diff --git a/Pkgfile b/Pkgfile index 2ecd193c1..fe2d14d87 100644 --- a/Pkgfile +++ b/Pkgfile @@ -3,9 +3,9 @@ format: v1alpha2 vars: - TOOLCHAIN_MUSL_IMAGE: ghcr.io/siderolabs/toolchain-musl:v1.14.0-3-g386b969 + TOOLCHAIN_MUSL_IMAGE: ghcr.io/siderolabs/toolchain-musl:v1.14.0-4-gebafe88 TOOLS_PREFIX: ghcr.io/siderolabs/ - TOOLS_REV: v1.14.0-5-g87316ca + TOOLS_REV: v1.14.0-7-ga404efb LLVM_IMAGE: ghcr.io/siderolabs/llvm RUSTC_IMAGE: ghcr.io/siderolabs/rustc:v1.14.0 @@ -15,10 +15,10 @@ vars: cni_sha512: 5811fb14786f1f9d9e40741ce337449ce329e14e04213bc660102eb470150f24026e59caec480572e37d0e3e6e6518737f3cc7ac462c47034d0737283ec532f9 # renovate: datasource=github-tags depName=containerd/containerd - containerd_version: v2.3.4 - containerd_ref: db8809540e1a7a9da5d518876894933ff55692ab - containerd_sha256: 175bbf57d637c987fa742f846b43b1b8ba2c61af6a9eaec619c625e4a8a19b69 - containerd_sha512: cf8be1759399fb9e3b7c84d353a876b8f599b74fb3094a288333cf0b61a743b74484cbde7eab96576b214c92caf7de65ef94813bb3670e079585c371a438f6b4 + containerd_version: v2.3.5 + containerd_ref: 1294c24a7da8e5a793ed378161673abe94118892 + containerd_sha256: a99a4dca98061064ff4cb35d27d1ec2345717e9108c822329fcec91dc72bff96 + containerd_sha512: 87255f36b2b2fb5fc2cb7abaadae33c2ea85b5f7a1259c8c52cc3cf3efffa64525886a220eadf804b7c6414babe7310d39fddc6a24e79b707770fb621323f5c8 # renovate: datasource=github-tags depName=kdave/btrfs-progs btrfsprogs_version: 6.19.1 @@ -104,9 +104,9 @@ vars: kspp_sha512: 2b40c41ed0347a339053aef61c838b5131dd583fb0d1ac8f3361040361ba868724ad16dfdc13023ff2b0f51f32c0aba605316d5d76f9fc6c1d50d90b4ceedead # renovate: datasource=git-tags extractVersion=^v(?.*)$ depName=git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git - linux_version: 6.18.48 - linux_sha256: 5ebdadb10a4b5708fc6b1c457764a110bc49f8150cc3502c59b921ead8c6fc8c - linux_sha512: 711e08958a8a4c39206018d0222687dc5a01845a9226ae44f7d3f0cfcea76caae041cee958dfe8c0cfc8c728a5a2241b29018ccf1b7593b9615c27057d2628c4 + linux_version: 6.18.51 + linux_sha256: ba2f60f858bf4d1f929101faa356c93dc8b925b17aaa9f95eabd4627758df613 + linux_sha512: 482c68c483c8317db0266fcdce54bc7028ba2a2e0d410af5995258efa21d4f8246dcbded43c09da7cc0b272148ee34c422d840d66dbf7ebb9d57c295dc770bea # renovate: datasource=git-tags extractVersion=^libaio-(?.*)$ depName=https://pagure.io/libaio.git libaio_version: 0.3.113 @@ -175,9 +175,9 @@ vars: # NOTE: keep in sync with the libpathrs version required by runc: https://github.com/opencontainers/runc/blob/release-1.5/script/build-libpathrs.sh # renovate: datasource=github-releases depName=cyphar/libpathrs - libpathrs_version: v0.2.5 - libpathrs_sha256: f8f4a9419eb839cd5decbd120b65f0495bf6eac07155477fe39a8c2a23da589d - libpathrs_sha512: 009a6aa91d4ef5ccae011f39def4cf7ffc626fd7def9e9cbcf7c827d813215811719c44674e68192d3f4770c7968f2e7de7c13b27c7e53807f0aa0f4ba5c428f + libpathrs_version: v0.2.6 + libpathrs_sha256: 7b1e3a2c3cc0bd9f94187edbb6d1ba9737deb2bf7f724df1ee37653ea405b2b0 + libpathrs_sha512: e48a3e2ed8c8403c95621f1f98ae7e95cd86f733894c73478742772852eca2aa52ff99af27e43c2997f3c658cf4f5cb4f86c46c6ec7dcb3b3ddfc3a60797dd17 # renovate: datasource=github-releases extractVersion=^popt-(?.*)-release$ depName=rpm-software-management/popt libpopt_version: 1.19 diff --git a/kernel/build/config-amd64 b/kernel/build/config-amd64 index dc13c721b..95c07611a 100644 --- a/kernel/build/config-amd64 +++ b/kernel/build/config-amd64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.18.48 Kernel Configuration +# Linux/x86 6.18.51 Kernel Configuration # CONFIG_CC_VERSION_TEXT="clang version 22.1.8" CONFIG_GCC_VERSION=0 @@ -634,6 +634,7 @@ CONFIG_ACPI_HOTPLUG_IOAPIC=y CONFIG_ACPI_HED=y CONFIG_ACPI_BGRT=y # CONFIG_ACPI_REDUCED_HARDWARE_ONLY is not set +CONFIG_ACPI_NHLT=y # CONFIG_ACPI_NFIT is not set CONFIG_ACPI_NUMA=y CONFIG_ACPI_HMAT=y @@ -1302,7 +1303,7 @@ CONFIG_XFRM_OFFLOAD=y CONFIG_XFRM_ALGO=y CONFIG_XFRM_USER=y # CONFIG_XFRM_USER_COMPAT is not set -# CONFIG_XFRM_INTERFACE is not set +CONFIG_XFRM_INTERFACE=m # CONFIG_XFRM_SUB_POLICY is not set # CONFIG_XFRM_MIGRATE is not set CONFIG_XFRM_STATISTICS=y @@ -3000,7 +3001,7 @@ CONFIG_MARVELL_10G_PHY=y # CONFIG_MEDIATEK_GE_PHY is not set # CONFIG_MICREL_PHY is not set # CONFIG_MICROCHIP_T1S_PHY is not set -# CONFIG_MICROCHIP_PHY is not set +CONFIG_MICROCHIP_PHY=m # CONFIG_MICROCHIP_T1_PHY is not set # CONFIG_MICROSEMI_PHY is not set # CONFIG_MOTORCOMM_PHY is not set @@ -3069,7 +3070,7 @@ CONFIG_USB_NET_DRIVERS=y # CONFIG_USB_PEGASUS is not set # CONFIG_USB_RTL8150 is not set CONFIG_USB_RTL8152=m -# CONFIG_USB_LAN78XX is not set +CONFIG_USB_LAN78XX=m CONFIG_USB_USBNET=m CONFIG_USB_NET_AX8817X=m CONFIG_USB_NET_AX88179_178A=m @@ -5226,12 +5227,16 @@ CONFIG_SOUND=m CONFIG_SND=m CONFIG_SND_TIMER=m CONFIG_SND_PCM=m +CONFIG_SND_PCM_ELD=y CONFIG_SND_HWDEP=m CONFIG_SND_RAWMIDI=m +CONFIG_SND_JACK=y +CONFIG_SND_JACK_INPUT_DEV=y # CONFIG_SND_OSSEMUL is not set CONFIG_SND_PCM_TIMER=y # CONFIG_SND_HRTIMER is not set -# CONFIG_SND_DYNAMIC_MINORS is not set +CONFIG_SND_DYNAMIC_MINORS=y +CONFIG_SND_MAX_CARDS=32 CONFIG_SND_SUPPORT_OLD_API=y CONFIG_SND_PROC_FS=y CONFIG_SND_VERBOSE_PROCFS=y @@ -5239,7 +5244,9 @@ CONFIG_SND_CTL_FAST_LOOKUP=y # CONFIG_SND_DEBUG is not set # CONFIG_SND_CTL_INPUT_VALIDATION is not set # CONFIG_SND_UTIMER is not set +CONFIG_SND_VMASTER=y CONFIG_SND_DMA_SGBUF=y +CONFIG_SND_CTL_LED=m # CONFIG_SND_SEQUENCER is not set CONFIG_SND_DRIVERS=y # CONFIG_SND_PCSP is not set @@ -5319,8 +5326,57 @@ CONFIG_SND_PCI=y # # HD-Audio # -# CONFIG_SND_HDA_INTEL is not set +CONFIG_SND_HDA=m +# CONFIG_SND_HDA_HWDEP is not set +# CONFIG_SND_HDA_RECONFIG is not set +# CONFIG_SND_HDA_INPUT_BEEP is not set +# CONFIG_SND_HDA_PATCH_LOADER is not set +CONFIG_SND_HDA_POWER_SAVE_DEFAULT=0 +# CONFIG_SND_HDA_CTL_DEV_ID is not set +CONFIG_SND_HDA_PREALLOC_SIZE=0 +CONFIG_SND_HDA_INTEL=m # CONFIG_SND_HDA_ACPI is not set +CONFIG_SND_HDA_GENERIC_LEDS=y +# CONFIG_SND_HDA_CODEC_ANALOG is not set +# CONFIG_SND_HDA_CODEC_SIGMATEL is not set +# CONFIG_SND_HDA_CODEC_VIA is not set +# CONFIG_SND_HDA_CODEC_CONEXANT is not set +# CONFIG_SND_HDA_CODEC_SENARYTECH is not set +# CONFIG_SND_HDA_CODEC_CA0110 is not set +# CONFIG_SND_HDA_CODEC_CA0132 is not set +# CONFIG_SND_HDA_CODEC_CMEDIA is not set +# CONFIG_SND_HDA_CODEC_CM9825 is not set +# CONFIG_SND_HDA_CODEC_SI3054 is not set +CONFIG_SND_HDA_GENERIC=m +CONFIG_SND_HDA_CODEC_REALTEK=m +CONFIG_SND_HDA_CODEC_REALTEK_LIB=m +CONFIG_SND_HDA_CODEC_ALC260=m +CONFIG_SND_HDA_CODEC_ALC262=m +CONFIG_SND_HDA_CODEC_ALC268=m +CONFIG_SND_HDA_CODEC_ALC269=m +CONFIG_SND_HDA_CODEC_ALC662=m +CONFIG_SND_HDA_CODEC_ALC680=m +CONFIG_SND_HDA_CODEC_ALC861=m +CONFIG_SND_HDA_CODEC_ALC861VD=m +CONFIG_SND_HDA_CODEC_ALC880=m +CONFIG_SND_HDA_CODEC_ALC882=m +# CONFIG_SND_HDA_CODEC_CIRRUS is not set +CONFIG_SND_HDA_CODEC_HDMI=m +CONFIG_SND_HDA_CODEC_HDMI_GENERIC=m +CONFIG_SND_HDA_CODEC_HDMI_SIMPLE=m +CONFIG_SND_HDA_CODEC_HDMI_INTEL=m +# CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM is not set +CONFIG_SND_HDA_CODEC_HDMI_ATI=m +CONFIG_SND_HDA_CODEC_HDMI_NVIDIA=m +CONFIG_SND_HDA_CODEC_HDMI_NVIDIA_MCP=m +CONFIG_SND_HDA_CODEC_HDMI_TEGRA=m +CONFIG_SND_HDA_SCODEC_COMPONENT=m +CONFIG_SND_HDA_CORE=m +CONFIG_SND_HDA_COMPONENT=y +CONFIG_SND_HDA_I915=y +CONFIG_SND_INTEL_NHLT=y +CONFIG_SND_INTEL_DSP_CONFIG=m +CONFIG_SND_INTEL_SOUNDWIRE_ACPI=m # end of HD-Audio CONFIG_SND_USB=y @@ -6906,6 +6962,7 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set +CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y CONFIG_SECURITY_LANDLOCK=y # CONFIG_SECURITY_IPE is not set CONFIG_INTEGRITY=y diff --git a/kernel/build/config-arm64 b/kernel/build/config-arm64 index 83f758bc3..24641c5f1 100644 --- a/kernel/build/config-arm64 +++ b/kernel/build/config-arm64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 6.18.48 Kernel Configuration +# Linux/arm64 6.18.51 Kernel Configuration # CONFIG_CC_VERSION_TEXT="clang version 22.1.8" CONFIG_GCC_VERSION=0 @@ -1289,7 +1289,7 @@ CONFIG_XFRM=y CONFIG_XFRM_OFFLOAD=y CONFIG_XFRM_ALGO=y CONFIG_XFRM_USER=y -# CONFIG_XFRM_INTERFACE is not set +CONFIG_XFRM_INTERFACE=m # CONFIG_XFRM_SUB_POLICY is not set # CONFIG_XFRM_MIGRATE is not set CONFIG_XFRM_STATISTICS=y @@ -8333,7 +8333,6 @@ CONFIG_IMX9_BLK_CTRL=y # CONFIG_MTK_SCPSYS=y CONFIG_MTK_SCPSYS_PM_DOMAINS=y -# CONFIG_AIROHA_CPU_PM_DOMAIN is not set # end of MediaTek PM Domains # @@ -9742,6 +9741,7 @@ CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y # CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set # CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set +CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y CONFIG_SECURITY_LANDLOCK=y # CONFIG_SECURITY_IPE is not set CONFIG_INTEGRITY=y @@ -10001,11 +10001,9 @@ CONFIG_CRYPTO_DEV_SUN4I_SS=y CONFIG_CRYPTO_DEV_SUN8I_CE=y # CONFIG_CRYPTO_DEV_SUN8I_CE_DEBUG is not set # CONFIG_CRYPTO_DEV_SUN8I_CE_HASH is not set -# CONFIG_CRYPTO_DEV_SUN8I_CE_PRNG is not set # CONFIG_CRYPTO_DEV_SUN8I_CE_TRNG is not set CONFIG_CRYPTO_DEV_SUN8I_SS=y # CONFIG_CRYPTO_DEV_SUN8I_SS_DEBUG is not set -# CONFIG_CRYPTO_DEV_SUN8I_SS_PRNG is not set # CONFIG_CRYPTO_DEV_SUN8I_SS_HASH is not set # CONFIG_CRYPTO_DEV_FSL_CAAM is not set # CONFIG_CRYPTO_DEV_SAHARA is not set diff --git a/kernel/build/patches/0017-security-lockdown-lock-down-the-kernel-in-EFI-Secure-.patch b/kernel/build/patches/0017-security-lockdown-lock-down-the-kernel-in-EFI-Secure-.patch new file mode 100644 index 000000000..a1c7bab77 --- /dev/null +++ b/kernel/build/patches/0017-security-lockdown-lock-down-the-kernel-in-EFI-Secure-.patch @@ -0,0 +1,90 @@ +From: Andrey Smirnov +Date: Thu, 3 Sep 2026 12:00:00 +0400 +Subject: [PATCH] security/lockdown: lock down the kernel in EFI Secure Boot + mode + +Upstream offers no way to enter lockdown only when the machine was booted +with UEFI Secure Boot enabled: the default level is a build-time choice +(LOCK_DOWN_KERNEL_FORCE_*) which applies to every boot, so a single kernel +image cannot be `none` when booted without Secure Boot and `integrity` when +booted with it. Forcing `integrity` unconditionally is not an option, as it +would also require a signed kernel image for kexec on non-Secure Boot +installs. + +Distributions carry an out-of-tree patch for this (originally by David +Howells), keyed off an EFI_SECURE_BOOT flag which is itself out of tree and +is only plumbed into the kernel proper via boot_params on x86. + +Do the same thing arch-generically instead: once EFI runtime services are +up, read the `SecureBoot`/`SetupMode` EFI variables using the helper already +in and raise lockdown to integrity if Secure Boot is enabled. +As `lock_kernel_down()` never lowers the level, an explicit +`lockdown=confidentiality` on the kernel command line still wins. + +Signed-off-by: Andrey Smirnov +--- +diff --git a/security/lockdown/Kconfig b/security/lockdown/Kconfig +index e84ddf4..a02aec3 100644 +--- a/security/lockdown/Kconfig ++++ b/security/lockdown/Kconfig +@@ -45,3 +45,18 @@ config LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY + disabled. + + endchoice ++ ++config LOCK_DOWN_IN_EFI_SECURE_BOOT ++ bool "Lock down the kernel in EFI Secure Boot mode" ++ default n ++ depends on SECURITY_LOCKDOWN_LSM ++ depends on EFI ++ help ++ UEFI Secure Boot provides a mechanism for ensuring that the firmware ++ will only load signed bootloaders and kernels. Secure boot mode may ++ be determined from EFI variables provided by the system firmware if ++ not indicated by the boot parameters. ++ ++ Enabling this option turns on the kernel lockdown feature in ++ integrity mode if the kernel was booted on a platform with UEFI ++ Secure Boot enabled. +diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c +index cf83afa..da8b89a 100644 +--- a/security/lockdown/lockdown.c ++++ b/security/lockdown/lockdown.c +@@ -10,6 +10,7 @@ + * 2 of the Licence, or (at your option) any later version. + */ + ++#include + #include + #include + #include +@@ -93,6 +94,29 @@ static int __init lockdown_lsm_init(void) + return 0; + } + ++#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT ++/* ++ * Raise the lockdown level to integrity when the machine was booted with UEFI ++ * Secure Boot enabled. ++ * ++ * This runs once EFI runtime services are available (efisubsys_init() is a ++ * subsys_initcall), which is still well before userspace is started. ++ */ ++static int __init lockdown_efi_secure_boot(void) ++{ ++ if (!efi_enabled(EFI_BOOT) || ++ !efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) ++ return 0; ++ ++ if (efi_get_secureboot_mode(efi.get_variable) == efi_secureboot_mode_enabled) ++ lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_INTEGRITY_MAX); ++ ++ return 0; ++} ++ ++late_initcall(lockdown_efi_secure_boot); ++#endif ++ + static ssize_t lockdown_read(struct file *filp, char __user *buf, size_t count, + loff_t *ppos) + { diff --git a/kernel/build/patches/README.md b/kernel/build/patches/README.md index 83998c6ca..2be93bdc9 100644 --- a/kernel/build/patches/README.md +++ b/kernel/build/patches/README.md @@ -14,3 +14,4 @@ | `0014-libceph-add-support-for-CEPH_CRYPTO_AES256KRB5.patch` | libceph: the actual `aes256k` support — new key type `CEPH_CRYPTO_AES256KRB5` (`0x2`), AES256-CTS-HMAC-SHA384-192 via the in-kernel `crypto/krb5` library, per-usage AEAD tfms and confounder+HMAC framing. Fixes kclient auth against a cluster whose CephX keys have been rotated to `--key-type aes256k` for [CVE-2025-30156](https://docs.ceph.com/en/latest/security/CVE-2025-30156/). **Adds `select CRYPTO_KRB5` to `CEPH_LIB`** — hence `CONFIG_CRYPTO_KRB5`/`KRB5ENC`/`CAMELLIA` in both configs | Merged to mainline v7.0 | [`b7cc142dbafe`](https://git.kernel.org/torvalds/c/b7cc142dbafeaf6c053284ca9121b9f70b6d6d06), [pull req](https://lore.kernel.org/all/20260217173743.1840319-1-idryomov@gmail.com/) | | `0015-libceph-adapt-ceph_x_challenge_blob-hashing-and-msgr1.patch` | libceph: route the connect-challenge hashing and msgr1 message signing through the key-type-aware helpers so both work with `aes256k` keys | Merged to mainline v7.0 | [`8356b4b1103b`](https://git.kernel.org/torvalds/c/8356b4b1103b8c970648c94bab724aa30e42d869), [pull req](https://lore.kernel.org/all/20260217173743.1840319-1-idryomov@gmail.com/) | | `0016-libceph-Fix-potential-out-of-bounds-access-in-__ceph_.patch` | libceph: bounds-check the plaintext before dereferencing `hdr->magic` in `__ceph_x_decrypt()` — a short `FRAME_TAG_AUTH_REPLY_MORE` frame can read past the buffer. `Cc: stable` but never picked up into 6.18.y; applies on top of `0012`-`0015` | Merged to mainline v7.1 | [`821365487aa5`](https://git.kernel.org/torvalds/c/821365487aa58d06bda65c676ba215d506ba9768) | +| `0017-security-lockdown-lock-down-the-kernel-in-EFI-Secure-.patch` | security/lockdown: add `LOCK_DOWN_IN_EFI_SECURE_BOOT`, which raises lockdown to `integrity` from a `late_initcall` when the `SecureBoot`/`SetupMode` EFI variables say UEFI Secure Boot is enabled. Upstream only has the build-time `LOCK_DOWN_KERNEL_FORCE_*` choice, which cannot be conditional on how the machine booted; the distro patch this replaces keys off an out-of-tree `EFI_SECURE_BOOT` flag that is only plumbed through `boot_params` on x86, so this reads the variables directly and works on arm64 too | Not submitted; distro-local (Fedora/SUSE carry an equivalent out-of-tree patch) | [talos#14237](https://github.com/siderolabs/talos/issues/14237), [SUSE `b1a0314b0827`](https://github.com/SUSE/kernel/commit/b1a0314b0827ea781c13a27abcc3c3b96fc0e946) |