Re: [yocto] [meta-security][DISCUSSION] : Enable Additional Security Configs in meta-security Layer

Sending again, as I wasn't subscribed to yocto-security :)

Bruce

On Tue, Nov 4, 2025 at 8:15 AM Bruce Ashfield <[email protected]>
wrote:

>
>
> On Tue, Nov 4, 2025 at 6:33 AM Abhilasha Manna (Temp) via
> lists.yoctoproject.org <[email protected]>
> wrote:
>
>> Hi Yocto Security Team,
>>
>> I'm currently working with the Yocto Project and exploring the
>> `meta-security` layer. I'd like to propose enabling additional security
>> configurations to enhance system hardening.
>>
>> Specifically, I'm looking to enable the following configurations:
>>
>> - CONFIG_SLAB_FREELIST_RANDOM=y
>> - CONFIG_SLAB_FREELIST_HARDENED=y
>> - CONFIG_HARDENED_USERCOPY=y
>> - CONFIG_FORTIFY_SOURCE=y
>>
>> I'd appreciate guidance on the best practices for integrating these into
>> the layer, and whether there are any existing patches or recommendations
>> from the community.
>>
>>
> If these are in kernel fragments. I'd suggest putting them in the
> kernel-cache
> repository and send them to the linux-yocto mailing list.
>
> Putting configuration fragments into many different layers makes them both
> hard to find and difficult to re-use, which is why I've been pushing for
> over a
> decade to centralize things in the kernel-cache. Once in the centralized
> configuration location, even non kernel-yocto style kernel's can still
> reuse
> the fragments.
>
> In the layer, you would then enable them via KERNEL_FEATURES in a bbappend.
>
> You can see how this is done in the meta-virtualization layer.
>
> Cheers,
>
> Bruce
>
>
>
>> Please let me know if this is something that aligns with the goals of the
>> `meta-security` layer, and how I can contribute or proceed further.
>>
>> Thanks, and regards,
>> Abhilasha Manna
>>
>> -=-=-=-=-=-=-=-=-=-=-=-
>> Links: You receive all messages sent to this group.
>> View/Reply Online (#66000):
>> https://lists.yoctoproject.org/g/yocto/message/66000
>> Mute This Topic: https://lists.yoctoproject.org/mt/116115138/1050810
>> Group Owner: [email protected]
>> Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub [
>> [email protected]]
>> -=-=-=-=-=-=-=-=-=-=-=-
>>
>>
>
> --
> - Thou shalt not follow the NULL pointer, for chaos and madness await thee
> at its end
> - "Use the force Harry" - Gandalf, Star Trek II
>
>

-- 
- Thou shalt not follow the NULL pointer, for chaos and madness await thee
at its end
- "Use the force Harry" - Gandalf, Star Trek II