Re: [yocto] [meta-security][DISCUSSION] : Enable Additional Security Configs in meta-security Layer

On Tue, Nov 4, 2025 at 6:33 AM Abhilasha Manna (Temp) via
lists.yoctoproject.org <[email protected]>
wrote:

> Hi Yocto Security Team,
>
> I'm currently working with the Yocto Project and exploring the
> `meta-security` layer. I'd like to propose enabling additional security
> configurations to enhance system hardening.
>
> Specifically, I'm looking to enable the following configurations:
>
> - CONFIG_SLAB_FREELIST_RANDOM=y
> - CONFIG_SLAB_FREELIST_HARDENED=y
> - CONFIG_HARDENED_USERCOPY=y
> - CONFIG_FORTIFY_SOURCE=y
>
> I'd appreciate guidance on the best practices for integrating these into
> the layer, and whether there are any existing patches or recommendations
> from the community.
>
>
If these are in kernel fragments. I'd suggest putting them in the
kernel-cache
repository and send them to the linux-yocto mailing list.

Putting configuration fragments into many different layers makes them both
hard to find and difficult to re-use, which is why I've been pushing for
over a
decade to centralize things in the kernel-cache. Once in the centralized
configuration location, even non kernel-yocto style kernel's can still reuse
the fragments.

In the layer, you would then enable them via KERNEL_FEATURES in a bbappend.

You can see how this is done in the meta-virtualization layer.

Cheers,

Bruce



> Please let me know if this is something that aligns with the goals of the
> `meta-security` layer, and how I can contribute or proceed further.
>
> Thanks, and regards,
> Abhilasha Manna
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#66000):
> https://lists.yoctoproject.org/g/yocto/message/66000
> Mute This Topic: https://lists.yoctoproject.org/mt/116115138/1050810
> Group Owner: [email protected]
> Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub [
> [email protected]]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>

-- 
- Thou shalt not follow the NULL pointer, for chaos and madness await thee
at its end
- "Use the force Harry" - Gandalf, Star Trek II