We are going to add pwru for packet drop related
trouble shooting, pwru by default requires kernel
with kprobe multi attachment, enable kernel config
for that.
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
set CONFIG_ARCH_STRICT_ALIGN=n to enable
CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS. this
allows loading BPF program with unaligned memory
access generated by clang, see [0].
this change might cause BPF program fail to load
in loongarch CPU models that require strict aligned
memory access.
[0]: https://github.com/vincentmli/BPFire/issues/69
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
rebase the kernel config from fedora loongarch kernel
6.12, and enable kernel BTF/BPF feature config
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
Initial list of changes required to build iso
and flash image successfully:
1 softwares require config.guess and config.stub
update with loongarch support
2 no rust build and no suricata which depends on rust
3 comment out python 3.10 lib-dynload and config-3.10-xxxMACHINExxx-linux-gnu
4 lfs/cdrom lfs/Config loongarch seems requiring capital EFI boot image name
to boot properly
5 comment out a few softwares that are not needed for now
iso can be installed to loongarch PC hard drive, but
fail to boot.
flash image can be dd to USB drive, then boot loongarch
PC from USB drive, then dd from USB drive to loongarch
PC hard drive
Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
This is a feature more and more tools start using now and will help to
keep performance of the OS up.
This was enabled on riscv64 already.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
this feature should not used by IPFire and there
is a possible unfixed race condition that can
used for a privilege elevation attack.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
To quote from the kernel documentation:
> Historically the kernel has allowed TIOCSTI, which will push
> characters into a controlling TTY. This continues to be used
> as a malicious privilege escalation mechanism, and provides no
> meaningful real-world utility any more. Its use is considered
> a dangerous legacy operation, and can be disabled on most
> systems.
>
> Say Y here only if you have confirmed that your system's
> userspace depends on this functionality to continue operating
> normally.
>
> Processes which run with CAP_SYS_ADMIN, such as BRLTTY, can
> use TIOCSTI even when this is set to N.
>
> This functionality can be changed at runtime with the
> dev.tty.legacy_tiocsti sysctl. This configuration option sets
> the default value of the sysctl.
This patch therefore proposes to no longer allow legacy TIOCSTI usage
in IPFire, given its security implications and the apparent lack of
legitimate usage.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
