Skip to content

Kernel flags for apparmor #275

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Kernel flags for apparmor #275

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b2d1f05
kernel flags for apparmor
dashaub Jan 8, 2021
2d1e989
shellcheck fixes
dashaub Jan 8, 2021
de7da32
more apparmor settings
dashaub Jan 13, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion kernel/packages/prawnos-linux-image-armhf/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
prawnos linux kernel images have 3 version numbers, each representing a different type of change. This is to keep versioning organized, and to make the debian packaging system happy.

the format is:
`prawnos-linus-image-armhf_<upstream_kver>-<prawnos_kver>-<debian_package_ver>`
`prawnos-linux-image-armhf_<upstream_kver>-<prawnos_kver>-<debian_package_ver>`

upstream_kver changes with a new version of the linux kernel
prawnos_kver changes when new patches are added or a config change occurs
Expand Down
13 changes: 8 additions & 5 deletions kernel/resources/armhf/libre-config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5757,9 +5757,12 @@ CONFIG_KEYS=y
# CONFIG_TRUSTED_KEYS is not set
CONFIG_ENCRYPTED_KEYS=y
# CONFIG_KEY_DH_OPERATIONS is not set
# CONFIG_SECURITY_DMESG_RESTRICT is not set
CONFIG_SECURITY_DMESG_RESTRICT=y
CONFIG_SECURITY=y
CONFIG_SECURITYFS=y
CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1
CONFIG_SECURITY_APPARMOR_HASH=y
SECURITY_APPARMOR_HASH_DEFAULT=y
CONFIG_SECURITY_NETWORK=y
# CONFIG_SECURITY_NETWORK_XFRM is not set
CONFIG_SECURITY_PATH=y
Expand All @@ -5772,7 +5775,7 @@ CONFIG_HARDENED_USERCOPY_FALLBACK=y
CONFIG_STATIC_USERMODEHELPER=y
CONFIG_STATIC_USERMODEHELPER_PATH="/sbin/usermode-helper"
CONFIG_SECURITY_SELINUX=y
CONFIG_SECURITY_SELINUX_BOOTPARAM=y
# CONFIG_SECURITY_SELINUX_BOOTPARAM is not set
# CONFIG_SECURITY_SELINUX_DISABLE is not set
CONFIG_SECURITY_SELINUX_DEVELOP=y
CONFIG_SECURITY_SELINUX_AVC_STATS=y
Expand All @@ -5781,7 +5784,7 @@ CONFIG_SECURITY_SELINUX_SIDTAB_HASH_BITS=9
CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE=256
# CONFIG_SECURITY_SMACK is not set
# CONFIG_SECURITY_TOMOYO is not set
# CONFIG_SECURITY_APPARMOR is not set
CONFIG_SECURITY_APPARMOR=y
CONFIG_SECURITY_LOADPIN=y
# CONFIG_SECURITY_LOADPIN_ENFORCE is not set
CONFIG_SECURITY_YAMA=y
Expand All @@ -5792,10 +5795,10 @@ CONFIG_INTEGRITY=y
CONFIG_INTEGRITY_AUDIT=y
# CONFIG_IMA is not set
# CONFIG_EVM is not set
CONFIG_DEFAULT_SECURITY_SELINUX=y
CONFIG_DEFAULT_SECURITY_APPARMOR=y
# CONFIG_DEFAULT_SECURITY_SELINUX is not set
# CONFIG_DEFAULT_SECURITY_DAC is not set
CONFIG_LSM="yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor"

#
# Kernel hardening options
#
Expand Down
2 changes: 1 addition & 1 deletion kernel/resources/shared/FlashKernelPartition.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ get_emmc_devname() {
local devname=$(ls /dev/mmcblk* | grep -F boot0 | sed "s/boot0//")
if [ -z "$devname" ]
then
echo "Unknown device! can't determine emmc devname. Please file an issue with the output of fdisk -l if you get this on a supported device"; exit 1;;
echo "Unknown device! can't determine emmc devname. Please file an issue with the output of fdisk -l if you get this on a supported device"; exit 1;
fi
echo $devname
}
Expand Down
2 changes: 1 addition & 1 deletion scripts/InstallScripts/InstallPackages.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ get_emmc_devname() {
local devname=$(ls /dev/mmcblk* | grep -F boot0 | sed "s/boot0//")
if [ -z "$devname" ]
then
echo "Unknown device! can't determine emmc devname. Please file an issue with the output of fdisk -l if you get this on a supported device"; exit 1;;
echo "Unknown device! can't determine emmc devname. Please file an issue with the output of fdisk -l if you get this on a supported device"; exit 1;
fi
echo $devname
}
Expand Down
2 changes: 1 addition & 1 deletion scripts/InstallScripts/InstallPrawnOS.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ get_emmc_devname() {
local devname=$(ls /dev/mmcblk* | grep -F boot0 | sed "s/boot0//")
if [ -z "$devname" ]
then
echo "Unknown device! can't determine emmc devname. Please file an issue with the output of fdisk -l if you get this on a supported device"; exit 1;;
echo "Unknown device! can't determine emmc devname. Please file an issue with the output of fdisk -l if you get this on a supported device"; exit 1;
fi
echo $devname
}
Expand Down