vyos-build.git/packages/linux-kernel/arch, branch currentVyOS image build scripts (mirror of https://github.com/vyos/vyos-build.git)
https://git.amelek.net/vyos/vyos-build.git/atom?h=current2024-10-02T08:02:51+00:00T6754: Delete Jenkins build packages2024-10-02T08:02:51+00:00Viacheslav Hletenkov.gletenko@vyos.io2024-10-02T08:02:51+00:00urn:sha1:2fed892f2746561207aa21a2660f4d8f3f79d24eT861: sign all Kernel modules with an ephemeral key2024-09-25T18:24:21+00:00Christian Breunigchristian@breunig.cc2024-09-25T18:24:21+00:00urn:sha1:d235b31a095f9b8fdb2d5c231935c8b4b4c3da6c
The shim review board (which is the secure boot base loader) recommends using
ephemeral keys when signing the Linux Kernel. This commit enables the Kernel
build system to generate a one-time ephemeral key that is used to:
* sign all build-in Kernel modules
* sign all other out-of-tree Kernel modules
The key lives in /tmp and is destroyed after the build container exits and is
named: "VyOS build time autogenerated kernel key".
In addition the Kernel now uses CONFIG_MODULE_SIG_FORCE. This now makes it
unable to load any Kernel Module to the image that is NOT signed by the
ephemeral key.
Kernel: T5887: disable various unused/not needed debug options2024-09-22T07:31:31+00:00Christian Breunigchristian@breunig.cc2024-09-21T19:01:31+00:00urn:sha1:b2945a4753c90b30df1870df76ce8e9a894308bfMerge pull request #763 from c-po/secure-boot2024-09-16T09:27:21+00:00Viacheslav Hletenkov.gletenko@vyos.io2024-09-16T09:27:21+00:00urn:sha1:5255ad102a0df86ccc251c7a9bf51f798cb95bf8
T861: add UEFI Secure Boot supportT861: add UEFI Secure Boot support2024-09-14T21:05:23+00:00Christian Breunigchristian@breunig.cc2024-09-04T19:37:11+00:00urn:sha1:fd737172f1068870fe1ededbe9b2ed4a86663acd
This adds support for UEFI Secure Boot. It adds the missing pieces to the Linux
Kernel and enforces module signing. This results in an additional security
layer where untrusted (unsigned) Kernel modules can no longer be loaded into
the live system.
NOTE: This commit will not work unless signing keys are present. Arbitrary
keys can be generated using instructions found in:
data/live-build-config/includes.chroot/var/lib/shim-signed/mok/README.md
T6703: add support for amd pstate driver2024-09-06T08:30:11+00:00Nicolas Vollmarnvo@scaling.ch2024-09-06T08:29:55+00:00urn:sha1:01085c0512deea6031f503d6468717aca9728ad0linux-kernel: T6485: build modules for thunderbolt and thunderbolt-net2024-08-20T07:41:12+00:00Rafael Antunesrafael.gaspar@me.com2024-06-14T08:45:41+00:00urn:sha1:23970427436bc0c7c5ac503b32bbc87a3a26e629T6584: Revert "T6293: add Mediatek MT7921 to defconfig"2024-07-17T06:47:38+00:00Christian Breunigchristian@breunig.cc2024-07-17T06:47:38+00:00urn:sha1:faf191ed858373fab0f4add7edadd40e64f11f2e
This reverts commit dbf7e47a27537a9c298afd665244b7bc2b6cf5f6.
T6406: enables CONFIG_CFS_BANDWIDTH for cpu cgroup limits2024-05-27T14:32:28+00:00Nicolas Vollmarnvollmar@gmail.com2024-05-27T14:32:28+00:00urn:sha1:707c073f7ce5edab02d71f36c38f44bb39d8d6faKernel: T6406: enables CONFIG_CGROUP_CPUACCT2024-05-27T11:22:51+00:00Nicolas Vollmarnvollmar@gmail.com2024-05-27T11:22:51+00:00urn:sha1:b809886538eaad66b8756be8f5e758584f88e6a6