Re: [RFC cip-dev][isar-cip-core][PATCH 06/14] Apply hardening configuration to the kernel

On 24.07.26 14:39, Quirin Gylstorff wrote:
> From: Quirin Gylstorff <[email protected]>
> 
> Use the provided kernel hardening configuration options in the kernel
> build.

Err, no, this does not do that. This just drops a dead include that
could be used in an own kernel recipe, and only then it will have a real
effect.

> 
> Co-Authored-by: Felix Moessbauer <[email protected]>
> Co-Authored-by: Christoph Steiger <[email protected]>
> Signed-off-by: Quirin Gylstorff <[email protected]>
> ---
>  recipes-kernel/linux/kernel-hardening.inc | 16 ++++++++++++++++
>  1 file changed, 16 insertions(+)
>  create mode 100644 recipes-kernel/linux/kernel-hardening.inc
> 
> diff --git a/recipes-kernel/linux/kernel-hardening.inc b/recipes-kernel/linux/kernel-hardening.inc
> new file mode 100644
> index 0000000..2b22fca
> --- /dev/null
> +++ b/recipes-kernel/linux/kernel-hardening.inc
> @@ -0,0 +1,16 @@
> +#
> +# CIP Core, generic profile
> +#
> +# Copyright (c) Siemens AG, 2026
> +#
> +# SPDX-License-Identifier: MIT
> +
> +OVERRIDES:append = "${@'kernel-hardening' if bb.utils.to_boolean(d.getVar('CIP_CIS_HARDENING')) else ''}"
> +
> +KERNEL_CONFIG_FRAGMENTS:kernel-hardening += "hardening.kernel.cfg"
> +
> +do_dpkg_source[depends] += "${@'cip-cis-rules-config:do_deploy_hardening' if bb.utils.to_boolean(d.getVar('CIP_CIS_HARDENING')) else ''}"
> +
> +do_dpkg_source:prepend:kernel-hardening() {
> +    cp ${DEPLOY_DIR_IMAGE}/${DISTRO}-hardening.kernel.cfg ${WORKDIR}/hardening.kernel.cfg

Why does this need copying? Can't we just reference the right .cfg file
in SRC_URI and let Isar do its magic?

Jan

> +}


-- 
Siemens AG, Foundational Technologies
Linux Expert Center