AWS linux documentation change
Summary
Updated kernel configuration comparison table to include AL2023/6.12 kernel versions for aarch64 and x86_64 architectures, expanding documentation of CONFIG options including security-related settings like SECURITY_DMESG_RESTRICT, SECURITY_SELINUX_DISABLE, and PANIC_ON_OOPS
Security assessment
The changes document security-hardening configurations (e.g., enabling dmesg restriction, preventing SELinux disablement, panic on kernel oops) in newer kernel versions, but there is no explicit mention of addressing specific CVEs or vulnerabilities. The updates primarily reflect expanded version support and existing security feature states.
Diff
diff --git a/linux/al2023/ug/compare-with-al1-kernel.md b/linux/al2023/ug/compare-with-al1-kernel.md index 95ad2dd34..def68baa0 100644 --- a//linux/al2023/ug/compare-with-al1-kernel.md +++ b//linux/al2023/ug/compare-with-al1-kernel.md @@ -17,29 +17,29 @@ There have been several changes in the file systems that the kernel in AL1 will -`CONFIG` option | AL1/4.14/x86_64 | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 ----|---|---|--- -[CONFIG_AFS_FS](./compare-with-al2-kernel.html#CONFIG_AFS_FS) | `m` | `n` | `n` -[CONFIG_AF_RXRPC](./compare-with-al2-kernel.html#CONFIG_AF_RXRPC) | `m` | `n` | `n` -[CONFIG_BSD_DISKLABEL](./compare-with-al2-kernel.html#CONFIG_BSD_DISKLABEL) | `y` | `n` | `n` -[CONFIG_CRAMFS](./compare-with-al2-kernel.html#CONFIG_CRAMFS) | `m` | `n` | `n` -[CONFIG_CRAMFS_BLOCKDEV](./compare-with-al2-kernel.html#CONFIG_CRAMFS_BLOCKDEV) | N/A | N/A | N/A -[CONFIG_DM_CLONE](./compare-with-al2-kernel.html#CONFIG_DM_CLONE) | N/A | `n` | `n` -[CONFIG_DM_ERA](./compare-with-al2-kernel.html#CONFIG_DM_ERA) | `n` | `n` | `n` -[CONFIG_DM_INTEGRITY](./compare-with-al2-kernel.html#CONFIG_DM_INTEGRITY) | `m` | `m` | `m` -[CONFIG_DM_LOG_WRITES](./compare-with-al2-kernel.html#CONFIG_DM_LOG_WRITES) | `n` | `m` | `m` -[CONFIG_DM_SWITCH](./compare-with-al2-kernel.html#CONFIG_DM_SWITCH) | `n` | `n` | `n` -[CONFIG_DM_VERITY](./compare-with-al2-kernel.html#CONFIG_DM_VERITY) | `n` | `n` | `n` -[CONFIG_ECRYPT_FS](./compare-with-al2-kernel.html#CONFIG_ECRYPT_FS) | `m` | `n` | `n` -[CONFIG_EXFAT_FS](./compare-with-al2-kernel.html#CONFIG_EXFAT_FS) | N/A | `m` | `m` -[CONFIG_EXT2_FS](./compare-with-al2-kernel.html#CONFIG_EXT2_FS) | `m` | `n` | `n` -[CONFIG_EXT3_FS](./compare-with-al2-kernel.html#CONFIG_EXT3_FS) | `m` | `n` | `n` -[CONFIG_GFS2_FS](./compare-with-al2-kernel.html#CONFIG_GFS2_FS) | `n` | `n` | `n` -[CONFIG_HFSPLUS_FS](./compare-with-al2-kernel.html#CONFIG_HFSPLUS_FS) | `m` | `n` | `n` -[CONFIG_HFS_FS](./compare-with-al2-kernel.html#CONFIG_HFS_FS) | `m` | `n` | `n` -[CONFIG_JFS_FS](./compare-with-al2-kernel.html#CONFIG_JFS_FS) | `n` | `n` | `n` -[CONFIG_LDM_PARTITION](./compare-with-al2-kernel.html#CONFIG_LDM_PARTITION) | `y` | `n` | `n` -[CONFIG_MAC_PARTITION](./compare-with-al2-kernel.html#CONFIG_MAC_PARTITION) | `y` | `n` | `n` -[CONFIG_NFS_V2](./compare-with-al2-kernel.html#CONFIG_NFS_V2) | `m` | `n` | `n` -[CONFIG_NTFS_FS](./compare-with-al2-kernel.html#CONFIG_NTFS_FS) | `m` | `n` | `n` -[CONFIG_ROMFS_FS](./compare-with-al2-kernel.html#CONFIG_ROMFS_FS) | `m` | `n` | `n` -[CONFIG_SOLARIS_X86_PARTITION](./compare-with-al2-kernel.html#CONFIG_SOLARIS_X86_PARTITION) | `y` | `n` | `n` -[CONFIG_SQUASHFS_ZSTD](./compare-with-al2-kernel.html#CONFIG_SQUASHFS_ZSTD) | `y` | `y` | `y` -[CONFIG_SUN_PARTITION](./compare-with-al2-kernel.html#CONFIG_SUN_PARTITION) | `y` | `n` | `n` +`CONFIG` option | AL1/4.14/x86_64 | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 | AL2023/6.12/aarch64 | AL2023/6.12/x86_64 +---|---|---|---|---|--- +[CONFIG_AFS_FS](./compare-with-al2-kernel.html#CONFIG_AFS_FS) | `m` | `n` | `n` | `n` | `n` +[CONFIG_AF_RXRPC](./compare-with-al2-kernel.html#CONFIG_AF_RXRPC) | `m` | `n` | `n` | `n` | `n` +[CONFIG_BSD_DISKLABEL](./compare-with-al2-kernel.html#CONFIG_BSD_DISKLABEL) | `y` | `n` | `n` | `n` | `n` +[CONFIG_CRAMFS](./compare-with-al2-kernel.html#CONFIG_CRAMFS) | `m` | `n` | `n` | `n` | `n` +[CONFIG_CRAMFS_BLOCKDEV](./compare-with-al2-kernel.html#CONFIG_CRAMFS_BLOCKDEV) | N/A | N/A | N/A | N/A | N/A +[CONFIG_DM_CLONE](./compare-with-al2-kernel.html#CONFIG_DM_CLONE) | N/A | `n` | `n` | `n` | `n` +[CONFIG_DM_ERA](./compare-with-al2-kernel.html#CONFIG_DM_ERA) | `n` | `n` | `n` | `n` | `n` +[CONFIG_DM_INTEGRITY](./compare-with-al2-kernel.html#CONFIG_DM_INTEGRITY) | `m` | `m` | `m` | `m` | `m` +[CONFIG_DM_LOG_WRITES](./compare-with-al2-kernel.html#CONFIG_DM_LOG_WRITES) | `n` | `m` | `m` | `m` | `m` +[CONFIG_DM_SWITCH](./compare-with-al2-kernel.html#CONFIG_DM_SWITCH) | `n` | `n` | `n` | `n` | `n` +[CONFIG_DM_VERITY](./compare-with-al2-kernel.html#CONFIG_DM_VERITY) | `n` | `n` | `n` | `n` | `n` +[CONFIG_ECRYPT_FS](./compare-with-al2-kernel.html#CONFIG_ECRYPT_FS) | `m` | `n` | `n` | `n` | `n` +[CONFIG_EXFAT_FS](./compare-with-al2-kernel.html#CONFIG_EXFAT_FS) | N/A | `m` | `m` | `m` | `m` +[CONFIG_EXT2_FS](./compare-with-al2-kernel.html#CONFIG_EXT2_FS) | `m` | `n` | `n` | `n` | `n` +[CONFIG_EXT3_FS](./compare-with-al2-kernel.html#CONFIG_EXT3_FS) | `m` | `n` | `n` | `n` | `n` +[CONFIG_GFS2_FS](./compare-with-al2-kernel.html#CONFIG_GFS2_FS) | `n` | `n` | `n` | `n` | `n` +[CONFIG_HFSPLUS_FS](./compare-with-al2-kernel.html#CONFIG_HFSPLUS_FS) | `m` | `n` | `n` | `n` | `n` +[CONFIG_HFS_FS](./compare-with-al2-kernel.html#CONFIG_HFS_FS) | `m` | `n` | `n` | `n` | `n` +[CONFIG_JFS_FS](./compare-with-al2-kernel.html#CONFIG_JFS_FS) | `n` | `n` | `n` | `n` | `n` +[CONFIG_LDM_PARTITION](./compare-with-al2-kernel.html#CONFIG_LDM_PARTITION) | `y` | `n` | `n` | `n` | `n` +[CONFIG_MAC_PARTITION](./compare-with-al2-kernel.html#CONFIG_MAC_PARTITION) | `y` | `n` | `n` | `n` | `n` +[CONFIG_NFS_V2](./compare-with-al2-kernel.html#CONFIG_NFS_V2) | `m` | `n` | `n` | `n` | `n` +[CONFIG_NTFS_FS](./compare-with-al2-kernel.html#CONFIG_NTFS_FS) | `m` | `n` | `n` | `n` | `n` +[CONFIG_ROMFS_FS](./compare-with-al2-kernel.html#CONFIG_ROMFS_FS) | `m` | `n` | `n` | `n` | `n` +[CONFIG_SOLARIS_X86_PARTITION](./compare-with-al2-kernel.html#CONFIG_SOLARIS_X86_PARTITION) | `y` | `n` | `n` | `n` | `n` +[CONFIG_SQUASHFS_ZSTD](./compare-with-al2-kernel.html#CONFIG_SQUASHFS_ZSTD) | `y` | `y` | `y` | `y` | `y` +[CONFIG_SUN_PARTITION](./compare-with-al2-kernel.html#CONFIG_SUN_PARTITION) | `y` | `n` | `n` | `n` | `n` @@ -49,19 +49,19 @@ There have been several changes in the file systems that the kernel in AL1 will -`CONFIG` option | AL1/4.14/x86_64 | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 ----|---|---|--- -[CONFIG_BUG_ON_DATA_CORRUPTION](./kernel-hardening.html#CONFIG_BUG_ON_DATA_CORRUPTION) | `y` | `y` | `y` -[CONFIG_DEFAULT_MMAP_MIN_ADDR](./kernel-hardening.html#CONFIG_DEFAULT_MMAP_MIN_ADDR) | `4096` | `65536` | `65536` -[CONFIG_DEVMEM](./compare-with-al2-kernel.html#CONFIG_DEVMEM) | `y` | `n` | `n` -[CONFIG_DEVPORT](./compare-with-al2-kernel.html#CONFIG_DEVPORT) | `y` | `n` | `n` -[CONFIG_FORTIFY_SOURCE](./compare-with-al2-kernel.html#CONFIG_FORTIFY_SOURCE) | `y` | `y` | `y` -[CONFIG_HARDENED_USERCOPY_FALLBACK](./kernel-hardening.html#CONFIG_HARDENED_USERCOPY_FALLBACK) | N/A | N/A | N/A -[CONFIG_INIT_ON_ALLOC_DEFAULT_ON](./kernel-hardening.html#CONFIG_INIT_ON_ALLOC_DEFAULT_ON) | N/A | `n` | `n` -[CONFIG_INIT_ON_FREE_DEFAULT_ON](./kernel-hardening.html#CONFIG_INIT_ON_FREE_DEFAULT_ON) | N/A | `n` | `n` -[CONFIG_IOMMU_DEFAULT_DMA_STRICT](./kernel-hardening.html#CONFIG_IOMMU_DEFAULT_DMA_STRICT) | N/A | `n` | `n` -[CONFIG_LDISC_AUTOLOAD](./compare-with-al2-kernel.html#CONFIG_LDISC_AUTOLOAD) | `y` | `n` | `n` -[CONFIG_SCHED_CORE](./kernel-hardening.html#CONFIG_SCHED_CORE) | N/A | N/A | `y` -[CONFIG_SCHED_STACK_END_CHECK](./kernel-hardening.html#CONFIG_SCHED_STACK_END_CHECK) | `y` | `y` | `y` -[CONFIG_SECURITY_DMESG_RESTRICT](./compare-with-al2-kernel.html#CONFIG_SECURITY_DMESG_RESTRICT) | `n` | `y` | `y` -[CONFIG_SECURITY_SELINUX_DISABLE](./compare-with-al2-kernel.html#CONFIG_SECURITY_SELINUX_DISABLE) | `y` | `n` | `n` -[CONFIG_SHUFFLE_PAGE_ALLOCATOR](./kernel-hardening.html#CONFIG_SHUFFLE_PAGE_ALLOCATOR) | N/A | `y` | `y` -[CONFIG_SLAB_FREELIST_HARDENED](./kernel-hardening.html#CONFIG_SLAB_FREELIST_HARDENED) | `y` | `y` | `y` -[CONFIG_SLAB_FREELIST_RANDOM](./kernel-hardening.html#CONFIG_SLAB_FREELIST_RANDOM) | `n` | `y` | `y` +`CONFIG` option | AL1/4.14/x86_64 | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 | AL2023/6.12/aarch64 | AL2023/6.12/x86_64 +---|---|---|---|---|--- +[CONFIG_BUG_ON_DATA_CORRUPTION](./kernel-hardening.html#CONFIG_BUG_ON_DATA_CORRUPTION) | `y` | `y` | `y` | `y` | `y` +[CONFIG_DEFAULT_MMAP_MIN_ADDR](./kernel-hardening.html#CONFIG_DEFAULT_MMAP_MIN_ADDR) | `4096` | `65536` | `65536` | `65536` | `65536` +[CONFIG_DEVMEM](./compare-with-al2-kernel.html#CONFIG_DEVMEM) | `y` | `n` | `n` | `n` | `n` +[CONFIG_DEVPORT](./compare-with-al2-kernel.html#CONFIG_DEVPORT) | `y` | `n` | `n` | `n` | `n` +[CONFIG_FORTIFY_SOURCE](./compare-with-al2-kernel.html#CONFIG_FORTIFY_SOURCE) | `y` | `y` | `y` | `y` | `y` +[CONFIG_HARDENED_USERCOPY_FALLBACK](./kernel-hardening.html#CONFIG_HARDENED_USERCOPY_FALLBACK) | N/A | N/A | N/A | N/A | N/A +[CONFIG_INIT_ON_ALLOC_DEFAULT_ON](./kernel-hardening.html#CONFIG_INIT_ON_ALLOC_DEFAULT_ON) | N/A | `n` | `n` | `n` | `n` +[CONFIG_INIT_ON_FREE_DEFAULT_ON](./kernel-hardening.html#CONFIG_INIT_ON_FREE_DEFAULT_ON) | N/A | `n` | `n` | `n` | `n` +[CONFIG_IOMMU_DEFAULT_DMA_STRICT](./kernel-hardening.html#CONFIG_IOMMU_DEFAULT_DMA_STRICT) | N/A | `n` | `n` | `n` | `n` +[CONFIG_LDISC_AUTOLOAD](./compare-with-al2-kernel.html#CONFIG_LDISC_AUTOLOAD) | `y` | `n` | `n` | `n` | `n` +[CONFIG_SCHED_CORE](./kernel-hardening.html#CONFIG_SCHED_CORE) | N/A | N/A | `y` | N/A | `y` +[CONFIG_SCHED_STACK_END_CHECK](./kernel-hardening.html#CONFIG_SCHED_STACK_END_CHECK) | `y` | `y` | `y` | `y` | `y` +[CONFIG_SECURITY_DMESG_RESTRICT](./compare-with-al2-kernel.html#CONFIG_SECURITY_DMESG_RESTRICT) | `n` | `y` | `y` | `y` | `y` +[CONFIG_SECURITY_SELINUX_DISABLE](./compare-with-al2-kernel.html#CONFIG_SECURITY_SELINUX_DISABLE) | `y` | `n` | `n` | N/A | N/A +[CONFIG_SHUFFLE_PAGE_ALLOCATOR](./kernel-hardening.html#CONFIG_SHUFFLE_PAGE_ALLOCATOR) | N/A | `y` | `y` | `y` | `y` +[CONFIG_SLAB_FREELIST_HARDENED](./kernel-hardening.html#CONFIG_SLAB_FREELIST_HARDENED) | `y` | `y` | `y` | `y` | `y` +[CONFIG_SLAB_FREELIST_RANDOM](./kernel-hardening.html#CONFIG_SLAB_FREELIST_RANDOM) | `n` | `y` | `y` | `y` | `y` @@ -71,9 +71,9 @@ There have been several changes in the file systems that the kernel in AL1 will -`CONFIG` option | AL1/4.14/x86_64 | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 ----|---|---|--- -[CONFIG_HZ](./compare-with-al2-kernel.html#CONFIG_HZ) | `250` | `100` | `100` -[CONFIG_NR_CPUS](./compare-with-al2-kernel.html#CONFIG_NR_CPUS) | `8192` | `4096` | `8192` -[CONFIG_PANIC_ON_OOPS](./compare-with-al2-kernel.html#CONFIG_PANIC_ON_OOPS) | `n` | `y` | `y` -[CONFIG_PANIC_ON_OOPS_VALUE](./compare-with-al2-kernel.html#CONFIG_PANIC_ON_OOPS_VALUE) | `0` | `1` | `1` -[CONFIG_PPP](./compare-with-al2-kernel.html#CONFIG_PPP) | `m` | `n` | `n` -[CONFIG_SLIP](./compare-with-al2-kernel.html#CONFIG_SLIP) | `m` | `n` | `n` -[CONFIG_XEN_PV](./compare-with-al2-kernel.html#CONFIG_XEN_PV) | `y` | N/A | `n` +`CONFIG` option | AL1/4.14/x86_64 | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 | AL2023/6.12/aarch64 | AL2023/6.12/x86_64 +---|---|---|---|---|--- +[CONFIG_HZ](./compare-with-al2-kernel.html#CONFIG_HZ) | `250` | `100` | `100` | `100` | `100` +[CONFIG_NR_CPUS](./compare-with-al2-kernel.html#CONFIG_NR_CPUS) | `8192` | `4096` | `8192` | `4096` | `8192` +[CONFIG_PANIC_ON_OOPS](./compare-with-al2-kernel.html#CONFIG_PANIC_ON_OOPS) | `n` | `y` | `y` | `y` | `y` +[CONFIG_PANIC_ON_OOPS_VALUE](./compare-with-al2-kernel.html#CONFIG_PANIC_ON_OOPS_VALUE) | `0` | `1` | `1` | `1` | `1` +[CONFIG_PPP](./compare-with-al2-kernel.html#CONFIG_PPP) | `m` | `n` | `n` | `n` | `n` +[CONFIG_SLIP](./compare-with-al2-kernel.html#CONFIG_SLIP) | `m` | `n` | `n` | `n` | `n` +[CONFIG_XEN_PV](./compare-with-al2-kernel.html#CONFIG_XEN_PV) | `y` | N/A | `n` | N/A | `n`