-
Notifications
You must be signed in to change notification settings - Fork 9
/
config-bcm27xx.cfg
123 lines (105 loc) · 3.09 KB
/
config-bcm27xx.cfg
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
##################################################
# FedBerry BCM270x specific kernel config options
##################################################
#Unset local version
CONFIG_LOCALVERSION=""
#Add / edit our own default kernel boot time options
CONFIG_CMDLINE="dwc_otg.lpm_enable=0 console=ttyAMA0,115200 kgdboc=ttyAMA0,115200 console=tty1 root=/dev/mmcblk0p2 ro rootfstype=ext4 rootwait nortc"
#Use ondemand govenor by default
CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE=n
CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
#Enable some SECCOMP filter options (need to disable OABI first)
CONFIG_OABI_COMPAT=n
#We want to use our own logo
CONFIG_LOGO_LINUX_CLUT224=n
#IPV6 should be built in (saves some selinux hassels)
CONFIG_IPV6=y
CONFIG_CRC_CCITT=y
CONFIG_NETFILTER_XTABLES=y
CONFIG_IP_NF_IPTABLES=y
#Enable SELinux
CONFIG_PERSISTENT_KEYRINGS=y
CONFIG_BIG_KEYS=y
CONFIG_ENCRYPTED_KEYS=m
CONFIG_SECURITY=y
CONFIG_SECURITYFS=y
CONFIG_SECURITY_NETWORK=y
CONFIG_SECURITY_NETWORK_XFRM=y
CONFIG_SECURITY_PATH=n
CONFIG_LSM_MMAP_MIN_ADDR=65536
CONFIG_SECURITY_SELINUX=y
CONFIG_SECURITY_SELINUX_BOOTPARAM=y
CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=1
CONFIG_SECURITY_SELINUX_DISABLE=y
CONFIG_SECURITY_SELINUX_DEVELOP=y
CONFIG_SECURITY_SELINUX_AVC_STATS=y
CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1
CONFIG_SECURITY_SELINUX_SIDTAB_HASH_BITS=9
CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE=256
CONFIG_SECURITY_SMACK=n
CONFIG_SECURITY_TOMOYO=n
CONFIG_SECURITY_APPARMOR=n
CONFIG_SECURITY_LOADPIN=n
CONFIG_SECURITY_YAMA=y
CONFIG_SECURITY_YAMA_STACKED=y
CONFIG_SECURITY_SAFESETID=n
CONFIG_INTEGRITY=n
CONFIG_DEFAULT_SECURITY_SELINUX=y
CONFIG_DEFAULT_SECURITY_YAMA=n
CONFIG_DEFAULT_SECURITY_DAC=n
CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
CONFIG_NETLABEL=y
CONFIG_NETWORK_SECMARK=y
CONFIG_NF_CONNTRACK_SECMARK=y
CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m
CONFIG_NETFILTER_XT_TARGET_SECMARK=m
CONFIG_IP_NF_SECURITY=m
CONFIG_IP6_NF_SECURITY=m
CONFIG_F2FS_FS_SECURITY=y
CONFIG_LSM="yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor"
#Enable Zswap support
CONFIG_ZSWAP=y
CONFIG_ZPOOL=y
CONFIG_ZBUD=y
CONFIG_Z3FOLD=y
CONFIG_SQUASHFS_LZ4=y
CONFIG_CRYPTO_LZ4=y
CONFIG_CRYPTO_LZ4HC=y
#Enable BPF/cgroup based firewalling
CONFIG_CGROUP_BPF=y
CONFIG_BPF=y
CONFIG_BPF_LSM=y
CONFIG_BPF_SYSCALL=y
CONFIG_BPF_JIT_ALWAYS_ON=y
CONFIG_IPV6_SEG6_BPF=y
CONFIG_NETFILTER_XT_MATCH_BPF=m
CONFIG_NET_CLS_BPF=m
CONFIG_NET_ACT_BPF=m
CONFIG_BPF_JIT=y
CONFIG_BPF_STREAM_PARSER=y
CONFIG_LWTUNNEL_BPF=y
#initial-setup (ananconda/blivet workaround)
CONFIG_EFI_VARS=y
CONFIG_EFI_BOOTLOADER_CONTROL=n
# Required to boot Fedora IoT edition
CONFIG_EFI_ARMSTUB_DTB_LOADER=y
CONFIG_EFI=y
# Don't want dwc2 built-in for bcmrpi3_defconfig (aarch64)
CONFIG_USB_DWC2=m
CONFIG_USB_DWC2_HOST=n
CONFIG_USB_DWC2_PERIPHERAL=n
CONFIG_USB_DWC2_DUAL_ROLE=y
# Enable btrfs support
CONFIG_BTRFS_FS=y
# Enable for Fedora 34 user-space
CONFIG_FW_LOADER_COMPRESS=y
CONFIG_CMA_DEBUGFS=y
# Add Ceph RBD and FS support
CONFIG_BLK_DEV_RBD=m
CONFIG_CEPH_LIB=m
CONFIG_CEPH_LIB_PRETTYDEBUG=n
CONFIG_CEPH_LIB_USE_DNS_RESOLVER=n
CONFIG_CEPH_FS=m
CONFIG_CEPH_FSCACHE=y
CONFIG_CEPH_FS_POSIX_ACL=y
CONFIG_CEPH_FS_SECURITY_LABEL=ny