Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 834918 - sys-kernel/gentoo-kernel: add apparmor support
Summary: sys-kernel/gentoo-kernel: add apparmor support
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Distribution Kernel Project
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-03-10 14:14 UTC by Joonas Niilola
Modified: 2022-03-20 19:10 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Joonas Niilola gentoo-dev 2022-03-10 14:14:29 UTC 
Hey, 

can we add apparmor support to dist kernels? The following options are needed/enabled:

--- /var/tmp/portage/sys-kernel/gentoo-kernel-5.15.24/work/modprep/.config	2022-03-10 15:40:39.660656219 +0200
+++ ./apparmord.config	2022-03-10 15:40:08.997377856 +0200
@@ -8451,7 +8451,10 @@
 CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE=256
 # CONFIG_SECURITY_SMACK is not set
 # CONFIG_SECURITY_TOMOYO is not set
-# CONFIG_SECURITY_APPARMOR is not set
+CONFIG_SECURITY_APPARMOR=y
+CONFIG_SECURITY_APPARMOR_HASH=y
+CONFIG_SECURITY_APPARMOR_HASH_DEFAULT=y
+# CONFIG_SECURITY_APPARMOR_DEBUG is not set
 # CONFIG_SECURITY_LOADPIN is not set
 CONFIG_SECURITY_YAMA=y
 # CONFIG_SECURITY_SAFESETID is not set
@@ -8483,6 +8486,7 @@
 CONFIG_EVM_ATTR_FSUUID=y
 # CONFIG_EVM_ADD_XATTRS is not set
 # CONFIG_DEFAULT_SECURITY_SELINUX is not set
+# CONFIG_DEFAULT_SECURITY_APPARMOR is not set
 CONFIG_DEFAULT_SECURITY_DAC=y
 CONFIG_LSM="yama"

Note that the parts:
 # CONFIG_DEFAULT_SECURITY_SELINUX is not set
 # CONFIG_DEFAULT_SECURITY_APPARMOR is not set

requires one to be selected via boot parameters, and therefore this shouldn't break anyone's setup.
Comment 1 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2022-03-17 09:27:05 UTC 
Could you submit a PR to https://github.com/mgorny/gentoo-kernel-config ?
Comment 2 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2022-03-20 19:07:37 UTC 
Now in the following kernels:

gentoo-kernel-5.10.107.ebuild
gentoo-kernel-5.15.30.ebuild
gentoo-kernel-5.16.16.ebuild
gentoo-kernel-5.4.186.ebuild