# Custom kernel config fragment for libkrunfw (OpenShell VM)
#
# This fragment is applied on top of libkrunfw's base kernel config. VM
# sandboxes have no virtual NIC; the base loopback, TCP/UDP, Unix-socket,
# route-netlink, and vsock support is enough for the capability-free sandbox.
#
# Apply with: scripts/merge-kconfig.sh <base_config> <this_file>
#
# See also: check-vm-capabilities.sh for runtime verification.

# Root disk transport and filesystem.
CONFIG_BLOCK=y
CONFIG_BLK_DEV=y
CONFIG_VIRTIO_BLK=y
CONFIG_EXT4_FS=y
CONFIG_EXT4_USE_FOR_EXT2=y

# Cgroups used for process supervision and resource limits.
CONFIG_CGROUPS=y
CONFIG_CGROUP_DEVICE=y
CONFIG_CGROUP_CPUACCT=y
CONFIG_CGROUP_PIDS=y
CONFIG_MEMCG=y

# Disable the kernel headers archive to avoid cpio issues in CI.
# CONFIG_IKHEADERS is not set

# POSIX message queues used by OCI workloads.
CONFIG_POSIX_MQUEUE=y
CONFIG_POSIX_MQUEUE_SYSCTL=y

# Capability-free sandbox enforcement.
CONFIG_SECURITY=y
CONFIG_SECURITY_LANDLOCK=y
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,ipe,bpf"
CONFIG_SECCOMP=y
CONFIG_SECCOMP_FILTER=y

# Kernel memory hardening. Keep init-on-free disabled because its runtime cost
# is too high for sandbox workloads.
CONFIG_HARDENED_USERCOPY=y
CONFIG_INIT_STACK_ALL_ZERO=y
CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
# CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
CONFIG_SLAB_FREELIST_RANDOM=y