Re: [PATCH ima-evm-utils v2 2/9] Add config for UML kernel

[Stefan Berger <stefanb@linux.ibm.com>]

On 1/12/23 07:24, Roberto Sassu wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>
> 
> Add config-uml, with test-specific options that are not enabled in the
> kernel configuration generated with 'make ARCH=um olddefconfig'. The new
> options will be merged with the merge_config.sh script from the kernel
> source code in a Github workflow step.
> 
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>

Acked-by: Stefan Berger <stefanb@linux.ibm.com>

> ---
>   config-uml | 235 +++++++++++++++++++++++++++++++++++++++++++++++++++++
>   1 file changed, 235 insertions(+)
>   create mode 100644 config-uml
> 
> diff --git a/config-uml b/config-uml
> new file mode 100644
> index 000000000000..2d3bb8ba8edb
> --- /dev/null
> +++ b/config-uml
> @@ -0,0 +1,235 @@
> +CONFIG_LOCALVERSION="-dont-use"
> +CONFIG_WATCH_QUEUE=y
> +CONFIG_AUDIT=y
> +CONFIG_AUDITSYSCALL=y
> +CONFIG_HZ_PERIODIC=y
> +CONFIG_LOG_BUF_SHIFT=17
> +CONFIG_USER_NS=y
> +CONFIG_PID_NS=y
> +CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y
> +CONFIG_KALLSYMS_ALL=y
> +CONFIG_SYSTEM_DATA_VERIFICATION=y
> +CONFIG_TRACEPOINTS=y
> +CONFIG_CON_CHAN="xterm"
> +CONFIG_SSL_CHAN="pty"
> +CONFIG_MODULE_SIG_FORMAT=y
> +CONFIG_MODULE_SIG=y
> +CONFIG_MODULE_SIG_FORCE=y
> +CONFIG_MODULE_SIG_ALL=y
> +CONFIG_MODULE_SIG_SHA1=y
> +CONFIG_MODULE_SIG_HASH="sha1"
> +CONFIG_MODULES_TREE_LOOKUP=y
> +CONFIG_BLK_DEBUG_FS=y
> +CONFIG_ASN1=y
> +CONFIG_UNINLINE_SPIN_UNLOCK=y
> +CONFIG_SLUB=y
> +CONFIG_COMPACTION=y
> +CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
> +CONFIG_MIGRATION=y
> +CONFIG_BLK_DEV_LOOP=y
> +CONFIG_LEGACY_PTY_COUNT=256
> +CONFIG_NULL_TTY=y
> +CONFIG_SERIAL_DEV_BUS=y
> +CONFIG_SERIAL_DEV_CTRL_TTYPORT=y
> +CONFIG_VALIDATE_FS_PARSER=y
> +CONFIG_EXT4_FS_POSIX_ACL=y
> +CONFIG_EXT4_FS_SECURITY=y
> +CONFIG_EXT4_DEBUG=y
> +CONFIG_REISERFS_FS_XATTR=y
> +CONFIG_REISERFS_FS_POSIX_ACL=y
> +CONFIG_REISERFS_FS_SECURITY=y
> +CONFIG_FS_POSIX_ACL=y
> +CONFIG_FS_VERITY=y
> +CONFIG_FS_VERITY_BUILTIN_SIGNATURES=y
> +CONFIG_TMPFS_POSIX_ACL=y
> +CONFIG_TMPFS_XATTR=y
> +CONFIG_CONFIGFS_FS=y
> +CONFIG_KEYS=y
> +CONFIG_ENCRYPTED_KEYS=y
> +CONFIG_SECURITY=y
> +CONFIG_SECURITYFS=y
> +CONFIG_SECURITY_NETWORK=y
> +CONFIG_SECURITY_PATH=y
> +CONFIG_INTEGRITY=y
> +CONFIG_INTEGRITY_SIGNATURE=y
> +CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
> +CONFIG_INTEGRITY_TRUSTED_KEYRING=y
> +CONFIG_INTEGRITY_AUDIT=y
> +CONFIG_IMA=y
> +CONFIG_IMA_MEASURE_PCR_IDX=10
> +CONFIG_IMA_NG_TEMPLATE=y
> +CONFIG_IMA_DEFAULT_TEMPLATE="ima-ng"
> +CONFIG_IMA_DEFAULT_HASH_SHA256=y
> +CONFIG_IMA_DEFAULT_HASH="sha256"
> +CONFIG_IMA_WRITE_POLICY=y
> +CONFIG_IMA_READ_POLICY=y
> +CONFIG_IMA_APPRAISE=y
> +CONFIG_IMA_ARCH_POLICY=y
> +CONFIG_IMA_APPRAISE_BUILD_POLICY=y
> +CONFIG_IMA_APPRAISE_BOOTPARAM=y
> +CONFIG_IMA_APPRAISE_MODSIG=y
> +CONFIG_IMA_TRUSTED_KEYRING=y
> +CONFIG_IMA_BLACKLIST_KEYRING=y
> +CONFIG_IMA_LOAD_X509=y
> +CONFIG_IMA_X509_PATH="/etc/keys/x509_ima.der"
> +CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS=y
> +CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS=y
> +CONFIG_EVM=y
> +CONFIG_EVM_ATTR_FSUUID=y
> +CONFIG_EVM_ADD_XATTRS=y
> +CONFIG_EVM_LOAD_X509=y
> +CONFIG_EVM_X509_PATH="/etc/keys/x509_evm.der"
> +CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,bpf"
> +CONFIG_CRYPTO_AEAD2=y
> +CONFIG_CRYPTO_SKCIPHER=y
> +CONFIG_CRYPTO_SKCIPHER2=y
> +CONFIG_CRYPTO_RNG=y
> +CONFIG_CRYPTO_RNG2=y
> +CONFIG_CRYPTO_RNG_DEFAULT=y
> +CONFIG_CRYPTO_AKCIPHER2=y
> +CONFIG_CRYPTO_AKCIPHER=y
> +CONFIG_CRYPTO_KPP2=y
> +CONFIG_CRYPTO_ACOMP2=y
> +CONFIG_CRYPTO_MANAGER=y
> +CONFIG_CRYPTO_MANAGER2=y
> +CONFIG_CRYPTO_NULL2=y
> +CONFIG_CRYPTO_RSA=y
> +CONFIG_CRYPTO_ECC=y
> +CONFIG_CRYPTO_ECDSA=y
> +CONFIG_CRYPTO_AES=y
> +CONFIG_CRYPTO_CBC=y
> +CONFIG_CRYPTO_HMAC=y
> +CONFIG_CRYPTO_MD5=y
> +CONFIG_CRYPTO_SHA1=y
> +CONFIG_CRYPTO_SHA256=y
> +CONFIG_CRYPTO_SHA512=y
> +CONFIG_CRYPTO_WP512=y
> +CONFIG_CRYPTO_LZO=y
> +CONFIG_CRYPTO_ZSTD=y
> +CONFIG_CRYPTO_DRBG_MENU=y
> +CONFIG_CRYPTO_DRBG_HMAC=y
> +CONFIG_CRYPTO_DRBG=y
> +CONFIG_CRYPTO_JITTERENTROPY=y
> +CONFIG_CRYPTO_HASH_INFO=y
> +CONFIG_ASYMMETRIC_KEY_TYPE=y
> +CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
> +CONFIG_X509_CERTIFICATE_PARSER=y
> +CONFIG_PKCS8_PRIVATE_KEY_PARSER=y
> +CONFIG_PKCS7_MESSAGE_PARSER=y
> +CONFIG_PKCS7_TEST_KEY=y
> +CONFIG_SIGNED_PE_FILE_VERIFICATION=y
> +CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
> +CONFIG_MODULE_SIG_KEY_TYPE_RSA=y
> +CONFIG_SYSTEM_TRUSTED_KEYRING=y
> +CONFIG_SYSTEM_TRUSTED_KEYS=""
> +CONFIG_SYSTEM_EXTRA_CERTIFICATE=y
> +CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE=4096
> +CONFIG_SECONDARY_TRUSTED_KEYRING=y
> +CONFIG_SYSTEM_BLACKLIST_KEYRING=y
> +CONFIG_SYSTEM_BLACKLIST_HASH_LIST=""
> +CONFIG_SYSTEM_REVOCATION_LIST=y
> +CONFIG_SYSTEM_REVOCATION_KEYS=""
> +CONFIG_SYSTEM_BLACKLIST_AUTH_UPDATE=y
> +CONFIG_BINARY_PRINTF=y
> +CONFIG_CRYPTO_LIB_AES=y
> +CONFIG_CRYPTO_LIB_SHA256=y
> +CONFIG_CRC_CCITT=y
> +CONFIG_XXHASH=y
> +CONFIG_AUDIT_GENERIC=y
> +CONFIG_LZO_COMPRESS=y
> +CONFIG_LZO_DECOMPRESS=y
> +CONFIG_ZSTD_COMMON=y
> +CONFIG_ZSTD_COMPRESS=y
> +CONFIG_ZSTD_DECOMPRESS=y
> +CONFIG_ASSOCIATIVE_ARRAY=y
> +CONFIG_SGL_ALLOC=y
> +CONFIG_GLOB=y
> +CONFIG_CLZ_TAB=y
> +CONFIG_MPILIB=y
> +CONFIG_SIGNATURE=y
> +CONFIG_OID_REGISTRY=y
> +CONFIG_STACKDEPOT=y
> +CONFIG_STACKDEPOT_ALWAYS_INIT=y
> +CONFIG_PRINTK_TIME=y
> +CONFIG_PRINTK_CALLER=y
> +CONFIG_DYNAMIC_DEBUG=y
> +CONFIG_DYNAMIC_DEBUG_CORE=y
> +CONFIG_DEBUG_INFO_DWARF5=y
> +CONFIG_GDB_SCRIPTS=y
> +CONFIG_FRAME_WARN=2048
> +CONFIG_READABLE_ASM=y
> +CONFIG_DEBUG_SECTION_MISMATCH=y
> +CONFIG_DEBUG_FS=y
> +CONFIG_DEBUG_FS_ALLOW_ALL=y
> +CONFIG_UBSAN=y
> +CONFIG_CC_HAS_UBSAN_BOUNDS=y
> +CONFIG_UBSAN_BOUNDS=y
> +CONFIG_UBSAN_ONLY_BOUNDS=y
> +CONFIG_UBSAN_SHIFT=y
> +CONFIG_UBSAN_DIV_ZERO=y
> +CONFIG_UBSAN_BOOL=y
> +CONFIG_UBSAN_ENUM=y
> +CONFIG_UBSAN_ALIGNMENT=y
> +CONFIG_PAGE_EXTENSION=y
> +CONFIG_DEBUG_PAGEALLOC=y
> +CONFIG_DEBUG_PAGEALLOC_ENABLE_DEFAULT=y
> +CONFIG_SLUB_DEBUG=y
> +CONFIG_SLUB_DEBUG_ON=y
> +CONFIG_PAGE_OWNER=y
> +CONFIG_PAGE_POISONING=y
> +CONFIG_DEBUG_OBJECTS=y
> +CONFIG_DEBUG_OBJECTS_FREE=y
> +CONFIG_DEBUG_OBJECTS_TIMERS=y
> +CONFIG_DEBUG_OBJECTS_WORK=y
> +CONFIG_DEBUG_OBJECTS_RCU_HEAD=y
> +CONFIG_DEBUG_OBJECTS_PERCPU_COUNTER=y
> +CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT=1
> +CONFIG_DEBUG_KMEMLEAK=y
> +CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE=16000
> +CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN=y
> +CONFIG_DEBUG_STACK_USAGE=y
> +CONFIG_SCHED_STACK_END_CHECK=y
> +CONFIG_DEBUG_SHIRQ=y
> +CONFIG_PANIC_ON_OOPS=y
> +CONFIG_PANIC_ON_OOPS_VALUE=1
> +CONFIG_LOCKUP_DETECTOR=y
> +CONFIG_SOFTLOCKUP_DETECTOR=y
> +CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
> +CONFIG_DETECT_HUNG_TASK=y
> +CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120
> +CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
> +CONFIG_WQ_WATCHDOG=y
> +CONFIG_DEBUG_TIMEKEEPING=y
> +CONFIG_PROVE_LOCKING=y
> +CONFIG_PROVE_RAW_LOCK_NESTING=y
> +CONFIG_LOCK_STAT=y
> +CONFIG_DEBUG_RT_MUTEXES=y
> +CONFIG_DEBUG_SPINLOCK=y
> +CONFIG_DEBUG_MUTEXES=y
> +CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y
> +CONFIG_DEBUG_RWSEMS=y
> +CONFIG_DEBUG_LOCK_ALLOC=y
> +CONFIG_LOCKDEP=y
> +CONFIG_LOCKDEP_BITS=15
> +CONFIG_LOCKDEP_CHAINS_BITS=16
> +CONFIG_LOCKDEP_STACK_TRACE_BITS=19
> +CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
> +CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12
> +CONFIG_WW_MUTEX_SELFTEST=y
> +CONFIG_CSD_LOCK_WAIT_DEBUG=y
> +CONFIG_TRACE_IRQFLAGS=y
> +CONFIG_DEBUG_IRQFLAGS=y
> +CONFIG_DEBUG_LIST=y
> +CONFIG_DEBUG_PLIST=y
> +CONFIG_DEBUG_SG=y
> +CONFIG_DEBUG_NOTIFIERS=y
> +CONFIG_BUG_ON_DATA_CORRUPTION=y
> +CONFIG_PROVE_RCU=y
> +CONFIG_RCU_TRACE=y
> +CONFIG_NOP_TRACER=y
> +CONFIG_TRACE_CLOCK=y
> +CONFIG_RING_BUFFER=y
> +CONFIG_EVENT_TRACING=y
> +CONFIG_CONTEXT_SWITCH_TRACER=y
> +CONFIG_PREEMPTIRQ_TRACEPOINTS=y
> +CONFIG_TRACING=y