AWS linux documentation change
Summary
Added documentation for AL2023 6.12 kernel versions across multiple configuration tables, updated values for security-related kernel configurations
Security assessment
The changes document security-hardened kernel configurations (e.g., CONFIG_SECURITY_DMESG_RESTRICT=y, CONFIG_FORTIFY_SOURCE=y) but do not indicate remediation of a specific vulnerability. Updates show continued use of security features rather than addressing new vulnerabilities.
Diff
diff --git a/linux/al2023/ug/compare-with-al2-kernel.md b/linux/al2023/ug/compare-with-al2-kernel.md index 401861aec..1e8aef68f 100644 --- a//linux/al2023/ug/compare-with-al2-kernel.md +++ b//linux/al2023/ug/compare-with-al2-kernel.md @@ -19,19 +19,19 @@ AL2 set the `net.ipv4.ip_default_ttl` value to to 255, while AL2023 sets it to 1 -`CONFIG` option | AL2/4.14/aarch64 | AL2/4.14/x86_64 | AL2/5.10/aarch64 | AL2/5.10/x86_64 | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 ----|---|---|---|---|---|--- -[CONFIG_BUG_ON_DATA_CORRUPTION](./kernel-hardening.html#CONFIG_BUG_ON_DATA_CORRUPTION) | `n` | `y` | `n` | `y` | `y` | `y` -[CONFIG_DEFAULT_MMAP_MIN_ADDR](./kernel-hardening.html#CONFIG_DEFAULT_MMAP_MIN_ADDR) | `4096` | `4096` | `4096` | `4096` | `65536` | `65536` -CONFIG_DEVMEM | `n` | `y` | `n` | `y` | `n` | `n` -CONFIG_DEVPORT | `n` | `y` | `n` | `y` | `n` | `n` -CONFIG_FORTIFY_SOURCE | `n` | `y` | `n` | `y` | `y` | `y` -[CONFIG_HARDENED_USERCOPY_FALLBACK](./kernel-hardening.html#CONFIG_HARDENED_USERCOPY_FALLBACK) | N/A | N/A | `y` | `y` | N/A | N/A -[CONFIG_INIT_ON_ALLOC_DEFAULT_ON](./kernel-hardening.html#CONFIG_INIT_ON_ALLOC_DEFAULT_ON) | N/A | N/A | `n` | `n` | `n` | `n` -[CONFIG_INIT_ON_FREE_DEFAULT_ON](./kernel-hardening.html#CONFIG_INIT_ON_FREE_DEFAULT_ON) | N/A | N/A | `n` | `n` | `n` | `n` -[CONFIG_IOMMU_DEFAULT_DMA_STRICT](./kernel-hardening.html#CONFIG_IOMMU_DEFAULT_DMA_STRICT) | N/A | N/A | N/A | N/A | `n` | `n` -CONFIG_LDISC_AUTOLOAD | `y` | `y` | `y` | `y` | `n` | `n` -[CONFIG_SCHED_CORE](./kernel-hardening.html#CONFIG_SCHED_CORE) | N/A | N/A | N/A | N/A | N/A | `y` -[CONFIG_SCHED_STACK_END_CHECK](./kernel-hardening.html#CONFIG_SCHED_STACK_END_CHECK) | `n` | `y` | `n` | `y` | `y` | `y` -CONFIG_SECURITY_DMESG_RESTRICT | `n` | `n` | `n` | `n` | `y` | `y` -CONFIG_SECURITY_SELINUX_DISABLE | `y` | `y` | `y` | `y` | `n` | `n` -[CONFIG_SHUFFLE_PAGE_ALLOCATOR](./kernel-hardening.html#CONFIG_SHUFFLE_PAGE_ALLOCATOR) | N/A | N/A | `y` | `y` | `y` | `y` -[CONFIG_SLAB_FREELIST_HARDENED](./kernel-hardening.html#CONFIG_SLAB_FREELIST_HARDENED) | `n` | `y` | `y` | `y` | `y` | `y` -[CONFIG_SLAB_FREELIST_RANDOM](./kernel-hardening.html#CONFIG_SLAB_FREELIST_RANDOM) | `n` | `n` | `y` | `y` | `y` | `y` +`CONFIG` option | AL2/4.14/aarch64 | AL2/4.14/x86_64 | AL2/5.10/aarch64 | AL2/5.10/x86_64 | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 | AL2023/6.12/aarch64 | AL2023/6.12/x86_64 +---|---|---|---|---|---|---|---|--- +[CONFIG_BUG_ON_DATA_CORRUPTION](./kernel-hardening.html#CONFIG_BUG_ON_DATA_CORRUPTION) | `n` | `y` | `n` | `y` | `y` | `y` | `y` | `y` +[CONFIG_DEFAULT_MMAP_MIN_ADDR](./kernel-hardening.html#CONFIG_DEFAULT_MMAP_MIN_ADDR) | `4096` | `4096` | `4096` | `4096` | `65536` | `65536` | `65536` | `65536` +CONFIG_DEVMEM | `n` | `y` | `n` | `y` | `n` | `n` | `n` | `n` +CONFIG_DEVPORT | `n` | `y` | `n` | `y` | `n` | `n` | `n` | `n` +CONFIG_FORTIFY_SOURCE | `n` | `y` | `n` | `y` | `y` | `y` | `y` | `y` +[CONFIG_HARDENED_USERCOPY_FALLBACK](./kernel-hardening.html#CONFIG_HARDENED_USERCOPY_FALLBACK) | N/A | N/A | `y` | `y` | N/A | N/A | N/A | N/A +[CONFIG_INIT_ON_ALLOC_DEFAULT_ON](./kernel-hardening.html#CONFIG_INIT_ON_ALLOC_DEFAULT_ON) | N/A | N/A | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_INIT_ON_FREE_DEFAULT_ON](./kernel-hardening.html#CONFIG_INIT_ON_FREE_DEFAULT_ON) | N/A | N/A | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_IOMMU_DEFAULT_DMA_STRICT](./kernel-hardening.html#CONFIG_IOMMU_DEFAULT_DMA_STRICT) | N/A | N/A | N/A | N/A | `n` | `n` | `n` | `n` +CONFIG_LDISC_AUTOLOAD | `y` | `y` | `y` | `y` | `n` | `n` | `n` | `n` +[CONFIG_SCHED_CORE](./kernel-hardening.html#CONFIG_SCHED_CORE) | N/A | N/A | N/A | N/A | N/A | `y` | N/A | `y` +[CONFIG_SCHED_STACK_END_CHECK](./kernel-hardening.html#CONFIG_SCHED_STACK_END_CHECK) | `n` | `y` | `n` | `y` | `y` | `y` | `y` | `y` +CONFIG_SECURITY_DMESG_RESTRICT | `n` | `n` | `n` | `n` | `y` | `y` | `y` | `y` +CONFIG_SECURITY_SELINUX_DISABLE | `y` | `y` | `y` | `y` | `n` | `n` | N/A | N/A +[CONFIG_SHUFFLE_PAGE_ALLOCATOR](./kernel-hardening.html#CONFIG_SHUFFLE_PAGE_ALLOCATOR) | N/A | N/A | `y` | `y` | `y` | `y` | `y` | `y` +[CONFIG_SLAB_FREELIST_HARDENED](./kernel-hardening.html#CONFIG_SLAB_FREELIST_HARDENED) | `n` | `y` | `y` | `y` | `y` | `y` | `y` | `y` +[CONFIG_SLAB_FREELIST_RANDOM](./kernel-hardening.html#CONFIG_SLAB_FREELIST_RANDOM) | `n` | `n` | `y` | `y` | `y` | `y` | `y` | `y` @@ -41,5 +41,5 @@ CONFIG_SECURITY_SELINUX_DISABLE | `y` | `y` | `y` | `y` | `n` | `n` -`CONFIG` option | AL2/4.14/x86_64 | AL2/5.10/x86_64 | AL2023/6.1/x86_64 ----|---|---|--- -[CONFIG_AMD_IOMMU](./kernel-hardening.html#CONFIG_AMD_IOMMU) | `y` | `y` | `y` -[CONFIG_AMD_IOMMU_V2](./kernel-hardening.html#CONFIG_AMD_IOMMU_V2) | `m` | `m` | `y` -[CONFIG_RANDOMIZE_MEMORY](./kernel-hardening.html#CONFIG_RANDOMIZE_MEMORY) | N/A | `y` | `y` +`CONFIG` option | AL2/4.14/x86_64 | AL2/5.10/x86_64 | AL2023/6.1/x86_64 | AL2023/6.12/x86_64 +---|---|---|---|--- +[CONFIG_AMD_IOMMU](./kernel-hardening.html#CONFIG_AMD_IOMMU) | `y` | `y` | `y` | `y` +[CONFIG_AMD_IOMMU_V2](./kernel-hardening.html#CONFIG_AMD_IOMMU_V2) | `m` | `m` | `y` | N/A +[CONFIG_RANDOMIZE_MEMORY](./kernel-hardening.html#CONFIG_RANDOMIZE_MEMORY) | N/A | `y` | `y` | `y` @@ -49,5 +49,5 @@ CONFIG_SECURITY_SELINUX_DISABLE | `y` | `y` | `y` | `y` | `n` | `n` -`CONFIG` option | AL2/4.14/aarch64 | AL2/5.10/aarch64 | AL2023/6.1/aarch64 ----|---|---|--- -[CONFIG_ARM64_PTR_AUTH](./kernel-hardening.html#CONFIG_ARM64_PTR_AUTH) | N/A | `y` | `y` -[CONFIG_ARM64_PTR_AUTH_KERNEL](./kernel-hardening.html#CONFIG_ARM64_PTR_AUTH_KERNEL) | N/A | N/A | `y` -[CONFIG_ARM64_SW_TTBR0_PAN](./kernel-hardening.html#CONFIG_ARM64_SW_TTBR0_PAN) | `y` | `y` | `y` +`CONFIG` option | AL2/4.14/aarch64 | AL2/5.10/aarch64 | AL2023/6.1/aarch64 | AL2023/6.12/aarch64 +---|---|---|---|--- +[CONFIG_ARM64_PTR_AUTH](./kernel-hardening.html#CONFIG_ARM64_PTR_AUTH) | N/A | `y` | `y` | `y` +[CONFIG_ARM64_PTR_AUTH_KERNEL](./kernel-hardening.html#CONFIG_ARM64_PTR_AUTH_KERNEL) | N/A | N/A | `y` | `y` +[CONFIG_ARM64_SW_TTBR0_PAN](./kernel-hardening.html#CONFIG_ARM64_SW_TTBR0_PAN) | `y` | `y` | `y` | `y` @@ -89,9 +89,9 @@ This option is one of the [Kernel Self Protection Project Recommended Settings]( -`CONFIG` option | AL2/4.14/aarch64 | AL2/4.14/x86_64 | AL2/5.10/aarch64 | AL2/5.10/x86_64 | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 ----|---|---|---|---|---|--- -CONFIG_HZ | `100` | `250` | `100` | `250` | `100` | `100` -CONFIG_NR_CPUS | `4096` | `8192` | `4096` | `8192` | `4096` | `8192` -CONFIG_PANIC_ON_OOPS | `y` | `n` | `y` | `n` | `y` | `y` -CONFIG_PANIC_ON_OOPS_VALUE | `1` | `0` | `1` | `0` | `1` | `1` -CONFIG_PPP | `m` | `m` | `m` | `m` | `n` | `n` -CONFIG_SLIP | `m` | `m` | `m` | `m` | `n` | `n` -CONFIG_XEN_PV | N/A | `y` | N/A | `n` | N/A | `n` +`CONFIG` option | AL2/4.14/aarch64 | AL2/4.14/x86_64 | AL2/5.10/aarch64 | AL2/5.10/x86_64 | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 | AL2023/6.12/aarch64 | AL2023/6.12/x86_64 +---|---|---|---|---|---|---|---|--- +CONFIG_HZ | `100` | `250` | `100` | `250` | `100` | `100` | `100` | `100` +CONFIG_NR_CPUS | `4096` | `8192` | `4096` | `8192` | `4096` | `8192` | `4096` | `8192` +CONFIG_PANIC_ON_OOPS | `y` | `n` | `y` | `n` | `y` | `y` | `y` | `y` +CONFIG_PANIC_ON_OOPS_VALUE | `1` | `0` | `1` | `0` | `1` | `1` | `1` | `1` +CONFIG_PPP | `m` | `m` | `m` | `m` | `n` | `n` | `n` | `n` +CONFIG_SLIP | `m` | `m` | `m` | `m` | `n` | `n` | `n` | `n` +CONFIG_XEN_PV | N/A | `y` | N/A | `n` | N/A | `n` | N/A | `n` @@ -125,29 +125,29 @@ There have been several changes in the file systems that the kernel in AL2 will -`CONFIG` option | AL2/4.14/aarch64 | AL2/4.14/x86_64 | AL2/5.10/aarch64 | AL2/5.10/x86_64 | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 ----|---|---|---|---|---|--- -CONFIG_AFS_FS | `n` | `m` | `n` | `m` | `n` | `n` -CONFIG_AF_RXRPC | `n` | `m` | `n` | `m` | `n` | `n` -CONFIG_BSD_DISKLABEL | `y` | `y` | `y` | `y` | `n` | `n` -CONFIG_CRAMFS | `m` | `m` | `m` | `m` | `n` | `n` -CONFIG_CRAMFS_BLOCKDEV | N/A | N/A | `y` | `n` | N/A | N/A -CONFIG_DM_CLONE | N/A | N/A | `n` | `n` | `n` | `n` -CONFIG_DM_ERA | `m` | `n` | `m` | `n` | `n` | `n` -CONFIG_DM_INTEGRITY | `n` | `m` | `n` | `m` | `m` | `m` -CONFIG_DM_LOG_WRITES | `n` | `n` | `m` | `m` | `m` | `m` -CONFIG_DM_SWITCH | `m` | `n` | `m` | `n` | `n` | `n` -CONFIG_DM_VERITY | `m` | `n` | `m` | `n` | `n` | `n` -CONFIG_ECRYPT_FS | `n` | `m` | `n` | `m` | `n` | `n` -CONFIG_EXFAT_FS | N/A | N/A | `m` | `m` | `m` | `m` -CONFIG_EXT2_FS | `n` | `m` | `n` | `m` | `n` | `n` -CONFIG_EXT3_FS | `n` | `m` | `n` | `m` | `n` | `n` -CONFIG_GFS2_FS | `m` | `m` | `m` | `m` | `n` | `n` -CONFIG_HFSPLUS_FS | `n` | `m` | `n` | `m` | `n` | `n` -CONFIG_HFS_FS | `n` | `m` | `n` | `m` | `n` | `n` -CONFIG_JFS_FS | `n` | `n` | `n` | `n` | `n` | `n` -CONFIG_LDM_PARTITION | `n` | `y` | `n` | `y` | `n` | `n` -CONFIG_MAC_PARTITION | `n` | `y` | `n` | `y` | `n` | `n` -CONFIG_NFS_V2 | `n` | `m` | `n` | `m` | `n` | `n` -CONFIG_NTFS_FS | `n` | `m` | `n` | `n` | `n` | `n` -CONFIG_ROMFS_FS | `n` | `m` | `n` | `m` | `n` | `n` -CONFIG_SOLARIS_X86_PARTITION | `n` | `y` | `n` | `y` | `n` | `n` -CONFIG_SQUASHFS_ZSTD | `n` | `y` | `n` | `y` | `y` | `y` -CONFIG_SUN_PARTITION | `n` | `y` | `n` | `y` | `n` | `n` +`CONFIG` option | AL2/4.14/aarch64 | AL2/4.14/x86_64 | AL2/5.10/aarch64 | AL2/5.10/x86_64 | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 | AL2023/6.12/aarch64 | AL2023/6.12/x86_64 +---|---|---|---|---|---|---|---|--- +CONFIG_AFS_FS | `n` | `m` | `n` | `m` | `n` | `n` | `n` | `n` +CONFIG_AF_RXRPC | `n` | `m` | `n` | `m` | `n` | `n` | `n` | `n` +CONFIG_BSD_DISKLABEL | `y` | `y` | `y` | `y` | `n` | `n` | `n` | `n` +CONFIG_CRAMFS | `m` | `m` | `m` | `m` | `n` | `n` | `n` | `n` +CONFIG_CRAMFS_BLOCKDEV | N/A | N/A | `y` | `n` | N/A | N/A | N/A | N/A +CONFIG_DM_CLONE | N/A | N/A | `n` | `n` | `n` | `n` | `n` | `n` +CONFIG_DM_ERA | `m` | `n` | `m` | `n` | `n` | `n` | `n` | `n` +CONFIG_DM_INTEGRITY | `n` | `m` | `n` | `m` | `m` | `m` | `m` | `m` +CONFIG_DM_LOG_WRITES | `n` | `n` | `m` | `m` | `m` | `m` | `m` | `m` +CONFIG_DM_SWITCH | `m` | `n` | `m` | `n` | `n` | `n` | `n` | `n` +CONFIG_DM_VERITY | `m` | `n` | `m` | `n` | `n` | `n` | `n` | `n` +CONFIG_ECRYPT_FS | `n` | `m` | `n` | `m` | `n` | `n` | `n` | `n` +CONFIG_EXFAT_FS | N/A | N/A | `m` | `m` | `m` | `m` | `m` | `m` +CONFIG_EXT2_FS | `n` | `m` | `n` | `m` | `n` | `n` | `n` | `n` +CONFIG_EXT3_FS | `n` | `m` | `n` | `m` | `n` | `n` | `n` | `n` +CONFIG_GFS2_FS | `m` | `m` | `m` | `m` | `n` | `n` | `n` | `n` +CONFIG_HFSPLUS_FS | `n` | `m` | `n` | `m` | `n` | `n` | `n` | `n` +CONFIG_HFS_FS | `n` | `m` | `n` | `m` | `n` | `n` | `n` | `n` +CONFIG_JFS_FS | `n` | `n` | `n` | `n` | `n` | `n` | `n` | `n` +CONFIG_LDM_PARTITION | `n` | `y` | `n` | `y` | `n` | `n` | `n` | `n` +CONFIG_MAC_PARTITION | `n` | `y` | `n` | `y` | `n` | `n` | `n` | `n` +CONFIG_NFS_V2 | `n` | `m` | `n` | `m` | `n` | `n` | `n` | `n` +CONFIG_NTFS_FS | `n` | `m` | `n` | `n` | `n` | `n` | `n` | `n` +CONFIG_ROMFS_FS | `n` | `m` | `n` | `m` | `n` | `n` | `n` | `n` +CONFIG_SOLARIS_X86_PARTITION | `n` | `y` | `n` | `y` | `n` | `n` | `n` | `n` +CONFIG_SQUASHFS_ZSTD | `n` | `y` | `n` | `y` | `y` | `y` | `y` | `y` +CONFIG_SUN_PARTITION | `n` | `y` | `n` | `y` | `n` | `n` | `n` | `n`