mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-14 04:59:28 +08:00
46 lines
1.3 KiB
Plaintext
46 lines
1.3 KiB
Plaintext
# Custom kernel config fragment for libkrunfw (OpenShell VM)
|
|
#
|
|
# This fragment is applied on top of libkrunfw's base kernel config. VM
|
|
# sandboxes have no virtual NIC; the base loopback, TCP/UDP, Unix-socket,
|
|
# route-netlink, and vsock support is enough for the capability-free sandbox.
|
|
#
|
|
# Apply with: scripts/merge-kconfig.sh <base_config> <this_file>
|
|
#
|
|
# See also: check-vm-capabilities.sh for runtime verification.
|
|
|
|
# Root disk transport and filesystem.
|
|
CONFIG_BLOCK=y
|
|
CONFIG_BLK_DEV=y
|
|
CONFIG_VIRTIO_BLK=y
|
|
CONFIG_EXT4_FS=y
|
|
CONFIG_EXT4_USE_FOR_EXT2=y
|
|
|
|
# Cgroups used for process supervision and resource limits.
|
|
CONFIG_CGROUPS=y
|
|
CONFIG_CGROUP_DEVICE=y
|
|
CONFIG_CGROUP_CPUACCT=y
|
|
CONFIG_CGROUP_PIDS=y
|
|
CONFIG_MEMCG=y
|
|
|
|
# Disable the kernel headers archive to avoid cpio issues in CI.
|
|
# CONFIG_IKHEADERS is not set
|
|
|
|
# POSIX message queues used by OCI workloads.
|
|
CONFIG_POSIX_MQUEUE=y
|
|
CONFIG_POSIX_MQUEUE_SYSCTL=y
|
|
|
|
# Capability-free sandbox enforcement.
|
|
CONFIG_SECURITY=y
|
|
CONFIG_SECURITY_LANDLOCK=y
|
|
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,ipe,bpf"
|
|
CONFIG_SECCOMP=y
|
|
CONFIG_SECCOMP_FILTER=y
|
|
|
|
# Kernel memory hardening. Keep init-on-free disabled because its runtime cost
|
|
# is too high for sandbox workloads.
|
|
CONFIG_HARDENED_USERCOPY=y
|
|
CONFIG_INIT_STACK_ALL_ZERO=y
|
|
CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
|
|
# CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
|
|
CONFIG_SLAB_FREELIST_RANDOM=y
|