diff --git a/Dockerfile b/Dockerfile index b90f32d..1ab0c1b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -15,9 +15,11 @@ RUN apt-get update && \ build-essential \ cpio \ curl \ + debhelper \ fakeroot \ flex \ gcc-12-plugin-dev \ + gettext-base \ git \ kmod \ libelf-dev \ @@ -25,6 +27,7 @@ RUN apt-get update && \ libssl-dev \ lsb-release \ ncurses-dev \ + pigz \ python3 \ python3-requests \ rsync \ @@ -35,10 +38,7 @@ RUN groupadd -g ${GID} ${USERNAME} && useradd -m -d /home/${USERNAME} -g ${GID} COPY build-kernel.sh /usr/local/bin/build-kernel.sh COPY grsecurity-urls.py /usr/local/bin/grsecurity-urls.py -COPY scripts/ /scripts - -COPY securedrop-grsec /securedrop-grsec -COPY securedrop-workstation-grsec /securedrop-workstation-grsec +COPY debian /debian RUN mkdir -p -m 0755 /kernel /patches-grsec /output RUN chown ${USERNAME}:${USERNAME} /kernel /patches-grsec /output diff --git a/Makefile b/Makefile index 045922d..a0c7bd7 100644 --- a/Makefile +++ b/Makefile @@ -12,6 +12,16 @@ vanilla: ## Builds latest stable kernel, unpatched --return \ $(OUT) +.PHONY: tiny-6.6 +tiny-6.6: OUT:=$(SCRIPT_OUTPUT_PREFIX)-tiny-6.6.$(SCRIPT_OUTPUT_EXT) +tiny-6.6: ## Builds latest stable kernel, unpatched + LINUX_MAJOR_VERSION="6.6" LOCALVERSION="tiny" \ + LINUX_LOCAL_CONFIG_PATH="$(PWD)/configs/tinyconfig-6.6" \ + script \ + --command ./scripts/build-kernel-wrapper \ + --return \ + $(OUT) + .PHONY: grsec grsec: OUT:=$(SCRIPT_OUTPUT_PREFIX)-grsec.$(SCRIPT_OUTPUT_EXT) grsec: ## Builds grsecurity-patched kernel (requires credentials) @@ -27,14 +37,14 @@ reprotest: ## Builds simple kernel multiple times to confirm reproducibility .PHONY: reprotest-sd reprotest-sd: ## DEBUG Builds SD kernel config without grsec in CI - GRSECURITY=0 LOCALVERSION="-securedrop" \ + GRSECURITY=0 LOCALVERSION="securedrop" \ LINUX_LOCAL_CONFIG_PATH="$(PWD)/configs/config-securedrop-5.15" \ LINUX_LOCAL_PATCHES_PATH="$(PWD)/patches" \ ./scripts/reproducibility-test securedrop-core-5.15: OUT:=$(SCRIPT_OUTPUT_PREFIX)-securedrop-core-5.15.$(SCRIPT_OUTPUT_EXT) securedrop-core-5.15: ## Builds kernels for SecureDrop servers, 5.15.x - GRSECURITY=1 GRSECURITY_PATCH_TYPE=stable6 LOCALVERSION="-securedrop" \ + GRSECURITY=1 GRSECURITY_PATCH_TYPE=stable6 LOCALVERSION="securedrop" \ LINUX_LOCAL_CONFIG_PATH="$(PWD)/configs/config-securedrop-5.15" \ LINUX_LOCAL_PATCHES_PATH="$(PWD)/patches" \ script \ @@ -44,7 +54,7 @@ securedrop-core-5.15: ## Builds kernels for SecureDrop servers, 5.15.x securedrop-workstation-6.6: OUT:=$(SCRIPT_OUTPUT_PREFIX)-securedrop-workstation-6.6.$(SCRIPT_OUTPUT_EXT) securedrop-workstation-6.6: ## Builds kernels for SecureDrop Workstation, 6.6.x - GRSECURITY=1 GRSECURITY_PATCH_TYPE=stable9 LOCALVERSION="-workstation" \ + GRSECURITY=1 GRSECURITY_PATCH_TYPE=stable9 LOCALVERSION="workstation" \ LINUX_LOCAL_CONFIG_PATH="$(PWD)/configs/config-workstation-6.6" \ script \ --command ./scripts/build-kernel-wrapper \ diff --git a/build-kernel.sh b/build-kernel.sh index 165536e..839109b 100755 --- a/build-kernel.sh +++ b/build-kernel.sh @@ -1,7 +1,5 @@ #!/bin/bash -set -e -set -u -set -o pipefail +set -euxo pipefail # Patching with grsecurity is disabled by default. @@ -12,8 +10,12 @@ LINUX_MAJOR_VERSION="${LINUX_MAJOR_VERSION:-}" LINUX_CUSTOM_CONFIG="${LINUX_CUSTOM_CONFIG:-/config}" LOCALVERSION="${LOCALVERSION:-}" export SOURCE_DATE_EPOCH +export SOURCE_DATE_EPOCH_FORMATTED=$(date -R -d @$SOURCE_DATE_EPOCH) export KBUILD_BUILD_TIMESTAMP export DEB_BUILD_TIMESTAMP +# Get the current Debian codename so we can vary based on version +eval "export $(cat /etc/os-release | grep CODENAME)" +export VERSION_CODENAME if [[ $# > 0 ]]; then x="$1" @@ -48,6 +50,7 @@ if [[ -z "$LINUX_VERSION" ]]; then exit 1 fi # Get the latest patch version of this version series from kernel.org + echo "Looking up latest release of $LINUX_MAJOR_VERSION from kernel.org" LINUX_VERSION="$(curl -s https://www.kernel.org/ | grep -m1 -F "$LINUX_MAJOR_VERSION" -A1 | head -n1 | grep -oP '[\d\.]+')" fi @@ -57,7 +60,7 @@ echo "Fetching Linux kernel source $LINUX_VERSION" wget https://cdn.kernel.org/pub/linux/kernel/v${FOLDER}/linux-${LINUX_VERSION}.tar.{xz,sign} echo "Extracting Linux kernel source $LINUX_VERSION" -xz -d -v linux-${LINUX_VERSION}.tar.xz +xz -d -T 0 -v linux-${LINUX_VERSION}.tar.xz gpgv --keyring /pubkeys/kroah_hartman.gpg linux-${LINUX_VERSION}.tar.sign linux-${LINUX_VERSION}.tar tar -xf linux-${LINUX_VERSION}.tar cd linux-${LINUX_VERSION} @@ -72,28 +75,36 @@ if [[ -e /patches-grsec && -n "$GRSECURITY" && "$GRSECURITY" = "1" ]]; then find /patches-grsec -maxdepth 1 -type f -exec patch -p 1 -i {} \; fi -echo "Copying in our mkdebian" -cp "/scripts/mkdebian-${LINUX_MAJOR_VERSION}" scripts/package/mkdebian -if [[ -f "/scripts/rules-${LINUX_MAJOR_VERSION}" ]]; then - echo "Copying in our debian/rules" - cp "/scripts/rules-${LINUX_MAJOR_VERSION}" scripts/package/debian/rules -fi +# Generate the orig tarball +#tar --use-compress-program="xz -T 0" -cf ../linux-upstream_${LINUX_VERSION}-grsec-${LOCALVERSION}.orig.tar.xz . +tar -cf - . | pigz > ../linux-upstream_${LINUX_VERSION}-grsec-${LOCALVERSION}.orig.tar.gz + +echo "Copying in our debian/" +cp -R /debian debian +export PACKAGE_VERSION="${LINUX_VERSION}-grsec-${LOCALVERSION}-1" +export DEBARCH="amd64" + +cat debian/control.in | envsubst > debian/control +echo "" >> debian/control if [[ "$LOCALVERSION" = "-workstation" ]]; then - echo "Copying in our securedrop-workstation-grsec" - mkdir -p debian/securedrop-workstation-grsec - cp -Rv /securedrop-workstation-grsec/* debian/securedrop-workstation-grsec/ + echo "Generating d/control for workstation" + cat debian/control.workstation | envsubst >> debian/control else - echo "Copying in our securedrop-grsec" - mkdir -p debian/securedrop-grsec - cp -Rv /securedrop-grsec/* debian/securedrop-grsec/ + echo "Generating d/control for server" + cat debian/control.server | envsubst >> debian/control fi +cat debian/changelog.in | envsubst > debian/changelog + +cat < debian/rules.vars +ARCH := x86 +KERNELRELEASE := ${LINUX_VERSION} +EOF echo "Building Linux kernel source $LINUX_VERSION" -make olddefconfig -VCPUS="$(nproc)" -make EXTRAVERSION="-1" -j $VCPUS deb-pkg +# TODO set parallel build here +dpkg-buildpackage -uc -us echo "Storing build artifacts for $LINUX_VERSION" if [[ -d /output ]]; then diff --git a/configs/tinyconfig-6.6 b/configs/tinyconfig-6.6 new file mode 100644 index 0000000..d8ef519 --- /dev/null +++ b/configs/tinyconfig-6.6 @@ -0,0 +1,1315 @@ +# +# Automatically generated file; DO NOT EDIT. +# Linux/x86 6.6.22 Kernel Configuration +# +CONFIG_CC_VERSION_TEXT="gcc (Debian 12.2.0-14) 12.2.0" +CONFIG_CC_IS_GCC=y +CONFIG_GCC_VERSION=120200 +CONFIG_CLANG_VERSION=0 +CONFIG_AS_IS_GNU=y +CONFIG_AS_VERSION=24000 +CONFIG_LD_IS_BFD=y +CONFIG_LD_VERSION=24000 +CONFIG_LLD_VERSION=0 +CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y +CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y +CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y +CONFIG_TOOLS_SUPPORT_RELR=y +CONFIG_CC_HAS_ASM_INLINE=y +CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y +CONFIG_PAHOLE_VERSION=0 +CONFIG_IRQ_WORK=y +CONFIG_BUILDTIME_TABLE_SORT=y +CONFIG_THREAD_INFO_IN_TASK=y + +# +# General setup +# +CONFIG_BROKEN_ON_SMP=y +CONFIG_INIT_ENV_ARG_LIMIT=32 +# CONFIG_COMPILE_TEST is not set +# CONFIG_WERROR is not set +CONFIG_LOCALVERSION="" +# CONFIG_LOCALVERSION_AUTO is not set +CONFIG_BUILD_SALT="" +CONFIG_HAVE_KERNEL_GZIP=y +CONFIG_HAVE_KERNEL_BZIP2=y +CONFIG_HAVE_KERNEL_LZMA=y +CONFIG_HAVE_KERNEL_XZ=y +CONFIG_HAVE_KERNEL_LZO=y +CONFIG_HAVE_KERNEL_LZ4=y +CONFIG_HAVE_KERNEL_ZSTD=y +# CONFIG_KERNEL_GZIP is not set +# CONFIG_KERNEL_BZIP2 is not set +# CONFIG_KERNEL_LZMA is not set +CONFIG_KERNEL_XZ=y +# CONFIG_KERNEL_LZO is not set +# CONFIG_KERNEL_LZ4 is not set +# CONFIG_KERNEL_ZSTD is not set +CONFIG_DEFAULT_INIT="" +CONFIG_DEFAULT_HOSTNAME="(none)" +# CONFIG_SYSVIPC is not set +# CONFIG_WATCH_QUEUE is not set +# CONFIG_CROSS_MEMORY_ATTACH is not set +# CONFIG_USELIB is not set +CONFIG_HAVE_ARCH_AUDITSYSCALL=y + +# +# IRQ subsystem +# +CONFIG_GENERIC_IRQ_PROBE=y +CONFIG_GENERIC_IRQ_SHOW=y +CONFIG_HARDIRQS_SW_RESEND=y +CONFIG_GENERIC_IRQ_RESERVATION_MODE=y +CONFIG_IRQ_FORCED_THREADING=y +CONFIG_SPARSE_IRQ=y +# end of IRQ subsystem + +CONFIG_CLOCKSOURCE_WATCHDOG=y +CONFIG_ARCH_CLOCKSOURCE_INIT=y +CONFIG_CLOCKSOURCE_VALIDATE_LAST_CYCLE=y +CONFIG_GENERIC_TIME_VSYSCALL=y +CONFIG_GENERIC_CLOCKEVENTS=y +CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST=y +CONFIG_GENERIC_CMOS_UPDATE=y +CONFIG_HAVE_POSIX_CPU_TIMERS_TASK_WORK=y + +# +# Timers subsystem +# +CONFIG_HZ_PERIODIC=y +# CONFIG_NO_HZ_IDLE is not set +# CONFIG_NO_HZ is not set +# CONFIG_HIGH_RES_TIMERS is not set +CONFIG_CLOCKSOURCE_WATCHDOG_MAX_SKEW_US=125 +# end of Timers subsystem + +CONFIG_HAVE_EBPF_JIT=y + +# +# BPF subsystem +# +# CONFIG_BPF_SYSCALL is not set +# end of BPF subsystem + +CONFIG_PREEMPT_NONE_BUILD=y +CONFIG_PREEMPT_NONE=y +# CONFIG_PREEMPT_VOLUNTARY is not set +# CONFIG_PREEMPT is not set +# CONFIG_PREEMPT_DYNAMIC is not set + +# +# CPU/Task time and stats accounting +# +CONFIG_TICK_CPU_ACCOUNTING=y +# CONFIG_IRQ_TIME_ACCOUNTING is not set +# CONFIG_PSI is not set +# end of CPU/Task time and stats accounting + +# +# RCU Subsystem +# +CONFIG_TINY_RCU=y +# CONFIG_RCU_EXPERT is not set +CONFIG_TINY_SRCU=y +# end of RCU Subsystem + +# CONFIG_IKCONFIG is not set +CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y + +# +# Scheduler features +# +# end of Scheduler features + +CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH=y +CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5" +CONFIG_GCC11_NO_ARRAY_BOUNDS=y +CONFIG_CC_NO_ARRAY_BOUNDS=y +# CONFIG_CGROUPS is not set +# CONFIG_SCHED_AUTOGROUP is not set +# CONFIG_RELAY is not set +# CONFIG_BLK_DEV_INITRD is not set +# CONFIG_BOOT_CONFIG is not set +# CONFIG_INITRAMFS_PRESERVE_MTIME is not set +# CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE is not set +CONFIG_CC_OPTIMIZE_FOR_SIZE=y +CONFIG_LD_ORPHAN_WARN=y +CONFIG_LD_ORPHAN_WARN_LEVEL="warn" +CONFIG_HAVE_UID16=y +CONFIG_SYSCTL_EXCEPTION_TRACE=y +CONFIG_HAVE_PCSPKR_PLATFORM=y +CONFIG_EXPERT=y +# CONFIG_MULTIUSER is not set +# CONFIG_SGETMASK_SYSCALL is not set +# CONFIG_SYSFS_SYSCALL is not set +# CONFIG_FHANDLE is not set +# CONFIG_POSIX_TIMERS is not set +# CONFIG_PRINTK is not set +# CONFIG_BUG is not set +# CONFIG_PCSPKR_PLATFORM is not set +# CONFIG_BASE_FULL is not set +# CONFIG_FUTEX is not set +# CONFIG_EPOLL is not set +# CONFIG_SIGNALFD is not set +# CONFIG_TIMERFD is not set +# CONFIG_EVENTFD is not set +# CONFIG_SHMEM is not set +# CONFIG_AIO is not set +# CONFIG_IO_URING is not set +# CONFIG_ADVISE_SYSCALLS is not set +# CONFIG_MEMBARRIER is not set +# CONFIG_KALLSYMS is not set +CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y +# CONFIG_KCMP is not set +# CONFIG_RSEQ is not set +# CONFIG_CACHESTAT_SYSCALL is not set +CONFIG_HAVE_PERF_EVENTS=y +# CONFIG_PC104 is not set + +# +# Kernel Performance Events And Counters +# +CONFIG_PERF_EVENTS=y +# CONFIG_DEBUG_PERF_USE_VMALLOC is not set +# end of Kernel Performance Events And Counters + +# CONFIG_PROFILING is not set + +# +# Kexec and crash features +# +# CONFIG_KEXEC is not set +# end of Kexec and crash features +# end of General setup + +# CONFIG_64BIT is not set +CONFIG_X86_32=y +CONFIG_X86=y +CONFIG_INSTRUCTION_DECODER=y +CONFIG_OUTPUT_FORMAT="elf32-i386" +CONFIG_LOCKDEP_SUPPORT=y +CONFIG_STACKTRACE_SUPPORT=y +CONFIG_MMU=y +CONFIG_ARCH_MMAP_RND_BITS_MIN=8 +CONFIG_ARCH_MMAP_RND_BITS_MAX=16 +CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8 +CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16 +CONFIG_GENERIC_ISA_DMA=y +CONFIG_ARCH_MAY_HAVE_PC_FDC=y +CONFIG_GENERIC_CALIBRATE_DELAY=y +CONFIG_ARCH_HAS_CPU_RELAX=y +CONFIG_ARCH_HIBERNATION_POSSIBLE=y +CONFIG_ARCH_SUSPEND_POSSIBLE=y +CONFIG_ARCH_SUPPORTS_UPROBES=y +CONFIG_FIX_EARLYCON_MEM=y +CONFIG_PGTABLE_LEVELS=2 +CONFIG_CC_HAS_SANE_STACKPROTECTOR=y + +# +# Processor type and features +# +# CONFIG_SMP is not set +# CONFIG_GOLDFISH is not set +# CONFIG_X86_CPU_RESCTRL is not set +# CONFIG_X86_EXTENDED_PLATFORM is not set +# CONFIG_X86_32_IRIS is not set +# CONFIG_SCHED_OMIT_FRAME_POINTER is not set +# CONFIG_HYPERVISOR_GUEST is not set +# CONFIG_M486SX is not set +# CONFIG_M486 is not set +# CONFIG_M586 is not set +# CONFIG_M586TSC is not set +# CONFIG_M586MMX is not set +CONFIG_M686=y +# CONFIG_MPENTIUMII is not set +# CONFIG_MPENTIUMIII is not set +# CONFIG_MPENTIUMM is not set +# CONFIG_MPENTIUM4 is not set +# CONFIG_MK6 is not set +# CONFIG_MK7 is not set +# CONFIG_MK8 is not set +# CONFIG_MCRUSOE is not set +# CONFIG_MEFFICEON is not set +# CONFIG_MWINCHIPC6 is not set +# CONFIG_MWINCHIP3D is not set +# CONFIG_MELAN is not set +# CONFIG_MGEODEGX1 is not set +# CONFIG_MGEODE_LX is not set +# CONFIG_MCYRIXIII is not set +# CONFIG_MVIAC3_2 is not set +# CONFIG_MVIAC7 is not set +# CONFIG_MCORE2 is not set +# CONFIG_MATOM is not set +# CONFIG_X86_GENERIC is not set +CONFIG_X86_INTERNODE_CACHE_SHIFT=5 +CONFIG_X86_L1_CACHE_SHIFT=5 +CONFIG_X86_USE_PPRO_CHECKSUM=y +CONFIG_X86_TSC=y +CONFIG_X86_CMPXCHG64=y +CONFIG_X86_CMOV=y +CONFIG_X86_MINIMUM_CPU_FAMILY=6 +CONFIG_X86_DEBUGCTLMSR=y +CONFIG_IA32_FEAT_CTL=y +CONFIG_X86_VMX_FEATURE_NAMES=y +# CONFIG_PROCESSOR_SELECT is not set +CONFIG_CPU_SUP_INTEL=y +CONFIG_CPU_SUP_CYRIX_32=y +CONFIG_CPU_SUP_AMD=y +CONFIG_CPU_SUP_HYGON=y +CONFIG_CPU_SUP_CENTAUR=y +CONFIG_CPU_SUP_TRANSMETA_32=y +CONFIG_CPU_SUP_UMC_32=y +CONFIG_CPU_SUP_ZHAOXIN=y +CONFIG_CPU_SUP_VORTEX_32=y +# CONFIG_HPET_TIMER is not set +# CONFIG_DMI is not set +CONFIG_NR_CPUS_RANGE_BEGIN=1 +CONFIG_NR_CPUS_RANGE_END=1 +CONFIG_NR_CPUS_DEFAULT=1 +CONFIG_NR_CPUS=1 +# CONFIG_X86_UP_APIC is not set +# CONFIG_X86_MCE is not set + +# +# Performance monitoring +# +# CONFIG_PERF_EVENTS_AMD_POWER is not set +# CONFIG_PERF_EVENTS_AMD_UNCORE is not set +# CONFIG_PERF_EVENTS_AMD_BRS is not set +# end of Performance monitoring + +# CONFIG_X86_LEGACY_VM86 is not set +# CONFIG_X86_IOPL_IOPERM is not set +# CONFIG_TOSHIBA is not set +# CONFIG_X86_REBOOTFIXUPS is not set +CONFIG_MICROCODE=y +# CONFIG_MICROCODE_LATE_LOADING is not set +# CONFIG_X86_MSR is not set +# CONFIG_X86_CPUID is not set +CONFIG_NOHIGHMEM=y +# CONFIG_HIGHMEM4G is not set +# CONFIG_HIGHMEM64G is not set +CONFIG_VMSPLIT_3G=y +# CONFIG_VMSPLIT_3G_OPT is not set +# CONFIG_VMSPLIT_2G is not set +# CONFIG_VMSPLIT_2G_OPT is not set +# CONFIG_VMSPLIT_1G is not set +CONFIG_PAGE_OFFSET=0xC0000000 +# CONFIG_X86_PAE is not set +CONFIG_ARCH_FLATMEM_ENABLE=y +CONFIG_ARCH_SPARSEMEM_ENABLE=y +CONFIG_ARCH_SELECT_MEMORY_MODEL=y +CONFIG_ILLEGAL_POINTER_VALUE=0 +# CONFIG_X86_CHECK_BIOS_CORRUPTION is not set +# CONFIG_MTRR is not set +# CONFIG_X86_UMIP is not set +CONFIG_CC_HAS_IBT=y +CONFIG_X86_INTEL_TSX_MODE_OFF=y +# CONFIG_X86_INTEL_TSX_MODE_ON is not set +# CONFIG_X86_INTEL_TSX_MODE_AUTO is not set +# CONFIG_HZ_100 is not set +CONFIG_HZ_250=y +# CONFIG_HZ_300 is not set +# CONFIG_HZ_1000 is not set +CONFIG_HZ=250 +CONFIG_ARCH_SUPPORTS_KEXEC=y +CONFIG_ARCH_SUPPORTS_KEXEC_PURGATORY=y +CONFIG_ARCH_SUPPORTS_KEXEC_SIG=y +CONFIG_ARCH_SUPPORTS_KEXEC_SIG_FORCE=y +CONFIG_ARCH_SUPPORTS_KEXEC_BZIMAGE_VERIFY_SIG=y +CONFIG_ARCH_SUPPORTS_KEXEC_JUMP=y +CONFIG_ARCH_SUPPORTS_CRASH_HOTPLUG=y +CONFIG_PHYSICAL_START=0x1000000 +# CONFIG_RELOCATABLE is not set +CONFIG_PHYSICAL_ALIGN=0x200000 +# CONFIG_COMPAT_VDSO is not set +# CONFIG_CMDLINE_BOOL is not set +# CONFIG_MODIFY_LDT_SYSCALL is not set +# CONFIG_STRICT_SIGALTSTACK_SIZE is not set +# end of Processor type and features + +CONFIG_CC_HAS_SLS=y +CONFIG_CC_HAS_RETURN_THUNK=y +CONFIG_CC_HAS_ENTRY_PADDING=y +CONFIG_FUNCTION_PADDING_CFI=0 +CONFIG_FUNCTION_PADDING_BYTES=4 +# CONFIG_SPECULATION_MITIGATIONS is not set + +# +# Power management and ACPI options +# +# CONFIG_SUSPEND is not set +# CONFIG_PM is not set +CONFIG_ARCH_SUPPORTS_ACPI=y +# CONFIG_ACPI is not set + +# +# CPU Frequency scaling +# +# CONFIG_CPU_FREQ is not set +# end of CPU Frequency scaling + +# +# CPU Idle +# +# CONFIG_CPU_IDLE is not set +# end of CPU Idle +# end of Power management and ACPI options + +# +# Bus options (PCI etc.) +# +# CONFIG_ISA_BUS is not set +CONFIG_ISA_DMA_API=y +# CONFIG_ISA is not set +# CONFIG_SCx200 is not set +# CONFIG_OLPC is not set +# CONFIG_ALIX is not set +# CONFIG_NET5501 is not set +# end of Bus options (PCI etc.) + +# +# Binary Emulations +# +CONFIG_COMPAT_32=y +# end of Binary Emulations + +CONFIG_HAVE_ATOMIC_IOMAP=y +CONFIG_HAVE_KVM=y +# CONFIG_VIRTUALIZATION is not set +CONFIG_AS_AVX512=y +CONFIG_AS_SHA1_NI=y +CONFIG_AS_SHA256_NI=y +CONFIG_AS_TPAUSE=y +CONFIG_AS_GFNI=y +CONFIG_AS_WRUSS=y + +# +# General architecture-dependent options +# +CONFIG_GENERIC_ENTRY=y +# CONFIG_JUMP_LABEL is not set +# CONFIG_STATIC_CALL_SELFTEST is not set +CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y +CONFIG_ARCH_USE_BUILTIN_BSWAP=y +CONFIG_HAVE_IOREMAP_PROT=y +CONFIG_HAVE_KPROBES=y +CONFIG_HAVE_KRETPROBES=y +CONFIG_HAVE_OPTPROBES=y +CONFIG_HAVE_KPROBES_ON_FTRACE=y +CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE=y +CONFIG_HAVE_FUNCTION_ERROR_INJECTION=y +CONFIG_HAVE_NMI=y +CONFIG_TRACE_IRQFLAGS_SUPPORT=y +CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y +CONFIG_HAVE_ARCH_TRACEHOOK=y +CONFIG_HAVE_DMA_CONTIGUOUS=y +CONFIG_GENERIC_SMP_IDLE_THREAD=y +CONFIG_ARCH_HAS_FORTIFY_SOURCE=y +CONFIG_ARCH_HAS_SET_MEMORY=y +CONFIG_ARCH_HAS_SET_DIRECT_MAP=y +CONFIG_ARCH_HAS_CPU_FINALIZE_INIT=y +CONFIG_HAVE_ARCH_THREAD_STRUCT_WHITELIST=y +CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT=y +CONFIG_ARCH_WANTS_NO_INSTR=y +CONFIG_ARCH_32BIT_OFF_T=y +CONFIG_HAVE_ASM_MODVERSIONS=y +CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y +CONFIG_HAVE_RSEQ=y +CONFIG_HAVE_FUNCTION_ARG_ACCESS_API=y +CONFIG_HAVE_HW_BREAKPOINT=y +CONFIG_HAVE_MIXED_BREAKPOINTS_REGS=y +CONFIG_HAVE_USER_RETURN_NOTIFIER=y +CONFIG_HAVE_PERF_EVENTS_NMI=y +CONFIG_HAVE_HARDLOCKUP_DETECTOR_PERF=y +CONFIG_HAVE_PERF_REGS=y +CONFIG_HAVE_PERF_USER_STACK_DUMP=y +CONFIG_HAVE_ARCH_JUMP_LABEL=y +CONFIG_HAVE_ARCH_JUMP_LABEL_RELATIVE=y +CONFIG_MMU_GATHER_MERGE_VMAS=y +CONFIG_MMU_LAZY_TLB_REFCOUNT=y +CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y +CONFIG_ARCH_HAS_NMI_SAFE_THIS_CPU_OPS=y +CONFIG_HAVE_ALIGNED_STRUCT_PAGE=y +CONFIG_HAVE_CMPXCHG_LOCAL=y +CONFIG_HAVE_CMPXCHG_DOUBLE=y +CONFIG_ARCH_WANT_IPC_PARSE_VERSION=y +CONFIG_HAVE_ARCH_SECCOMP=y +CONFIG_HAVE_ARCH_SECCOMP_FILTER=y +# CONFIG_SECCOMP is not set +CONFIG_HAVE_ARCH_STACKLEAK=y +CONFIG_HAVE_STACKPROTECTOR=y +# CONFIG_STACKPROTECTOR is not set +CONFIG_ARCH_SUPPORTS_LTO_CLANG=y +CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y +CONFIG_LTO_NONE=y +CONFIG_HAVE_ARCH_WITHIN_STACK_FRAMES=y +CONFIG_HAVE_IRQ_TIME_ACCOUNTING=y +CONFIG_HAVE_MOVE_PUD=y +CONFIG_HAVE_MOVE_PMD=y +CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE=y +CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y +CONFIG_HAVE_MOD_ARCH_SPECIFIC=y +CONFIG_MODULES_USE_ELF_REL=y +CONFIG_HAVE_SOFTIRQ_ON_OWN_STACK=y +CONFIG_SOFTIRQ_ON_OWN_STACK=y +CONFIG_ARCH_HAS_ELF_RANDOMIZE=y +CONFIG_HAVE_ARCH_MMAP_RND_BITS=y +CONFIG_HAVE_EXIT_THREAD=y +CONFIG_ARCH_MMAP_RND_BITS=8 +CONFIG_PAGE_SIZE_LESS_THAN_64KB=y +CONFIG_PAGE_SIZE_LESS_THAN_256KB=y +CONFIG_CLONE_BACKWARDS=y +CONFIG_OLD_SIGSUSPEND3=y +CONFIG_OLD_SIGACTION=y +# CONFIG_COMPAT_32BIT_TIME is not set +CONFIG_HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET=y +# CONFIG_RANDOMIZE_KSTACK_OFFSET is not set +CONFIG_ARCH_HAS_STRICT_KERNEL_RWX=y +CONFIG_STRICT_KERNEL_RWX=y +CONFIG_ARCH_HAS_STRICT_MODULE_RWX=y +CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y +CONFIG_ARCH_HAS_MEM_ENCRYPT=y +CONFIG_HAVE_STATIC_CALL=y +CONFIG_HAVE_PREEMPT_DYNAMIC=y +CONFIG_HAVE_PREEMPT_DYNAMIC_CALL=y +CONFIG_ARCH_WANT_LD_ORPHAN_WARN=y +CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y +CONFIG_ARCH_SPLIT_ARG64=y +CONFIG_ARCH_HAS_PARANOID_L1D_FLUSH=y +CONFIG_DYNAMIC_SIGFRAME=y + +# +# GCOV-based kernel profiling +# +CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y +# end of GCOV-based kernel profiling + +CONFIG_HAVE_GCC_PLUGINS=y +# CONFIG_GCC_PLUGINS is not set +CONFIG_FUNCTION_ALIGNMENT_4B=y +CONFIG_FUNCTION_ALIGNMENT=4 +# end of General architecture-dependent options + +CONFIG_BASE_SMALL=1 +# CONFIG_MODULES is not set +# CONFIG_BLOCK is not set +CONFIG_INLINE_SPIN_UNLOCK_IRQ=y +CONFIG_INLINE_READ_UNLOCK=y +CONFIG_INLINE_READ_UNLOCK_IRQ=y +CONFIG_INLINE_WRITE_UNLOCK=y +CONFIG_INLINE_WRITE_UNLOCK_IRQ=y +CONFIG_ARCH_SUPPORTS_ATOMIC_RMW=y +CONFIG_ARCH_USE_QUEUED_SPINLOCKS=y +CONFIG_ARCH_USE_QUEUED_RWLOCKS=y +CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE=y +CONFIG_ARCH_HAS_SYNC_CORE_BEFORE_USERMODE=y +CONFIG_ARCH_HAS_SYSCALL_WRAPPER=y + +# +# Executable file formats +# +# CONFIG_BINFMT_ELF is not set +# CONFIG_BINFMT_SCRIPT is not set +# CONFIG_BINFMT_MISC is not set +# CONFIG_COREDUMP is not set +# end of Executable file formats + +# +# Memory Management options +# + +# +# SLAB allocator options +# +# CONFIG_SLAB_DEPRECATED is not set +CONFIG_SLUB=y +CONFIG_SLUB_TINY=y +CONFIG_SLAB_MERGE_DEFAULT=y +# end of SLAB allocator options + +# CONFIG_SHUFFLE_PAGE_ALLOCATOR is not set +# CONFIG_COMPAT_BRK is not set +CONFIG_SELECT_MEMORY_MODEL=y +CONFIG_FLATMEM_MANUAL=y +# CONFIG_SPARSEMEM_MANUAL is not set +CONFIG_FLATMEM=y +CONFIG_SPARSEMEM_STATIC=y +CONFIG_HAVE_FAST_GUP=y +CONFIG_EXCLUSIVE_SYSTEM_RAM=y +CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y +CONFIG_SPLIT_PTLOCK_CPUS=4 +# CONFIG_COMPACTION is not set +# CONFIG_PAGE_REPORTING is not set +# CONFIG_KSM is not set +CONFIG_DEFAULT_MMAP_MIN_ADDR=4096 +CONFIG_ARCH_WANT_GENERAL_HUGETLB=y +# CONFIG_TRANSPARENT_HUGEPAGE is not set +CONFIG_NEED_PER_CPU_KM=y +CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y +CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y +CONFIG_HAVE_SETUP_PER_CPU_AREA=y +# CONFIG_CMA is not set +CONFIG_GENERIC_EARLY_IOREMAP=y +CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y +CONFIG_ARCH_HAS_CURRENT_STACK_POINTER=y +CONFIG_ARCH_HAS_ZONE_DMA_SET=y +# CONFIG_ZONE_DMA is not set +# CONFIG_VM_EVENT_COUNTERS is not set +# CONFIG_PERCPU_STATS is not set + +# +# GUP_TEST needs to have DEBUG_FS enabled +# +# CONFIG_DMAPOOL_TEST is not set +CONFIG_ARCH_HAS_PTE_SPECIAL=y +CONFIG_KMAP_LOCAL=y +# CONFIG_MEMFD_CREATE is not set +# CONFIG_SECRETMEM is not set +# CONFIG_USERFAULTFD is not set +# CONFIG_LRU_GEN is not set +CONFIG_LOCK_MM_AND_FIND_VMA=y + +# +# Data Access Monitoring +# +# CONFIG_DAMON is not set +# end of Data Access Monitoring +# end of Memory Management options + +# CONFIG_NET is not set + +# +# Device Drivers +# +CONFIG_HAVE_EISA=y +# CONFIG_EISA is not set +CONFIG_HAVE_PCI=y +# CONFIG_PCI is not set +# CONFIG_PCCARD is not set + +# +# Generic Driver Options +# +# CONFIG_UEVENT_HELPER is not set +# CONFIG_DEVTMPFS is not set +# CONFIG_STANDALONE is not set +# CONFIG_PREVENT_FIRMWARE_BUILD is not set + +# +# Firmware loader +# +# CONFIG_FW_LOADER is not set +# end of Firmware loader + +# CONFIG_ALLOW_DEV_COREDUMP is not set +# CONFIG_DEBUG_DRIVER is not set +# CONFIG_DEBUG_DEVRES is not set +# CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set +CONFIG_GENERIC_CPU_AUTOPROBE=y +CONFIG_GENERIC_CPU_VULNERABILITIES=y +# CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT is not set +# end of Generic Driver Options + +# +# Bus devices +# +# CONFIG_MHI_BUS is not set +# CONFIG_MHI_BUS_EP is not set +# end of Bus devices + +# +# Cache Drivers +# +# end of Cache Drivers + +# +# Firmware Drivers +# + +# +# ARM System Control and Management Interface Protocol +# +# end of ARM System Control and Management Interface Protocol + +# CONFIG_EDD is not set +# CONFIG_FIRMWARE_MEMMAP is not set +# CONFIG_SYSFB_SIMPLEFB is not set +# CONFIG_GOOGLE_FIRMWARE is not set + +# +# Tegra firmware driver +# +# end of Tegra firmware driver +# end of Firmware Drivers + +# CONFIG_GNSS is not set +# CONFIG_MTD is not set +# CONFIG_OF is not set +CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y +# CONFIG_PARPORT is not set + +# +# NVME Support +# +# end of NVME Support + +# +# Misc devices +# +# CONFIG_DUMMY_IRQ is not set +# CONFIG_ENCLOSURE_SERVICES is not set +# CONFIG_SRAM is not set +# CONFIG_XILINX_SDFEC is not set +# CONFIG_C2PORT is not set + +# +# EEPROM support +# +# CONFIG_EEPROM_93CX6 is not set +# end of EEPROM support + +# +# Texas Instruments shared transport line discipline +# +# end of Texas Instruments shared transport line discipline + +# +# Altera FPGA firmware download module (requires I2C) +# +# CONFIG_ECHO is not set +# CONFIG_PVPANIC is not set +# end of Misc devices + +# +# SCSI device support +# +# end of SCSI device support + +# CONFIG_MACINTOSH_DRIVERS is not set + +# +# Input device support +# +# CONFIG_INPUT is not set + +# +# Hardware I/O ports +# +# CONFIG_SERIO is not set +CONFIG_ARCH_MIGHT_HAVE_PC_SERIO=y +# CONFIG_GAMEPORT is not set +# end of Hardware I/O ports +# end of Input device support + +# +# Character devices +# +# CONFIG_TTY is not set +# CONFIG_SERIAL_DEV_BUS is not set +# CONFIG_IPMI_HANDLER is not set +# CONFIG_HW_RANDOM is not set +# CONFIG_PC8736x_GPIO is not set +# CONFIG_NSC_GPIO is not set +# CONFIG_DEVMEM is not set +# CONFIG_NVRAM is not set +# CONFIG_DEVPORT is not set +# CONFIG_HANGCHECK_TIMER is not set +# CONFIG_TCG_TPM is not set +# CONFIG_TELCLOCK is not set +# end of Character devices + +# +# I2C support +# +# CONFIG_I2C is not set +# end of I2C support + +# CONFIG_I3C is not set +# CONFIG_SPI is not set +# CONFIG_SPMI is not set +# CONFIG_HSI is not set +# CONFIG_PPS is not set + +# +# PTP clock support +# +CONFIG_PTP_1588_CLOCK_OPTIONAL=y + +# +# Enable PHYLIB and NETWORK_PHY_TIMESTAMPING to see the additional clocks. +# +# end of PTP clock support + +# CONFIG_PINCTRL is not set +# CONFIG_GPIOLIB is not set +# CONFIG_W1 is not set +# CONFIG_POWER_RESET is not set +# CONFIG_POWER_SUPPLY is not set +# CONFIG_HWMON is not set +# CONFIG_THERMAL is not set +# CONFIG_WATCHDOG is not set +CONFIG_SSB_POSSIBLE=y +# CONFIG_SSB is not set +CONFIG_BCMA_POSSIBLE=y +# CONFIG_BCMA is not set + +# +# Multifunction device drivers +# +# CONFIG_MFD_MADERA is not set +# CONFIG_MFD_KEMPLD is not set +# CONFIG_MFD_MT6397 is not set +# CONFIG_MFD_SM501 is not set +# CONFIG_MFD_SYSCON is not set +# CONFIG_MFD_TQMX86 is not set +# end of Multifunction device drivers + +# CONFIG_REGULATOR is not set + +# +# CEC support +# +# CONFIG_MEDIA_CEC_SUPPORT is not set +# end of CEC support + +# CONFIG_MEDIA_SUPPORT is not set + +# +# Graphics support +# +# CONFIG_AUXDISPLAY is not set +# CONFIG_DRM is not set +# CONFIG_DRM_DEBUG_MODESET_LOCK is not set + +# +# Frame buffer Devices +# +# CONFIG_FB is not set +# end of Frame buffer Devices + +# +# Backlight & LCD device support +# +# CONFIG_LCD_CLASS_DEVICE is not set +# CONFIG_BACKLIGHT_CLASS_DEVICE is not set +# end of Backlight & LCD device support +# end of Graphics support + +# CONFIG_SOUND is not set +CONFIG_USB_OHCI_LITTLE_ENDIAN=y +# CONFIG_USB_SUPPORT is not set +# CONFIG_MMC is not set +# CONFIG_MEMSTICK is not set +# CONFIG_NEW_LEDS is not set +# CONFIG_ACCESSIBILITY is not set +CONFIG_EDAC_ATOMIC_SCRUB=y +CONFIG_EDAC_SUPPORT=y +CONFIG_RTC_LIB=y +CONFIG_RTC_MC146818_LIB=y +# CONFIG_RTC_CLASS is not set +# CONFIG_DMADEVICES is not set + +# +# DMABUF options +# +# CONFIG_SYNC_FILE is not set +# CONFIG_DMABUF_HEAPS is not set +# end of DMABUF options + +# CONFIG_UIO is not set +# CONFIG_VFIO is not set +# CONFIG_VIRT_DRIVERS is not set +# CONFIG_VIRTIO_MENU is not set +# CONFIG_VHOST_MENU is not set + +# +# Microsoft Hyper-V guest support +# +# end of Microsoft Hyper-V guest support + +# CONFIG_COMEDI is not set +# CONFIG_STAGING is not set +# CONFIG_CHROME_PLATFORMS is not set +# CONFIG_MELLANOX_PLATFORM is not set +# CONFIG_SURFACE_PLATFORMS is not set +# CONFIG_X86_PLATFORM_DEVICES is not set +# CONFIG_COMMON_CLK is not set +# CONFIG_HWSPINLOCK is not set + +# +# Clock Source drivers +# +CONFIG_CLKSRC_I8253=y +CONFIG_CLKEVT_I8253=y +CONFIG_CLKBLD_I8253=y +# end of Clock Source drivers + +# CONFIG_MAILBOX is not set +# CONFIG_IOMMU_SUPPORT is not set + +# +# Remoteproc drivers +# +# CONFIG_REMOTEPROC is not set +# end of Remoteproc drivers + +# +# Rpmsg drivers +# +# CONFIG_RPMSG_VIRTIO is not set +# end of Rpmsg drivers + +# +# SOC (System On Chip) specific Drivers +# + +# +# Amlogic SoC drivers +# +# end of Amlogic SoC drivers + +# +# Broadcom SoC drivers +# +# end of Broadcom SoC drivers + +# +# NXP/Freescale QorIQ SoC drivers +# +# end of NXP/Freescale QorIQ SoC drivers + +# +# fujitsu SoC drivers +# +# end of fujitsu SoC drivers + +# +# i.MX SoC drivers +# +# end of i.MX SoC drivers + +# +# Enable LiteX SoC Builder specific drivers +# +# end of Enable LiteX SoC Builder specific drivers + +# CONFIG_WPCM450_SOC is not set + +# +# Qualcomm SoC drivers +# +# end of Qualcomm SoC drivers + +# CONFIG_SOC_TI is not set + +# +# Xilinx SoC drivers +# +# end of Xilinx SoC drivers +# end of SOC (System On Chip) specific Drivers + +# CONFIG_PM_DEVFREQ is not set +# CONFIG_EXTCON is not set +# CONFIG_MEMORY is not set +# CONFIG_IIO is not set +# CONFIG_PWM is not set + +# +# IRQ chip support +# +# end of IRQ chip support + +# CONFIG_IPACK_BUS is not set +# CONFIG_RESET_CONTROLLER is not set + +# +# PHY Subsystem +# +# CONFIG_GENERIC_PHY is not set +# CONFIG_PHY_CAN_TRANSCEIVER is not set + +# +# PHY drivers for Broadcom platforms +# +# CONFIG_BCM_KONA_USB2_PHY is not set +# end of PHY drivers for Broadcom platforms + +# CONFIG_PHY_PXA_28NM_HSIC is not set +# CONFIG_PHY_PXA_28NM_USB2 is not set +# CONFIG_PHY_INTEL_LGM_EMMC is not set +# end of PHY Subsystem + +# CONFIG_POWERCAP is not set +# CONFIG_MCB is not set + +# +# Performance monitor support +# +# end of Performance monitor support + +# CONFIG_RAS is not set + +# +# Android +# +# CONFIG_ANDROID_BINDER_IPC is not set +# end of Android + +# CONFIG_DAX is not set +# CONFIG_NVMEM is not set + +# +# HW tracing support +# +# CONFIG_STM is not set +# CONFIG_INTEL_TH is not set +# end of HW tracing support + +# CONFIG_FPGA is not set +# CONFIG_TEE is not set +# CONFIG_SIOX is not set +# CONFIG_SLIMBUS is not set +# CONFIG_INTERCONNECT is not set +# CONFIG_COUNTER is not set +# CONFIG_PECI is not set +# CONFIG_HTE is not set +# end of Device Drivers + +# +# File systems +# +CONFIG_DCACHE_WORD_ACCESS=y +# CONFIG_VALIDATE_FS_PARSER is not set +# CONFIG_EXPORTFS_BLOCK_OPS is not set +# CONFIG_FILE_LOCKING is not set +# CONFIG_FS_ENCRYPTION is not set +# CONFIG_FS_VERITY is not set +# CONFIG_DNOTIFY is not set +# CONFIG_INOTIFY_USER is not set +# CONFIG_FANOTIFY is not set +# CONFIG_QUOTA is not set +# CONFIG_AUTOFS_FS is not set +# CONFIG_FUSE_FS is not set +# CONFIG_OVERLAY_FS is not set + +# +# Caches +# +# CONFIG_FSCACHE is not set +# end of Caches + +# +# Pseudo filesystems +# +# CONFIG_PROC_FS is not set +# CONFIG_SYSFS is not set +# CONFIG_CONFIGFS_FS is not set +# end of Pseudo filesystems + +# CONFIG_MISC_FILESYSTEMS is not set +# CONFIG_NLS is not set +# CONFIG_UNICODE is not set +# end of File systems + +# +# Security options +# +# CONFIG_KEYS is not set +# CONFIG_SECURITY_DMESG_RESTRICT is not set +# CONFIG_SECURITYFS is not set +# CONFIG_HARDENED_USERCOPY is not set +# CONFIG_FORTIFY_SOURCE is not set +# CONFIG_STATIC_USERMODEHELPER is not set +CONFIG_DEFAULT_SECURITY_DAC=y +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,bpf" + +# +# Kernel hardening options +# + +# +# Memory initialization +# +CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y +CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE=y +CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y +# CONFIG_INIT_STACK_NONE is not set +# CONFIG_INIT_STACK_ALL_PATTERN is not set +CONFIG_INIT_STACK_ALL_ZERO=y +# CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set +# CONFIG_INIT_ON_FREE_DEFAULT_ON is not set +CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y +# CONFIG_ZERO_CALL_USED_REGS is not set +# end of Memory initialization + +# +# Hardening of kernel data structures +# +# CONFIG_LIST_HARDENED is not set +# CONFIG_BUG_ON_DATA_CORRUPTION is not set +# end of Hardening of kernel data structures + +CONFIG_RANDSTRUCT_NONE=y +# end of Kernel hardening options +# end of Security options + +# CONFIG_CRYPTO is not set + +# +# Library routines +# +# CONFIG_PACKING is not set +CONFIG_GENERIC_STRNCPY_FROM_USER=y +CONFIG_GENERIC_STRNLEN_USER=y +# CONFIG_CORDIC is not set +# CONFIG_PRIME_NUMBERS is not set +CONFIG_GENERIC_PCI_IOMAP=y +CONFIG_GENERIC_IOMAP=y +CONFIG_ARCH_HAS_FAST_MULTIPLIER=y +CONFIG_ARCH_USE_SYM_ANNOTATIONS=y + +# +# Crypto library routines +# +CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y +# CONFIG_CRYPTO_LIB_CHACHA is not set +# CONFIG_CRYPTO_LIB_CURVE25519 is not set +CONFIG_CRYPTO_LIB_POLY1305_RSIZE=1 +# CONFIG_CRYPTO_LIB_POLY1305 is not set +# end of Crypto library routines + +# CONFIG_CRC_CCITT is not set +# CONFIG_CRC16 is not set +# CONFIG_CRC_T10DIF is not set +# CONFIG_CRC64_ROCKSOFT is not set +# CONFIG_CRC_ITU_T is not set +# CONFIG_CRC32 is not set +# CONFIG_CRC64 is not set +# CONFIG_CRC4 is not set +# CONFIG_CRC7 is not set +# CONFIG_LIBCRC32C is not set +# CONFIG_CRC8 is not set +# CONFIG_RANDOM32_SELFTEST is not set +# CONFIG_XZ_DEC is not set +CONFIG_HAS_IOMEM=y +CONFIG_HAS_IOPORT=y +CONFIG_HAS_IOPORT_MAP=y +CONFIG_HAS_DMA=y +CONFIG_NEED_SG_DMA_LENGTH=y +# CONFIG_DMA_API_DEBUG is not set +# CONFIG_IRQ_POLL is not set +CONFIG_HAVE_GENERIC_VDSO=y +CONFIG_GENERIC_GETTIMEOFDAY=y +CONFIG_GENERIC_VDSO_32=y +CONFIG_GENERIC_VDSO_TIME_NS=y +CONFIG_ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION=y +CONFIG_ARCH_STACKWALK=y +# end of Library routines + +# +# Kernel hacking +# + +# +# printk and dmesg options +# +CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7 +CONFIG_CONSOLE_LOGLEVEL_QUIET=4 +CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4 +# CONFIG_SYMBOLIC_ERRNAME is not set +# end of printk and dmesg options + +CONFIG_DEBUG_KERNEL=y +# CONFIG_DEBUG_MISC is not set + +# +# Compile-time checks and compiler options +# +CONFIG_AS_HAS_NON_CONST_LEB128=y +CONFIG_DEBUG_INFO_NONE=y +# CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT is not set +# CONFIG_DEBUG_INFO_DWARF4 is not set +# CONFIG_DEBUG_INFO_DWARF5 is not set +CONFIG_FRAME_WARN=1024 +# CONFIG_STRIP_ASM_SYMS is not set +# CONFIG_READABLE_ASM is not set +# CONFIG_HEADERS_INSTALL is not set +# CONFIG_DEBUG_SECTION_MISMATCH is not set +# CONFIG_SECTION_MISMATCH_WARN_ONLY is not set +# CONFIG_VMLINUX_MAP is not set +# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set +# end of Compile-time checks and compiler options + +# +# Generic Kernel Debugging Instruments +# +# CONFIG_MAGIC_SYSRQ is not set +# CONFIG_DEBUG_FS is not set +CONFIG_HAVE_ARCH_KGDB=y +# CONFIG_KGDB is not set +CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y +# CONFIG_UBSAN is not set +CONFIG_HAVE_KCSAN_COMPILER=y +# end of Generic Kernel Debugging Instruments + +# +# Networking Debugging +# +# end of Networking Debugging + +# +# Memory Debugging +# +# CONFIG_PAGE_EXTENSION is not set +# CONFIG_DEBUG_PAGEALLOC is not set +# CONFIG_PAGE_OWNER is not set +# CONFIG_PAGE_POISONING is not set +# CONFIG_DEBUG_RODATA_TEST is not set +CONFIG_ARCH_HAS_DEBUG_WX=y +# CONFIG_DEBUG_WX is not set +CONFIG_GENERIC_PTDUMP=y +CONFIG_HAVE_DEBUG_KMEMLEAK=y +# CONFIG_DEBUG_KMEMLEAK is not set +# CONFIG_DEBUG_OBJECTS is not set +# CONFIG_DEBUG_STACK_USAGE is not set +# CONFIG_SCHED_STACK_END_CHECK is not set +CONFIG_ARCH_HAS_DEBUG_VM_PGTABLE=y +# CONFIG_DEBUG_VM is not set +# CONFIG_DEBUG_VM_PGTABLE is not set +CONFIG_ARCH_HAS_DEBUG_VIRTUAL=y +# CONFIG_DEBUG_VIRTUAL is not set +# CONFIG_DEBUG_MEMORY_INIT is not set +# CONFIG_DEBUG_KMAP_LOCAL is not set +CONFIG_ARCH_SUPPORTS_KMAP_LOCAL_FORCE_MAP=y +# CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP is not set +CONFIG_HAVE_DEBUG_STACKOVERFLOW=y +# CONFIG_DEBUG_STACKOVERFLOW is not set +CONFIG_CC_HAS_KASAN_GENERIC=y +CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y +CONFIG_HAVE_ARCH_KFENCE=y +# CONFIG_KFENCE is not set +# end of Memory Debugging + +# CONFIG_DEBUG_SHIRQ is not set + +# +# Debug Oops, Lockups and Hangs +# +# CONFIG_PANIC_ON_OOPS is not set +CONFIG_PANIC_ON_OOPS_VALUE=0 +CONFIG_PANIC_TIMEOUT=0 +# CONFIG_SOFTLOCKUP_DETECTOR is not set +# CONFIG_HARDLOCKUP_DETECTOR is not set +# CONFIG_DETECT_HUNG_TASK is not set +# CONFIG_WQ_WATCHDOG is not set +# CONFIG_WQ_CPU_INTENSIVE_REPORT is not set +# end of Debug Oops, Lockups and Hangs + +# +# Scheduler Debugging +# +# end of Scheduler Debugging + +# CONFIG_DEBUG_TIMEKEEPING is not set + +# +# Lock Debugging (spinlocks, mutexes, etc...) +# +CONFIG_LOCK_DEBUGGING_SUPPORT=y +# CONFIG_PROVE_LOCKING is not set +# CONFIG_LOCK_STAT is not set +# CONFIG_DEBUG_SPINLOCK is not set +# CONFIG_DEBUG_MUTEXES is not set +# CONFIG_DEBUG_WW_MUTEX_SLOWPATH is not set +# CONFIG_DEBUG_RWSEMS is not set +# CONFIG_DEBUG_LOCK_ALLOC is not set +# CONFIG_DEBUG_ATOMIC_SLEEP is not set +# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set +# CONFIG_LOCK_TORTURE_TEST is not set +# CONFIG_WW_MUTEX_SELFTEST is not set +# CONFIG_SCF_TORTURE_TEST is not set +# end of Lock Debugging (spinlocks, mutexes, etc...) + +# CONFIG_NMI_CHECK_CPU is not set +# CONFIG_DEBUG_IRQFLAGS is not set +# CONFIG_STACKTRACE is not set +# CONFIG_WARN_ALL_UNSEEDED_RANDOM is not set +# CONFIG_DEBUG_KOBJECT is not set + +# +# Debug kernel data structures +# +# CONFIG_DEBUG_LIST is not set +# CONFIG_DEBUG_PLIST is not set +# CONFIG_DEBUG_SG is not set +# CONFIG_DEBUG_NOTIFIERS is not set +# CONFIG_DEBUG_MAPLE_TREE is not set +# end of Debug kernel data structures + +# +# RCU Debugging +# +# CONFIG_RCU_SCALE_TEST is not set +# CONFIG_RCU_TORTURE_TEST is not set +# CONFIG_RCU_REF_SCALE_TEST is not set +# CONFIG_RCU_TRACE is not set +# CONFIG_RCU_EQS_DEBUG is not set +# end of RCU Debugging + +# CONFIG_DEBUG_WQ_FORCE_RR_CPU is not set +CONFIG_USER_STACKTRACE_SUPPORT=y +CONFIG_HAVE_RETHOOK=y +CONFIG_HAVE_FUNCTION_TRACER=y +CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y +CONFIG_HAVE_FUNCTION_GRAPH_RETVAL=y +CONFIG_HAVE_DYNAMIC_FTRACE=y +CONFIG_HAVE_DYNAMIC_FTRACE_WITH_REGS=y +CONFIG_HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y +CONFIG_HAVE_DYNAMIC_FTRACE_NO_PATCHABLE=y +CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y +CONFIG_HAVE_SYSCALL_TRACEPOINTS=y +CONFIG_HAVE_C_RECORDMCOUNT=y +CONFIG_HAVE_BUILDTIME_MCOUNT_SORT=y +CONFIG_TRACING_SUPPORT=y +# CONFIG_FTRACE is not set +# CONFIG_SAMPLES is not set +CONFIG_ARCH_HAS_DEVMEM_IS_ALLOWED=y + +# +# x86 Debugging +# +# CONFIG_X86_VERBOSE_BOOTUP is not set +# CONFIG_EARLY_PRINTK is not set +# CONFIG_DEBUG_TLBFLUSH is not set +CONFIG_HAVE_MMIOTRACE_SUPPORT=y +# CONFIG_X86_DECODER_SELFTEST is not set +CONFIG_IO_DELAY_0X80=y +# CONFIG_IO_DELAY_0XED is not set +# CONFIG_IO_DELAY_UDELAY is not set +# CONFIG_IO_DELAY_NONE is not set +# CONFIG_CPA_DEBUG is not set +# CONFIG_DEBUG_ENTRY is not set +# CONFIG_X86_DEBUG_FPU is not set +# CONFIG_UNWINDER_FRAME_POINTER is not set +CONFIG_UNWINDER_GUESS=y +# end of x86 Debugging + +# +# Kernel Testing and Coverage +# +# CONFIG_KUNIT is not set +# CONFIG_NOTIFIER_ERROR_INJECTION is not set +# CONFIG_FAULT_INJECTION is not set +CONFIG_CC_HAS_SANCOV_TRACE_PC=y +# CONFIG_RUNTIME_TESTING_MENU is not set +CONFIG_ARCH_USE_MEMTEST=y +# CONFIG_MEMTEST is not set +# end of Kernel Testing and Coverage + +# +# Rust hacking +# +# end of Rust hacking +# end of Kernel hacking diff --git a/debian/changelog.in b/debian/changelog.in new file mode 100644 index 0000000..6a0dbe8 --- /dev/null +++ b/debian/changelog.in @@ -0,0 +1,5 @@ +linux-upstream (${PACKAGE_VERSION}) ${VERSION_CODENAME}; urgency=low + + * Custom built Linux kernel. + + -- SecureDrop Team ${SOURCE_DATE_EPOCH_FORMATTED} diff --git a/debian/control.in b/debian/control.in new file mode 100644 index 0000000..bcfbc13 --- /dev/null +++ b/debian/control.in @@ -0,0 +1,36 @@ +Source: linux-upstream +Section: kernel +Priority: optional +Maintainer: SecureDrop Team +Rules-Requires-Root: no +Build-Depends: bc, debhelper, rsync, kmod, cpio, bison, flex, libelf-dev, libssl-dev +Homepage: https://securedrop.org/ + +Package: linux-image-${PACKAGE_VERSION} +Architecture: ${DEBARCH} +Description: Linux kernel, version ${PACKAGE_VERSION} + This package contains the Linux kernel, modules and corresponding other + files, version: ${PACKAGE_VERSION}. + +Package: linux-libc-dev +Section: devel +Provides: linux-kernel-headers +Architecture: ${DEBARCH} +Description: Linux support headers for userspace development + This package provides userspaces headers from the Linux kernel. These headers + are used by the installed headers for GNU glibc and other system libraries. +Multi-Arch: same + +Package: linux-headers-${PACKAGE_VERSION} +Architecture: ${DEBARCH} +Description: Linux kernel headers for ${PACKAGE_VERSION} on ${DEBARCH} + This package provides kernel header files for ${PACKAGE_VERSION} on ${DEBARCH} + . + This is useful for people who need to build external modules + +Package: linux-image-${PACKAGE_VERSION}-dbg +Section: debug +Architecture: ${DEBARCH} +Description: Linux kernel debugging symbols for ${PACKAGE_VERSION} + This package will come in handy if you need to debug the kernel. It provides + all the necessary debug symbols for the kernel and its modules. diff --git a/debian/control.server b/debian/control.server new file mode 100644 index 0000000..9073efc --- /dev/null +++ b/debian/control.server @@ -0,0 +1,7 @@ +Package: securedrop-grsec +Section: admin +Architecture: ${DEBARCH} +Depends: linux-image-${PACKAGE_VERSION}, intel-microcode, amd64-microcode, paxctld +Description: Metapackage providing a grsecurity-patched Linux kernel for use + with SecureDrop. Depends on the most recently built patched kernel maintained + by FPF. Package also includes sysctl and PaX flags calls for GRUB. diff --git a/debian/control.workstation b/debian/control.workstation new file mode 100644 index 0000000..fc169dd --- /dev/null +++ b/debian/control.workstation @@ -0,0 +1,9 @@ +Package: securedrop-workstation-grsec +Section: admin +Architecture: ${DEBARCH} +Pre-Depends: qubes-kernel-vm-support (>=4.0.31) +Depends: linux-image-${PACKAGE_VERSION}, libelf-dev, paxctld +Description: Linux for SecureDrop Workstation template (meta-package) + Metapackage providing a grsecurity-patched Linux kernel for use in SecureDrop + Workstation Qubes templates. Depends on the most recently built patched kernel + maintained by FPF. diff --git a/debian/copyright b/debian/copyright new file mode 100644 index 0000000..757d07c --- /dev/null +++ b/debian/copyright @@ -0,0 +1,16 @@ +This is a packaged upstream version of the Linux kernel. + +Please see +for information on how to obtain the source code for this kernel build. + +Copyright: 1991 - 2024 Linus Torvalds and others. + +The git repository for mainline kernel development is at: +git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; version 2 dated June, 1991. + +On Debian GNU/Linux systems, the complete text of the GNU General Public +License version 2 can be found in `/usr/share/common-licenses/GPL-2'. diff --git a/scripts/rules-6.6 b/debian/rules old mode 100644 new mode 100755 similarity index 64% rename from scripts/rules-6.6 rename to debian/rules index e93929f..1cc07d8 --- a/scripts/rules-6.6 +++ b/debian/rules @@ -1,5 +1,6 @@ #!/usr/bin/make -f # SPDX-License-Identifier: GPL-2.0-only +# fork of include debian/rules.vars @@ -10,6 +11,10 @@ ifneq (,$(filter-out parallel=1,$(filter parallel=%,$(DEB_BUILD_OPTIONS)))) MAKEFLAGS += -j$(NUMJOBS) endif +# Get the metapackage name by listing the packages from d/control and +# picking the only one that starts with SD +METAPACKGE := $(shell dh_listpackages | grep "securedrop") + .PHONY: binary binary-indep binary-arch binary: binary-arch binary-indep binary-indep: build-indep @@ -17,6 +22,10 @@ binary-arch: build-arch $(MAKE) -f $(srctree)/Makefile ARCH=$(ARCH) \ KERNELRELEASE=$(KERNELRELEASE) \ run-command KBUILD_RUN_COMMAND=+$(srctree)/scripts/package/builddeb + sed -i s/#DEB_VERSION_UPSTREAM#/$(KERNELRELEASE)/ debian/$(METAPACKGE)/DEBIAN/postinst + chmod 775 debian/$(METAPACKGE)/DEBIAN/postinst + dpkg-gencontrol -p$(METAPACKGE) -P"debian/$(METAPACKGE)" + dpkg-deb --root-owner-group --build "debian/$(METAPACKGE)" .. .PHONY: build build-indep build-arch build: build-arch build-indep @@ -26,10 +35,6 @@ build-arch: KERNELRELEASE=$(KERNELRELEASE) \ $(shell $(srctree)/scripts/package/deb-build-option) \ olddefconfig all - sed -i s/#DEB_VERSION_UPSTREAM#/${version}/ debian/$metapackage/DEBIAN/postinst - chmod 775 debian/$metapackage/DEBIAN/postinst - dpkg-gencontrol -p$metapackage -P"debian/$metapackage" - dpkg-deb --root-owner-group --build "debian/$metapackage" .. .PHONY: clean clean: diff --git a/securedrop-grsec/DEBIAN/postinst b/debian/securedrop-grsec/DEBIAN/postinst similarity index 100% rename from securedrop-grsec/DEBIAN/postinst rename to debian/securedrop-grsec/DEBIAN/postinst diff --git a/securedrop-grsec/etc/default/grub.d/50-mds-smt.cfg b/debian/securedrop-grsec/etc/default/grub.d/50-mds-smt.cfg similarity index 100% rename from securedrop-grsec/etc/default/grub.d/50-mds-smt.cfg rename to debian/securedrop-grsec/etc/default/grub.d/50-mds-smt.cfg diff --git a/securedrop-grsec/etc/sysctl.d/30-securedrop.conf b/debian/securedrop-grsec/etc/sysctl.d/30-securedrop.conf similarity index 100% rename from securedrop-grsec/etc/sysctl.d/30-securedrop.conf rename to debian/securedrop-grsec/etc/sysctl.d/30-securedrop.conf diff --git a/securedrop-grsec/opt/securedrop/paxctld.conf b/debian/securedrop-grsec/opt/securedrop/paxctld.conf similarity index 100% rename from securedrop-grsec/opt/securedrop/paxctld.conf rename to debian/securedrop-grsec/opt/securedrop/paxctld.conf diff --git a/securedrop-workstation-grsec/DEBIAN/postinst b/debian/securedrop-workstation-grsec/DEBIAN/postinst similarity index 100% rename from securedrop-workstation-grsec/DEBIAN/postinst rename to debian/securedrop-workstation-grsec/DEBIAN/postinst diff --git a/securedrop-workstation-grsec/etc/default/grub.d/50-disable-mds-smt.cfg b/debian/securedrop-workstation-grsec/etc/default/grub.d/50-disable-mds-smt.cfg similarity index 100% rename from securedrop-workstation-grsec/etc/default/grub.d/50-disable-mds-smt.cfg rename to debian/securedrop-workstation-grsec/etc/default/grub.d/50-disable-mds-smt.cfg diff --git a/debian/source/format b/debian/source/format new file mode 100644 index 0000000..163aaf8 --- /dev/null +++ b/debian/source/format @@ -0,0 +1 @@ +3.0 (quilt) diff --git a/scripts/mkdebian-5.15 b/scripts/mkdebian-5.15 deleted file mode 100755 index cb6c46c..0000000 --- a/scripts/mkdebian-5.15 +++ /dev/null @@ -1,288 +0,0 @@ -#!/bin/sh -# SPDX-License-Identifier: GPL-2.0-only -# -# Copyright 2003 Wichert Akkerman -# -# Simple script to generate a debian/ directory for a Linux kernel. - -set -e - -is_enabled() { - grep -q "^$1=y" include/config/auto.conf -} - -if_enabled_echo() { - if is_enabled "$1"; then - echo -n "$2" - elif [ $# -ge 3 ]; then - echo -n "$3" - fi -} - -set_debarch() { - if [ -n "$KBUILD_DEBARCH" ] ; then - debarch="$KBUILD_DEBARCH" - return - fi - - # Attempt to find the correct Debian architecture - case "$UTS_MACHINE" in - i386|ia64|alpha|m68k|riscv*) - debarch="$UTS_MACHINE" ;; - x86_64) - debarch=amd64 ;; - sparc*) - debarch=sparc$(if_enabled_echo CONFIG_64BIT 64) ;; - s390*) - debarch=s390x ;; - ppc*) - if is_enabled CONFIG_64BIT; then - debarch=ppc64$(if_enabled_echo CONFIG_CPU_LITTLE_ENDIAN el) - else - debarch=powerpc$(if_enabled_echo CONFIG_SPE spe) - fi - ;; - parisc*) - debarch=hppa ;; - mips*) - if is_enabled CONFIG_CPU_LITTLE_ENDIAN; then - debarch=mips$(if_enabled_echo CONFIG_64BIT 64)$(if_enabled_echo CONFIG_CPU_MIPSR6 r6)el - elif is_enabled CONFIG_CPU_MIPSR6; then - debarch=mips$(if_enabled_echo CONFIG_64BIT 64)r6 - else - debarch=mips - fi - ;; - aarch64|arm64) - debarch=arm64 ;; - arm*) - if is_enabled CONFIG_AEABI; then - debarch=arm$(if_enabled_echo CONFIG_VFP hf el) - else - debarch=arm - fi - ;; - openrisc) - debarch=or1k ;; - sh) - if is_enabled CONFIG_CPU_SH3; then - debarch=sh3$(if_enabled_echo CONFIG_CPU_BIG_ENDIAN eb) - elif is_enabled CONFIG_CPU_SH4; then - debarch=sh4$(if_enabled_echo CONFIG_CPU_BIG_ENDIAN eb) - fi - ;; - esac - if [ -z "$debarch" ]; then - debarch=$(dpkg-architecture -qDEB_HOST_ARCH) - echo "" >&2 - echo "** ** ** WARNING ** ** **" >&2 - echo "" >&2 - echo "Your architecture doesn't have its equivalent" >&2 - echo "Debian userspace architecture defined!" >&2 - echo "Falling back to the current host architecture ($debarch)." >&2 - echo "Please add support for $UTS_MACHINE to ${0} ..." >&2 - echo "" >&2 - fi -} - -# Some variables and settings used throughout the script -version=$KERNELRELEASE -if [ -n "$KDEB_PKGVERSION" ]; then - packageversion=$KDEB_PKGVERSION - revision=${packageversion##*-} -else - revision=$(cat .version 2>/dev/null||echo 1) - packageversion=$version-$revision -fi -sourcename=$KDEB_SOURCENAME - -if [ "$ARCH" = "um" ] ; then - packagename=user-mode-linux -else - packagename=linux-image -fi - -debarch= -set_debarch - -email=${DEBEMAIL-$EMAIL} - -# use email string directly if it contains -if echo $email | grep -q '<.*>'; then - maintainer=$email -else - # or construct the maintainer string - user=${KBUILD_BUILD_USER-$(id -nu)} - name=${DEBFULLNAME-$user} - if [ -z "$email" ]; then - buildhost=${KBUILD_BUILD_HOST-$(hostname -f 2>/dev/null || hostname)} - email="$user@$buildhost" - fi - maintainer="$name <$email>" -fi - -# Try to determine distribution -if [ -n "$KDEB_CHANGELOG_DIST" ]; then - distribution=$KDEB_CHANGELOG_DIST -# In some cases lsb_release returns the codename as n/a, which breaks dpkg-parsechangelog -elif distribution=$(lsb_release -cs 2>/dev/null) && [ -n "$distribution" ] && [ "$distribution" != "n/a" ]; then - : # nothing to do in this case -else - distribution="unstable" - echo >&2 "Using default distribution of 'unstable' in the changelog" - echo >&2 "Install lsb-release or set \$KDEB_CHANGELOG_DIST explicitly" -fi - -mkdir -p debian/source/ -echo "1.0" > debian/source/format - -echo $debarch > debian/arch -extra_build_depends=", $(if_enabled_echo CONFIG_UNWINDER_ORC libelf-dev:native)" -extra_build_depends="$extra_build_depends, $(if_enabled_echo CONFIG_SYSTEM_TRUSTED_KEYRING libssl-dev:native)" - -# Support SOURCE_DATE_EPOCH in changelog for reproducible builds -packagetimestamp_opts= -if [ -n "$SOURCE_DATE_EPOCH" ]; then - packagetimestamp_opts="-d @$SOURCE_DATE_EPOCH" -fi -packagetimestamp="$(date -R $packagetimestamp_opts)" - -# Generate a simple changelog template -cat < debian/changelog -$sourcename ($packageversion) $distribution; urgency=low - - * Custom built Linux kernel. - - -- $maintainer $packagetimestamp -EOF - -# Generate copyright file -cat < debian/copyright -This is a packaged upstream version of the Linux kernel. - -Please see -for information on how to obtain the source code for this kernel build. - -Copyright: 1991 - 2022 Linus Torvalds and others. - -The git repository for mainline kernel development is at: -git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; version 2 dated June, 1991. - -On Debian GNU/Linux systems, the complete text of the GNU General Public -License version 2 can be found in \`/usr/share/common-licenses/GPL-2'. -EOF - -# Generate a control file -cat < debian/control -Source: $sourcename -Section: kernel -Priority: optional -Maintainer: $maintainer -Rules-Requires-Root: no -Build-Depends: bc, rsync, kmod, cpio, bison, flex | flex:native $extra_build_depends -Homepage: https://securedrop.org/ - -Package: $packagename-$version -Architecture: $debarch -Description: Linux kernel, version $version - This package contains the Linux kernel, modules and corresponding other - files, version: $version. - -Package: linux-libc-dev -Section: devel -Provides: linux-kernel-headers -Architecture: $debarch -Description: Linux support headers for userspace development - This package provides userspaces headers from the Linux kernel. These headers - are used by the installed headers for GNU glibc and other system libraries. -Multi-Arch: same -EOF - -if [ "$LOCALVERSION" = "-workstation" ]; then - metapackage="securedrop-workstation-grsec" -cat <> debian/control - -Package: securedrop-workstation-grsec -Section: admin -Architecture: $debarch -Pre-Depends: qubes-kernel-vm-support (>=4.0.31) -Depends: $packagename-$version, libelf-dev, paxctld -Description: Linux for SecureDrop Workstation template (meta-package) - Metapackage providing a grsecurity-patched Linux kernel for use in SecureDrop - Workstation Qubes templates. Depends on the most recently built patched kernel - maintained by FPF. - -EOF -else - metapackage="securedrop-grsec" -cat <> debian/control - -Package: securedrop-grsec -Section: admin -Architecture: $debarch -Depends: $packagename-$version, intel-microcode, amd64-microcode, paxctld -Description: Metapackage providing a grsecurity-patched Linux kernel for use - with SecureDrop. Depends on the most recently built patched kernel maintained - by FPF. Package also includes sysctl and PaX flags calls for GRUB. - -EOF -fi - -if is_enabled CONFIG_MODULES; then -cat <> debian/control - -Package: linux-headers-$version -Architecture: $debarch -Description: Linux kernel headers for $version on $debarch - This package provides kernel header files for $version on $debarch - . - This is useful for people who need to build external modules -EOF -fi - -if is_enabled CONFIG_DEBUG_INFO; then -cat <> debian/control - -Package: linux-image-$version-dbg -Section: debug -Architecture: $debarch -Description: Linux kernel debugging symbols for $version - This package will come in handy if you need to debug the kernel. It provides - all the necessary debug symbols for the kernel and its modules. -EOF -fi - -cat < debian/rules -#!$(command -v $MAKE) -f - -srctree ?= . - -build-indep: -build-arch: - \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} \ - KBUILD_BUILD_VERSION=${revision} -f \$(srctree)/Makefile - -build: build-arch - -binary-indep: -binary-arch: build-arch - \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} \ - KBUILD_BUILD_VERSION=${revision} -f \$(srctree)/Makefile intdeb-pkg - sed -i s/#DEB_VERSION_UPSTREAM#/${version}/ debian/$metapackage/DEBIAN/postinst - chmod 775 debian/$metapackage/DEBIAN/postinst - dpkg-gencontrol -p$metapackage -P"debian/$metapackage" - dpkg-deb --root-owner-group --build "debian/$metapackage" .. - -clean: - rm -rf debian/*tmp debian/files - \$(MAKE) clean - -binary: binary-arch -EOF -chmod +x debian/rules - -exit 0 diff --git a/scripts/mkdebian-6.6 b/scripts/mkdebian-6.6 deleted file mode 100644 index 5fe4f77..0000000 --- a/scripts/mkdebian-6.6 +++ /dev/null @@ -1,311 +0,0 @@ -#!/bin/sh -# SPDX-License-Identifier: GPL-2.0-only -# -# Copyright 2003 Wichert Akkerman -# -# Simple script to generate a debian/ directory for a Linux kernel. - -set -e - -is_enabled() { - grep -q "^$1=y" include/config/auto.conf -} - -if_enabled_echo() { - if is_enabled "$1"; then - echo -n "$2" - elif [ $# -ge 3 ]; then - echo -n "$3" - fi -} - -set_debarch() { - if [ -n "$KBUILD_DEBARCH" ] ; then - debarch="$KBUILD_DEBARCH" - return - fi - - # Attempt to find the correct Debian architecture - case "$UTS_MACHINE" in - i386|ia64|alpha|m68k|riscv*) - debarch="$UTS_MACHINE" ;; - x86_64) - debarch=amd64 ;; - sparc*) - debarch=sparc$(if_enabled_echo CONFIG_64BIT 64) ;; - s390*) - debarch=s390x ;; - ppc*) - if is_enabled CONFIG_64BIT; then - debarch=ppc64$(if_enabled_echo CONFIG_CPU_LITTLE_ENDIAN el) - else - debarch=powerpc$(if_enabled_echo CONFIG_SPE spe) - fi - ;; - parisc*) - debarch=hppa ;; - mips*) - if is_enabled CONFIG_CPU_LITTLE_ENDIAN; then - debarch=mips$(if_enabled_echo CONFIG_64BIT 64)$(if_enabled_echo CONFIG_CPU_MIPSR6 r6)el - elif is_enabled CONFIG_CPU_MIPSR6; then - debarch=mips$(if_enabled_echo CONFIG_64BIT 64)r6 - else - debarch=mips - fi - ;; - aarch64|arm64) - debarch=arm64 ;; - arm*) - if is_enabled CONFIG_AEABI; then - debarch=arm$(if_enabled_echo CONFIG_VFP hf el) - else - debarch=arm - fi - ;; - openrisc) - debarch=or1k ;; - sh) - if is_enabled CONFIG_CPU_SH3; then - debarch=sh3$(if_enabled_echo CONFIG_CPU_BIG_ENDIAN eb) - elif is_enabled CONFIG_CPU_SH4; then - debarch=sh4$(if_enabled_echo CONFIG_CPU_BIG_ENDIAN eb) - fi - ;; - esac - if [ -z "$debarch" ]; then - debarch=$(dpkg-architecture -qDEB_HOST_ARCH) - echo "" >&2 - echo "** ** ** WARNING ** ** **" >&2 - echo "" >&2 - echo "Your architecture doesn't have its equivalent" >&2 - echo "Debian userspace architecture defined!" >&2 - echo "Falling back to the current host architecture ($debarch)." >&2 - echo "Please add support for $UTS_MACHINE to ${0} ..." >&2 - echo "" >&2 - fi -} - -# Create debian/source/ if it is a source package build -gen_source () -{ - mkdir -p debian/source - - echo "3.0 (quilt)" > debian/source/format - - { - echo "diff-ignore" - echo "extend-diff-ignore = .*" - } > debian/source/local-options - - # Add .config as a patch - mkdir -p debian/patches - { - echo "Subject: Add .config" - echo "Author: ${maintainer}" - echo - echo "--- /dev/null" - echo "+++ linux/.config" - diff -u /dev/null "${KCONFIG_CONFIG}" | tail -n +3 - } > debian/patches/config.patch - echo config.patch > debian/patches/series - - "${srctree}/scripts/package/gen-diff-patch" debian/patches/diff.patch - if [ -s debian/patches/diff.patch ]; then - sed -i " - 1iSubject: Add local diff - 1iAuthor: ${maintainer} - 1i - " debian/patches/diff.patch - - echo diff.patch >> debian/patches/series - else - rm -f debian/patches/diff.patch - fi -} - -rm -rf debian -mkdir debian - -email=${DEBEMAIL-$EMAIL} - -# use email string directly if it contains -if echo "${email}" | grep -q '<.*>'; then - maintainer=${email} -else - # or construct the maintainer string - user=${KBUILD_BUILD_USER-$(id -nu)} - name=${DEBFULLNAME-${user}} - if [ -z "${email}" ]; then - buildhost=${KBUILD_BUILD_HOST-$(hostname -f 2>/dev/null || hostname)} - email="${user}@${buildhost}" - fi - maintainer="${name} <${email}>" -fi - -if [ "$1" = --need-source ]; then - gen_source -fi - -# Some variables and settings used throughout the script -version=$KERNELRELEASE -if [ -n "$KDEB_PKGVERSION" ]; then - packageversion=$KDEB_PKGVERSION -else - packageversion=$(${srctree}/scripts/setlocalversion --no-local ${srctree})-$($srctree/init/build-version) -fi -sourcename=${KDEB_SOURCENAME:-linux-upstream} - -if [ "$ARCH" = "um" ] ; then - packagename=user-mode-linux -else - packagename=linux-image -fi - -debarch= -set_debarch - -# Try to determine distribution -if [ -n "$KDEB_CHANGELOG_DIST" ]; then - distribution=$KDEB_CHANGELOG_DIST -# In some cases lsb_release returns the codename as n/a, which breaks dpkg-parsechangelog -elif distribution=$(lsb_release -cs 2>/dev/null) && [ -n "$distribution" ] && [ "$distribution" != "n/a" ]; then - : # nothing to do in this case -else - distribution="unstable" - echo >&2 "Using default distribution of 'unstable' in the changelog" - echo >&2 "Install lsb-release or set \$KDEB_CHANGELOG_DIST explicitly" -fi - -echo $debarch > debian/arch -extra_build_depends=", $(if_enabled_echo CONFIG_UNWINDER_ORC libelf-dev:native)" -extra_build_depends="$extra_build_depends, $(if_enabled_echo CONFIG_SYSTEM_TRUSTED_KEYRING libssl-dev:native)" - -# Support SOURCE_DATE_EPOCH in changelog for reproducible builds -packagetimestamp_opts= -if [ -n "$SOURCE_DATE_EPOCH" ]; then - packagetimestamp_opts="-d @$SOURCE_DATE_EPOCH" -fi -packagetimestamp="$(date -R $packagetimestamp_opts)" - -# Generate a simple changelog template -cat < debian/changelog -$sourcename ($packageversion) $distribution; urgency=low - - * Custom built Linux kernel. - - -- $maintainer $(date -R) -EOF - -# Generate copyright file -cat < debian/copyright -This is a packaged upstream version of the Linux kernel. - -Please see -for information on how to obtain the source code for this kernel build. - -Copyright: 1991 - 2024 Linus Torvalds and others. - -The git repository for mainline kernel development is at: -git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; version 2 dated June, 1991. - -On Debian GNU/Linux systems, the complete text of the GNU General Public -License version 2 can be found in \`/usr/share/common-licenses/GPL-2'. -EOF - -# Generate a control file -cat < debian/control -Source: $sourcename -Section: kernel -Priority: optional -Maintainer: $maintainer -Rules-Requires-Root: no -Build-Depends: bc, debhelper, rsync, kmod, cpio, bison, flex $extra_build_depends -Homepage: https://securedrop.org/ - -Package: $packagename-$version -Architecture: $debarch -Description: Linux kernel, version $version - This package contains the Linux kernel, modules and corresponding other - files, version: $version. -EOF - -if [ "${SRCARCH}" != um ]; then -cat <> debian/control - -Package: linux-libc-dev -Section: devel -Provides: linux-kernel-headers -Architecture: $debarch -Description: Linux support headers for userspace development - This package provides userspaces headers from the Linux kernel. These headers - are used by the installed headers for GNU glibc and other system libraries. -Multi-Arch: same -EOF - -if [ "$LOCALVERSION" = "-workstation" ]; then - metapackage="securedrop-workstation-grsec" -cat <> debian/control - -Package: securedrop-workstation-grsec -Section: admin -Architecture: $debarch -Pre-Depends: qubes-kernel-vm-support (>=4.0.31) -Depends: $packagename-$version, libelf-dev, paxctld -Description: Linux for SecureDrop Workstation template (meta-package) - Metapackage providing a grsecurity-patched Linux kernel for use in SecureDrop - Workstation Qubes templates. Depends on the most recently built patched kernel - maintained by FPF. - -EOF -else - metapackage="securedrop-grsec" -cat <> debian/control - -Package: securedrop-grsec -Section: admin -Architecture: $debarch -Depends: $packagename-$version, intel-microcode, amd64-microcode, paxctld -Description: Metapackage providing a grsecurity-patched Linux kernel for use - with SecureDrop. Depends on the most recently built patched kernel maintained - by FPF. Package also includes sysctl and PaX flags calls for GRUB. - -EOF -fi - -if is_enabled CONFIG_MODULES; then -cat <> debian/control - -Package: linux-headers-$version -Architecture: $debarch -Description: Linux kernel headers for $version on $debarch - This package provides kernel header files for $version on $debarch - . - This is useful for people who need to build external modules -EOF -fi -fi - -if is_enabled CONFIG_DEBUG_INFO; then -cat <> debian/control - -Package: linux-image-$version-dbg -Section: debug -Architecture: $debarch -Description: Linux kernel debugging symbols for $version - This package will come in handy if you need to debug the kernel. It provides - all the necessary debug symbols for the kernel and its modules. -EOF -fi - -cat < debian/rules.vars -ARCH := ${ARCH} -KERNELRELEASE := ${KERNELRELEASE} -EOF - -cp "${srctree}/scripts/package/debian/rules" debian/ - -exit 0