECURITY_SMACK is not set # CONFIG_SECURITY_TOMOYO is not set # CONFIG_SECURITY_APPARMOR is not set -# CONFIG_SECURITY_LOADPIN is not set +CONFIG_SECURITY_LOADPIN=y # CONFIG_SECURITY_YAMA is not set CONFIG_INTEGRITY=y # CONFIG_INTEGRITY_SIGNATURE is not set diff --git a/config/kernel/kernel.config.i586-ipfire b/config/kernel/kernel.config.i586-ipfire index 578931497..096ef6141 100644 --- a/config/kernel/kernel.config.i586-ipfire +++ b/config/kernel/kernel.config.i586-ipfire @@ -6694,7 +6694,7 @@ CONFIG_FORTIFY_SOURCE=y # CONFIG_SECURITY_SMACK is not set # CONFIG_SECURITY_TOMOYO is not set # CONFIG_SECURITY_APPARMOR is not set -# CONFIG_SECURITY_LOADPIN is not set +CONFIG_SECURITY_LOADPIN=y # CONFIG_SECURITY_YAMA is not set CONFIG_INTEGRITY=y # CONFIG_INTEGRITY_SIGNATURE is not set diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 6a5fbbfe9..841a45bd0 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -6560,7 +6560,7 @@ CONFIG_FORTIFY_SOURCE=y # CONFIG_SECURITY_SMACK is not set # CONFIG_SECURITY_TOMOYO is not set # CONFIG_SECURITY_APPARMOR is not set -# CONFIG_SECURITY_LOADPIN is not set +CONFIG_SECURITY_LOADPIN=y # CONFIG_SECURITY_YAMA is not set CONFIG_INTEGRITY=y # CONFIG_INTEGRITY_SIGNATURE is not set -- 2.26.2

2 2

[PATCH 1/3] kernel: enable CONFIG_SECURITY_LOCKDOWN_LSM
by Peter Müller 10 Jun '20

10 Jun '20

Partially fixes: #12431 Cc: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 1 + config/kernel/kernel.config.armv5tel-ipfire-multi | 1 + config/kernel/kernel.config.i586-ipfire | 1 + config/kernel/kernel.config.x86_64-ipfire | 1 + 4 files changed, 4 insertions(+) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index e0f2f6df8..5d51730f8 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -6563,6 +6563,7 @@ CONFIG_ASYNC_XOR=m CONFIG_ASYNC_PQ=m CONFIG_ASYNC_RAID6_RECOV=m CONFIG_CRYPTO=y +CONFIG_SECURITY_LOCKDOWN_LSM=y # # Crypto core or helper diff --git a/config/kernel/kernel.config.armv5tel-ipfire-multi b/config/kernel/kernel.config.armv5tel-ipfire-multi index 15183300f..f5627ba31 100644 --- a/config/kernel/kernel.config.armv5tel-ipfire-multi +++ b/config/kernel/kernel.config.armv5tel-ipfire-multi @@ -7045,6 +7045,7 @@ CONFIG_ASYNC_XOR=m CONFIG_ASYNC_PQ=m CONFIG_ASYNC_RAID6_RECOV=m CONFIG_CRYPTO=y +CONFIG_SECURITY_LOCKDOWN_LSM=y # # Crypto core or helper diff --git a/config/kernel/kernel.config.i586-ipfire b/config/kernel/kernel.config.i586-ipfire index 578931497..57b205ef3 100644 --- a/config/kernel/kernel.config.i586-ipfire +++ b/config/kernel/kernel.config.i586-ipfire @@ -6709,6 +6709,7 @@ CONFIG_ASYNC_XOR=m CONFIG_ASYNC_PQ=m CONFIG_ASYNC_RAID6_RECOV=m CONFIG_CRYPTO=y +CONFIG_SECURITY_LOCKDOWN_LSM=y # # Crypto core or helper diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 6a5fbbfe9..840995bfe 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -6575,6 +6575,7 @@ CONFIG_ASYNC_XOR=m CONFIG_ASYNC_PQ=m CONFIG_ASYNC_RAID6_RECOV=m CONFIG_CRYPTO=y +CONFIG_SECURITY_LOCKDOWN_LSM=y # # Crypto core or helper -- 2.26.2

2 3

[PATCH] kernel: enable CONFIG_X86_INTEL_UMIP on x86_64
by Peter Müller 10 Jun '20

10 Jun '20

Quoted from https://capsule8.com/blog/kernel-configuration-glossary/: > Significance: High > > The User Mode Instruction Prevention (UMIP) is a security feature in newer > Intel processors. If enabled a general protection fault is issued if the SGDT > SLDT SIDT SMSW or STR instructions are executed in user mode. These > instructions unnecessarily expose information about the hardware state. Personally, I do not like Intel's "hardware security features" as they often turned out as being difficult to handle, to implement and completely useless or even contraproductive at the end of the day (SGX? Why, did anyone mentioned SGX?!). Anyway, here we go... Fixes: #12367 Cc: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org> Cc: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.x86_64-ipfire | 1 + 1 file changed, 1 insertion(+) diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 6a5fbbfe9..f37b4b5d4 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -459,6 +459,7 @@ CONFIG_X86_EXTENDED_PLATFORM=y # CONFIG_X86_GOLDFISH is not set # CONFIG_X86_INTEL_MID is not set CONFIG_X86_INTEL_LPSS=y +CONFIG_X86_INTEL_UMIP=y CONFIG_X86_AMD_PLATFORM_DEVICE=y CONFIG_IOSF_MBI=y # CONFIG_IOSF_MBI_DEBUG is not set -- 2.26.2

2 1

[PATCH] kernel: enable CONFIG_GCC_PLUGIN_STACKLEAK
by Peter Müller 10 Jun '20

10 Jun '20

Quoted from https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommend…: > # Wipe stack contents on syscall exit (reduces stale data lifetime in stack) > CONFIG_GCC_PLUGIN_STACKLEAK=y Not sure what performance penalities this introduces in real life... Fixes: #12382 Cc: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 1 + config/kernel/kernel.config.armv5tel-ipfire-multi | 1 + config/kernel/kernel.config.i586-ipfire | 1 + config/kernel/kernel.config.x86_64-ipfire | 1 + 4 files changed, 4 insertions(+) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index e0f2f6df8..f4240e0ae 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -256,6 +256,7 @@ CONFIG_HAVE_GCC_PLUGINS=y CONFIG_GCC_PLUGINS=y # CONFIG_GCC_PLUGIN_CYC_COMPLEXITY is not set CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y +CONFIG_GCC_PLUGIN_STACKLEAK=y CONFIG_GCC_PLUGIN_STRUCTLEAK=y CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y # CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE is not set diff --git a/config/kernel/kernel.config.armv5tel-ipfire-multi b/config/kernel/kernel.config.armv5tel-ipfire-multi index 15183300f..2bcfbdbdd 100644 --- a/config/kernel/kernel.config.armv5tel-ipfire-multi +++ b/config/kernel/kernel.config.armv5tel-ipfire-multi @@ -252,6 +252,7 @@ CONFIG_HAVE_GCC_PLUGINS=y CONFIG_GCC_PLUGINS=y # CONFIG_GCC_PLUGIN_CYC_COMPLEXITY is not set CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y +CONFIG_GCC_PLUGIN_STACKLEAK=y CONFIG_GCC_PLUGIN_STRUCTLEAK=y CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y # CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE is not set diff --git a/config/kernel/kernel.config.i586-ipfire b/config/kernel/kernel.config.i586-ipfire index 578931497..a72cde41a 100644 --- a/config/kernel/kernel.config.i586-ipfire +++ b/config/kernel/kernel.config.i586-ipfire @@ -283,6 +283,7 @@ CONFIG_HAVE_GCC_PLUGINS=y CONFIG_GCC_PLUGINS=y # CONFIG_GCC_PLUGIN_CYC_COMPLEXITY is not set CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y +CONFIG_GCC_PLUGIN_STACKLEAK=y CONFIG_GCC_PLUGIN_STRUCTLEAK=y CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y # CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE is not set diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 6a5fbbfe9..cd116d780 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -293,6 +293,7 @@ CONFIG_HAVE_GCC_PLUGINS=y CONFIG_GCC_PLUGINS=y # CONFIG_GCC_PLUGIN_CYC_COMPLEXITY is not set CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y +CONFIG_GCC_PLUGIN_STACKLEAK=y CONFIG_GCC_PLUGIN_STRUCTLEAK=y CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y # CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE is not set -- 2.26.2

3 2

[PATCH] kernel: enable CONFIG_RANDOMIZE_MEMORY on i586 aarch64 and, armv5tel
by Peter Müller 10 Jun '20

10 Jun '20

Fixes: #12364 Cc: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 2 ++ config/kernel/kernel.config.armv5tel-ipfire-multi | 2 ++ config/kernel/kernel.config.i586-ipfire | 2 ++ 3 files changed, 6 insertions(+) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index e0f2f6df8..b3c397a3c 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -519,6 +519,8 @@ CONFIG_ARM64_VA_BITS=39 CONFIG_SCHED_MC=y CONFIG_SCHED_SMT=y CONFIG_NR_CPUS=8 +CONFIG_RANDOMIZE_MEMORY=y +CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING=0x0 CONFIG_HOTPLUG_CPU=y # CONFIG_NUMA is not set CONFIG_HOLES_IN_ZONE=y diff --git a/config/kernel/kernel.config.armv5tel-ipfire-multi b/config/kernel/kernel.config.armv5tel-ipfire-multi index 15183300f..a314baa73 100644 --- a/config/kernel/kernel.config.armv5tel-ipfire-multi +++ b/config/kernel/kernel.config.armv5tel-ipfire-multi @@ -776,6 +776,8 @@ CONFIG_VMSPLIT_3G=y # CONFIG_VMSPLIT_1G is not set CONFIG_PAGE_OFFSET=0xC0000000 CONFIG_NR_CPUS=8 +CONFIG_RANDOMIZE_MEMORY=y +CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING=0x0 CONFIG_HOTPLUG_CPU=y CONFIG_ARM_PSCI=y CONFIG_ARCH_NR_GPIO=512 diff --git a/config/kernel/kernel.config.i586-ipfire b/config/kernel/kernel.config.i586-ipfire index 578931497..a86a76c05 100644 --- a/config/kernel/kernel.config.i586-ipfire +++ b/config/kernel/kernel.config.i586-ipfire @@ -628,6 +628,8 @@ CONFIG_RELOCATABLE=y CONFIG_RANDOMIZE_BASE=y CONFIG_X86_NEED_RELOCS=y CONFIG_PHYSICAL_ALIGN=0x400000 +CONFIG_RANDOMIZE_MEMORY=y +CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING=0x0 CONFIG_HOTPLUG_CPU=y # CONFIG_BOOTPARAM_HOTPLUG_CPU0 is not set # CONFIG_DEBUG_HOTPLUG_CPU0 is not set -- 2.26.2

2 1

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development June 2020