kernel December 2024

kernel@lists.fedoraproject.org

5 participants
4 discussions

Request For Insights On Kernel Security Hardening Practices In Fedora
by Yinhao Hu 19 Dec '24

19 Dec '24

Dear All, We are academic researchers from Huazhong University of Science and Technology, China. To foster a healthier Linux kernel community and enhance the overall security of Linux distributions, we are conducting a study on kernel security hardening deployments across various Linux distributions. In our research, we analyzed kernel config files and the /proc filesystem by installing and running multiple distribution ISO images. This allowed us to enumerate the default deployment of kernel defense mechanisms at runtime. So far, we have cataloged over 50 kernel security hardening features and documented inconsistencies in their deployment across different distributions. The results of our analysis are accessible via the following link: https://docs.google.com/spreadsheets/d/17QRr04pqK1K4-VoHXW2-9KgPd4uV8Q4I-NN…. Given Fedora’s reputation for exceptional performance and rich features, we conducted a detailed investigation into its kernel security hardening strategies. To further deepen our understanding, we would greatly appreciate your input on the following questions: 1. Effectiveness of Kernel Security Hardening 1.1 Do you consider deploying kernel security hardening features to be an effective strategy for ensuring operating system security? 2. Configuration Strategy for Default Kernel Security Hardening Options 2.1 What are the primary criteria for selecting kernel security hardening options in your distribution? 2.2 How are configurable security hardening features (e.g., unprivileged_bpf_disabled) typically set (e.g., 0, 1, or 2), and what are the main considerations involved? 2.3 How do you balance the trade-off between side-effects (e.g., performance overhead) and the enhanced security introduced by kernel security hardening? 2.4 Does the tolerance for performance overhead vary across different application scenarios? 2.5 Are there other negative factors, such as compatibility issues, that are considered when enabling security hardening features? 3. Customized Configurations 3.1 Do you provide different kernel security hardening configurations tailored to specific user groups? 4. Best Practices and Recommendations 4.1 Are there any best practices or recommendations you can share regarding kernel security hardening? 4.2 Are there relevant documents or materials available for reference? The purpose of these questions is to gain a deeper understanding of your security protection strategies. Your insights would be immensely valuable to our study. Thank you for taking the time to review our questions. We look forward to your response. Best regards, Yinhao Hu, PhD candidate huyinhaodd(a)gmail.com Huazhong University of Science and Technology

3 4

[OS-BUILD PATCHv2] [redhat] configs: Compress kernel with zstd cleanup
by Jeremy Linton (via Email Bridge) 13 Dec '24

13 Dec '24

From: Jeremy Linton <jlinton(a)redhat.com> [redhat] configs: Compress kernel with zstd cleanup Zstd compressed kernels consume less disk space and decompress faster than gziped ones. For example, kernel 6.12rc3 aarch64's on disk size is ~22% smaller and boots ~16% faster on a RPi4. Since this was already on for some x86 flavors, lets propogate the setting to all appropriate architectures and kernel flavors. Signed-off-by: Jeremy Linton <jlinton(a)redhat.com> diff --git a/redhat/configs/common/generic/CONFIG_KERNEL_GZIP b/redhat/configs/common/generic/CONFIG_KERNEL_GZIP index blahblah..blahblah 100644 --- a/redhat/configs/common/generic/CONFIG_KERNEL_GZIP +++ b/redhat/configs/common/generic/CONFIG_KERNEL_GZIP @@ -1 +1 @@ -CONFIG_KERNEL_GZIP=y +# CONFIG_KERNEL_GZIP is not set diff --git a/redhat/configs/fedora/generic/CONFIG_KERNEL_UNCOMPRESSED b/redhat/configs/common/generic/CONFIG_KERNEL_UNCOMPRESSED rename from redhat/configs/fedora/generic/CONFIG_KERNEL_UNCOMPRESSED rename to redhat/configs/common/generic/CONFIG_KERNEL_UNCOMPRESSED index blahblah..blahblah 100644 --- a/redhat/configs/fedora/generic/CONFIG_KERNEL_UNCOMPRESSED +++ b/redhat/configs/common/generic/CONFIG_KERNEL_UNCOMPRESSED diff --git a/redhat/configs/common/generic/CONFIG_KERNEL_ZSTD b/redhat/configs/common/generic/CONFIG_KERNEL_ZSTD index blahblah..blahblah 100644 --- a/redhat/configs/common/generic/CONFIG_KERNEL_ZSTD +++ b/redhat/configs/common/generic/CONFIG_KERNEL_ZSTD @@ -1 +1 @@ -# CONFIG_KERNEL_ZSTD is not set +CONFIG_KERNEL_ZSTD=y diff --git a/redhat/configs/common/generic/powerpc/CONFIG_KERNEL_GZIP b/redhat/configs/common/generic/powerpc/CONFIG_KERNEL_GZIP new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/powerpc/CONFIG_KERNEL_GZIP @@ -0,0 +1 @@ +CONFIG_KERNEL_GZIP=y diff --git a/redhat/configs/common/generic/s390x/CONFIG_KERNEL_GZIP b/redhat/configs/common/generic/s390x/CONFIG_KERNEL_GZIP new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/s390x/CONFIG_KERNEL_GZIP @@ -0,0 +1 @@ +CONFIG_KERNEL_GZIP=y diff --git a/redhat/configs/common/generic/s390x/CONFIG_KERNEL_ZSTD b/redhat/configs/common/generic/s390x/CONFIG_KERNEL_ZSTD new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/s390x/CONFIG_KERNEL_ZSTD @@ -0,0 +1 @@ +# CONFIG_KERNEL_ZSTD is not set diff --git a/redhat/configs/fedora/generic/x86/CONFIG_KERNEL_GZIP b/redhat/configs/fedora/generic/x86/CONFIG_KERNEL_GZIP deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/configs/fedora/generic/x86/CONFIG_KERNEL_GZIP +++ /dev/null @@ -1 +0,0 @@ -# CONFIG_KERNEL_GZIP is not set diff --git a/redhat/configs/fedora/generic/x86/CONFIG_KERNEL_ZSTD b/redhat/configs/fedora/generic/x86/CONFIG_KERNEL_ZSTD deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/configs/fedora/generic/x86/CONFIG_KERNEL_ZSTD +++ /dev/null @@ -1 +0,0 @@ -CONFIG_KERNEL_ZSTD=y diff --git a/redhat/configs/rhel/generic/s390x/CONFIG_KERNEL_UNCOMPRESSED b/redhat/configs/rhel/generic/s390x/CONFIG_KERNEL_UNCOMPRESSED deleted file mode 100644 index blahblah..blahblah 0 --- a/redhat/configs/rhel/generic/s390x/CONFIG_KERNEL_UNCOMPRESSED +++ /dev/null @@ -1 +0,0 @@ -# CONFIG_KERNEL_UNCOMPRESSED is not set diff --git a/redhat/kernel.spec.template b/redhat/kernel.spec.template index blahblah..blahblah 100644 --- a/redhat/kernel.spec.template +++ b/redhat/kernel.spec.template @@ -673,6 +673,8 @@ Provides: installonlypkg(kernel) # BuildRequires: kmod, bash, coreutils, tar, git-core, which BuildRequires: bzip2, xz, findutils, m4, perl-interpreter, perl-Carp, perl-devel, perl-generators, make, diffutils, gawk, %compression +# Kernel EFI/Compression set by CONFIG_KERNEL_ZSTD +BuildRequires: zstd BuildRequires: gcc, binutils, redhat-rpm-config, hmaccalc, bison, flex, gcc-c++ %if 0%{?fedora} BuildRequires: rust, rust-src, bindgen -- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/3460

4 19

Fwd: Linux kernel 6.1.3 released
by Luna Jernberg 06 Dec '24

06 Dec '24

This one works better then 6.1.2 with kernel panics so you have more to package so we can test when you are awake :) ---------- Forwarded message --------- Från: Linux Kernel Distribution System <kdist(a)linux.kernel.org> Date: ons 4 jan. 2023 kl 11:46 Subject: Linux kernel 6.1.3 released To: <linux-kernel-announce(a)vger.kernel.org> Linux kernel version 6.1.3 is now available: Full source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.1.3.tar.xz Patch: https://cdn.kernel.org/pub/linux/kernel/v6.x/patch-6.1.3.xz PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.1.3.tar.sign You can view the summary of the changes at the following URL: https://git.kernel.org/stable/ds/v6.1.3/v6.1.2

1 0

Kernel 6.12 Test Week Invitation
by Sumantro Mukherjee 01 Dec '24

01 Dec '24

Hey All, I would like to invite all of you to participate in the Kernel 6.12 Test week is happening from 2024-12-01 to 2024-12-08. It's fairly simple, head over to the wiki [0] and read in detail about the test week and simply run the test case mentioned in[1] and enter your results. As usual, the Fedora QA team will hangout at #fedora-test-day(a)libera.chat for questions and discussion. [0]http://fedoraproject.org/wiki/Test_Day:2024-12-01_Kernel_6.12_Test_Week [1]https://testdays.fedoraproject.org/events/205 -- //sumantro Fedora QE TRIED AND PERSONALLY TESTED, ERGO TRUSTED <https://redhat.com/trusted>

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

kernel December 2024