AWS linux documentation change
Summary
Updated kernel configuration comparison table to add AL2023/6.18 kernel versions for both aarch64 and x86_64 architectures, and updated some configuration values (notably CONFIG_PPP changed from 'n' to 'm' for AL2023 versions, and CONFIG_EXT3_FS and CONFIG_PANIC_ON_OOPS_VALUE show N/A for 6.18)
Security assessment
This change documents kernel configuration differences between AL1 and newer AL2023 kernels. While it includes security-related kernel configurations (like CONFIG_SECURITY_DMESG_RESTRICT, CONFIG_FORTIFY_SOURCE, CONFIG_SLAB_FREELIST_HARDENED), the change itself is a routine documentation update to add newer kernel versions. There's no evidence of addressing a specific security vulnerability - it's simply extending the comparison table. The change does document security features present in different kernel versions, which helps users understand security hardening differences.
Diff
diff --git a/linux/al2023/ug/compare-with-al1-kernel.md b/linux/al2023/ug/compare-with-al1-kernel.md index 353ec6497..02d27f654 100644 --- a//linux/al2023/ug/compare-with-al1-kernel.md +++ b//linux/al2023/ug/compare-with-al1-kernel.md @@ -17,29 +17,29 @@ There have been several changes in the file systems that the kernel in AL1 will -`CONFIG` option | AL1/4.14/x86_64 | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 | AL2023/6.12/aarch64 | AL2023/6.12/x86_64 ----|---|---|---|---|--- -[CONFIG_AFS_FS](./compare-with-al2-kernel.html#CONFIG_AFS_FS) | `m` | `n` | `n` | `n` | `n` -[CONFIG_AF_RXRPC](./compare-with-al2-kernel.html#CONFIG_AF_RXRPC) | `m` | `n` | `n` | `n` | `n` -[CONFIG_BSD_DISKLABEL](./compare-with-al2-kernel.html#CONFIG_BSD_DISKLABEL) | `y` | `n` | `n` | `n` | `n` -[CONFIG_CRAMFS](./compare-with-al2-kernel.html#CONFIG_CRAMFS) | `m` | `n` | `n` | `n` | `n` -[CONFIG_CRAMFS_BLOCKDEV](./compare-with-al2-kernel.html#CONFIG_CRAMFS_BLOCKDEV) | N/A | N/A | N/A | N/A | N/A -[CONFIG_DM_CLONE](./compare-with-al2-kernel.html#CONFIG_DM_CLONE) | N/A | `n` | `n` | `n` | `n` -[CONFIG_DM_ERA](./compare-with-al2-kernel.html#CONFIG_DM_ERA) | `n` | `n` | `n` | `n` | `n` -[CONFIG_DM_INTEGRITY](./compare-with-al2-kernel.html#CONFIG_DM_INTEGRITY) | `m` | `m` | `m` | `m` | `m` -[CONFIG_DM_LOG_WRITES](./compare-with-al2-kernel.html#CONFIG_DM_LOG_WRITES) | `n` | `m` | `m` | `m` | `m` -[CONFIG_DM_SWITCH](./compare-with-al2-kernel.html#CONFIG_DM_SWITCH) | `n` | `n` | `n` | `n` | `n` -[CONFIG_DM_VERITY](./compare-with-al2-kernel.html#CONFIG_DM_VERITY) | `n` | `m` | `m` | `m` | `m` -[CONFIG_ECRYPT_FS](./compare-with-al2-kernel.html#CONFIG_ECRYPT_FS) | `m` | `n` | `n` | `n` | `n` -[CONFIG_EXFAT_FS](./compare-with-al2-kernel.html#CONFIG_EXFAT_FS) | N/A | `m` | `m` | `m` | `m` -[CONFIG_EXT2_FS](./compare-with-al2-kernel.html#CONFIG_EXT2_FS) | `m` | `n` | `n` | `n` | `n` -[CONFIG_EXT3_FS](./compare-with-al2-kernel.html#CONFIG_EXT3_FS) | `m` | `n` | `n` | `n` | `n` -[CONFIG_GFS2_FS](./compare-with-al2-kernel.html#CONFIG_GFS2_FS) | `n` | `n` | `n` | `n` | `n` -[CONFIG_HFSPLUS_FS](./compare-with-al2-kernel.html#CONFIG_HFSPLUS_FS) | `m` | `n` | `n` | `n` | `n` -[CONFIG_HFS_FS](./compare-with-al2-kernel.html#CONFIG_HFS_FS) | `m` | `n` | `n` | `n` | `n` -[CONFIG_JFS_FS](./compare-with-al2-kernel.html#CONFIG_JFS_FS) | `n` | `n` | `n` | `n` | `n` -[CONFIG_LDM_PARTITION](./compare-with-al2-kernel.html#CONFIG_LDM_PARTITION) | `y` | `n` | `n` | `n` | `n` -[CONFIG_MAC_PARTITION](./compare-with-al2-kernel.html#CONFIG_MAC_PARTITION) | `y` | `n` | `n` | `n` | `n` -[CONFIG_NFS_V2](./compare-with-al2-kernel.html#CONFIG_NFS_V2) | `m` | `n` | `n` | `n` | `n` -[CONFIG_NTFS_FS](./compare-with-al2-kernel.html#CONFIG_NTFS_FS) | `m` | `n` | `n` | `n` | `n` -[CONFIG_ROMFS_FS](./compare-with-al2-kernel.html#CONFIG_ROMFS_FS) | `m` | `n` | `n` | `n` | `n` -[CONFIG_SOLARIS_X86_PARTITION](./compare-with-al2-kernel.html#CONFIG_SOLARIS_X86_PARTITION) | `y` | `n` | `n` | `n` | `n` -[CONFIG_SQUASHFS_ZSTD](./compare-with-al2-kernel.html#CONFIG_SQUASHFS_ZSTD) | `y` | `y` | `y` | `y` | `y` -[CONFIG_SUN_PARTITION](./compare-with-al2-kernel.html#CONFIG_SUN_PARTITION) | `y` | `n` | `n` | `n` | `n` +`CONFIG` option | AL1/4.14/x86_64 | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 | AL2023/6.12/aarch64 | AL2023/6.12/x86_64 | AL2023/6.18/aarch64 | AL2023/6.18/x86_64 +---|---|---|---|---|---|---|--- +[CONFIG_AFS_FS](./compare-with-al2-kernel.html#CONFIG_AFS_FS) | `m` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_AF_RXRPC](./compare-with-al2-kernel.html#CONFIG_AF_RXRPC) | `m` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_BSD_DISKLABEL](./compare-with-al2-kernel.html#CONFIG_BSD_DISKLABEL) | `y` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_CRAMFS](./compare-with-al2-kernel.html#CONFIG_CRAMFS) | `m` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_CRAMFS_BLOCKDEV](./compare-with-al2-kernel.html#CONFIG_CRAMFS_BLOCKDEV) | N/A | N/A | N/A | N/A | N/A | N/A | N/A +[CONFIG_DM_CLONE](./compare-with-al2-kernel.html#CONFIG_DM_CLONE) | N/A | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_DM_ERA](./compare-with-al2-kernel.html#CONFIG_DM_ERA) | `n` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_DM_INTEGRITY](./compare-with-al2-kernel.html#CONFIG_DM_INTEGRITY) | `m` | `m` | `m` | `m` | `m` | `m` | `m` +[CONFIG_DM_LOG_WRITES](./compare-with-al2-kernel.html#CONFIG_DM_LOG_WRITES) | `n` | `m` | `m` | `m` | `m` | `m` | `m` +[CONFIG_DM_SWITCH](./compare-with-al2-kernel.html#CONFIG_DM_SWITCH) | `n` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_DM_VERITY](./compare-with-al2-kernel.html#CONFIG_DM_VERITY) | `n` | `m` | `m` | `m` | `m` | `m` | `m` +[CONFIG_ECRYPT_FS](./compare-with-al2-kernel.html#CONFIG_ECRYPT_FS) | `m` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_EXFAT_FS](./compare-with-al2-kernel.html#CONFIG_EXFAT_FS) | N/A | `m` | `m` | `m` | `m` | `m` | `m` +[CONFIG_EXT2_FS](./compare-with-al2-kernel.html#CONFIG_EXT2_FS) | `m` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_EXT3_FS](./compare-with-al2-kernel.html#CONFIG_EXT3_FS) | `m` | `n` | `n` | `n` | `n` | N/A | N/A +[CONFIG_GFS2_FS](./compare-with-al2-kernel.html#CONFIG_GFS2_FS) | `n` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_HFSPLUS_FS](./compare-with-al2-kernel.html#CONFIG_HFSPLUS_FS) | `m` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_HFS_FS](./compare-with-al2-kernel.html#CONFIG_HFS_FS) | `m` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_JFS_FS](./compare-with-al2-kernel.html#CONFIG_JFS_FS) | `n` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_LDM_PARTITION](./compare-with-al2-kernel.html#CONFIG_LDM_PARTITION) | `y` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_MAC_PARTITION](./compare-with-al2-kernel.html#CONFIG_MAC_PARTITION) | `y` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_NFS_V2](./compare-with-al2-kernel.html#CONFIG_NFS_V2) | `m` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_NTFS_FS](./compare-with-al2-kernel.html#CONFIG_NTFS_FS) | `m` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_ROMFS_FS](./compare-with-al2-kernel.html#CONFIG_ROMFS_FS) | `m` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_SOLARIS_X86_PARTITION](./compare-with-al2-kernel.html#CONFIG_SOLARIS_X86_PARTITION) | `y` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_SQUASHFS_ZSTD](./compare-with-al2-kernel.html#CONFIG_SQUASHFS_ZSTD) | `y` | `y` | `y` | `y` | `y` | `y` | `y` +[CONFIG_SUN_PARTITION](./compare-with-al2-kernel.html#CONFIG_SUN_PARTITION) | `y` | `n` | `n` | `n` | `n` | `n` | `n` @@ -49,19 +49,19 @@ There have been several changes in the file systems that the kernel in AL1 will -`CONFIG` option | AL1/4.14/x86_64 | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 | AL2023/6.12/aarch64 | AL2023/6.12/x86_64 ----|---|---|---|---|--- -[CONFIG_BUG_ON_DATA_CORRUPTION](./kernel-hardening.html#CONFIG_BUG_ON_DATA_CORRUPTION) | `y` | `y` | `y` | `y` | `y` -[CONFIG_DEFAULT_MMAP_MIN_ADDR](./kernel-hardening.html#CONFIG_DEFAULT_MMAP_MIN_ADDR) | `4096` | `65536` | `65536` | `65536` | `65536` -[CONFIG_DEVMEM](./compare-with-al2-kernel.html#CONFIG_DEVMEM) | `y` | `n` | `n` | `n` | `n` -[CONFIG_DEVPORT](./compare-with-al2-kernel.html#CONFIG_DEVPORT) | `y` | `n` | `n` | `n` | `n` -[CONFIG_FORTIFY_SOURCE](./compare-with-al2-kernel.html#CONFIG_FORTIFY_SOURCE) | `y` | `y` | `y` | `y` | `y` -[CONFIG_HARDENED_USERCOPY_FALLBACK](./kernel-hardening.html#CONFIG_HARDENED_USERCOPY_FALLBACK) | N/A | N/A | N/A | N/A | N/A -[CONFIG_INIT_ON_ALLOC_DEFAULT_ON](./kernel-hardening.html#CONFIG_INIT_ON_ALLOC_DEFAULT_ON) | N/A | `n` | `n` | `n` | `n` -[CONFIG_INIT_ON_FREE_DEFAULT_ON](./kernel-hardening.html#CONFIG_INIT_ON_FREE_DEFAULT_ON) | N/A | `n` | `n` | `n` | `n` -[CONFIG_IOMMU_DEFAULT_DMA_STRICT](./kernel-hardening.html#CONFIG_IOMMU_DEFAULT_DMA_STRICT) | N/A | `n` | `n` | `n` | `n` -[CONFIG_LDISC_AUTOLOAD](./compare-with-al2-kernel.html#CONFIG_LDISC_AUTOLOAD) | `y` | `n` | `n` | `n` | `n` -[CONFIG_SCHED_CORE](./kernel-hardening.html#CONFIG_SCHED_CORE) | N/A | N/A | `y` | N/A | `y` -[CONFIG_SCHED_STACK_END_CHECK](./kernel-hardening.html#CONFIG_SCHED_STACK_END_CHECK) | `y` | `y` | `y` | `y` | `y` -[CONFIG_SECURITY_DMESG_RESTRICT](./compare-with-al2-kernel.html#CONFIG_SECURITY_DMESG_RESTRICT) | `n` | `y` | `y` | `y` | `y` -[CONFIG_SECURITY_SELINUX_DISABLE](./compare-with-al2-kernel.html#CONFIG_SECURITY_SELINUX_DISABLE) | `y` | `n` | `n` | N/A | N/A -[CONFIG_SHUFFLE_PAGE_ALLOCATOR](./kernel-hardening.html#CONFIG_SHUFFLE_PAGE_ALLOCATOR) | N/A | `y` | `y` | `y` | `y` -[CONFIG_SLAB_FREELIST_HARDENED](./kernel-hardening.html#CONFIG_SLAB_FREELIST_HARDENED) | `y` | `y` | `y` | `y` | `y` -[CONFIG_SLAB_FREELIST_RANDOM](./kernel-hardening.html#CONFIG_SLAB_FREELIST_RANDOM) | `n` | `y` | `y` | `y` | `y` +`CONFIG` option | AL1/4.14/x86_64 | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 | AL2023/6.12/aarch64 | AL2023/6.12/x86_64 | AL2023/6.18/aarch64 | AL2023/6.18/x86_64 +---|---|---|---|---|---|---|--- +[CONFIG_BUG_ON_DATA_CORRUPTION](./kernel-hardening.html#CONFIG_BUG_ON_DATA_CORRUPTION) | `y` | `y` | `y` | `y` | `y` | `y` | `y` +[CONFIG_DEFAULT_MMAP_MIN_ADDR](./kernel-hardening.html#CONFIG_DEFAULT_MMAP_MIN_ADDR) | `4096` | `65536` | `65536` | `65536` | `65536` | `65536` | `65536` +[CONFIG_DEVMEM](./compare-with-al2-kernel.html#CONFIG_DEVMEM) | `y` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_DEVPORT](./compare-with-al2-kernel.html#CONFIG_DEVPORT) | `y` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_FORTIFY_SOURCE](./compare-with-al2-kernel.html#CONFIG_FORTIFY_SOURCE) | `y` | `y` | `y` | `y` | `y` | `y` | `y` +[CONFIG_HARDENED_USERCOPY_FALLBACK](./kernel-hardening.html#CONFIG_HARDENED_USERCOPY_FALLBACK) | N/A | N/A | N/A | N/A | N/A | N/A | N/A +[CONFIG_INIT_ON_ALLOC_DEFAULT_ON](./kernel-hardening.html#CONFIG_INIT_ON_ALLOC_DEFAULT_ON) | N/A | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_INIT_ON_FREE_DEFAULT_ON](./kernel-hardening.html#CONFIG_INIT_ON_FREE_DEFAULT_ON) | N/A | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_IOMMU_DEFAULT_DMA_STRICT](./kernel-hardening.html#CONFIG_IOMMU_DEFAULT_DMA_STRICT) | N/A | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_LDISC_AUTOLOAD](./compare-with-al2-kernel.html#CONFIG_LDISC_AUTOLOAD) | `y` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_SCHED_CORE](./kernel-hardening.html#CONFIG_SCHED_CORE) | N/A | N/A | `y` | N/A | `y` | N/A | `y` +[CONFIG_SCHED_STACK_END_CHECK](./kernel-hardening.html#CONFIG_SCHED_STACK_END_CHECK) | `y` | `y` | `y` | `y` | `y` | `y` | `y` +[CONFIG_SECURITY_DMESG_RESTRICT](./compare-with-al2-kernel.html#CONFIG_SECURITY_DMESG_RESTRICT) | `n` | `y` | `y` | `y` | `y` | `y` | `y` +[CONFIG_SECURITY_SELINUX_DISABLE](./compare-with-al2-kernel.html#CONFIG_SECURITY_SELINUX_DISABLE) | `y` | `n` | `n` | N/A | N/A | N/A | N/A +[CONFIG_SHUFFLE_PAGE_ALLOCATOR](./kernel-hardening.html#CONFIG_SHUFFLE_PAGE_ALLOCATOR) | N/A | `y` | `y` | `y` | `y` | `y` | `y` +[CONFIG_SLAB_FREELIST_HARDENED](./kernel-hardening.html#CONFIG_SLAB_FREELIST_HARDENED) | `y` | `y` | `y` | `y` | `y` | `y` | `y` +[CONFIG_SLAB_FREELIST_RANDOM](./kernel-hardening.html#CONFIG_SLAB_FREELIST_RANDOM) | `n` | `y` | `y` | `y` | `y` | `y` | `y` @@ -71,9 +71,9 @@ There have been several changes in the file systems that the kernel in AL1 will -`CONFIG` option | AL1/4.14/x86_64 | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 | AL2023/6.12/aarch64 | AL2023/6.12/x86_64 ----|---|---|---|---|--- -[CONFIG_HZ](./compare-with-al2-kernel.html#CONFIG_HZ) | `250` | `100` | `100` | `100` | `100` -[CONFIG_NR_CPUS](./compare-with-al2-kernel.html#CONFIG_NR_CPUS) | `8192` | `4096` | `8192` | `4096` | `8192` -[CONFIG_PANIC_ON_OOPS](./compare-with-al2-kernel.html#CONFIG_PANIC_ON_OOPS) | `n` | `y` | `y` | `y` | `y` -[CONFIG_PANIC_ON_OOPS_VALUE](./compare-with-al2-kernel.html#CONFIG_PANIC_ON_OOPS_VALUE) | `0` | `1` | `1` | `1` | `1` -[CONFIG_PPP](./compare-with-al2-kernel.html#CONFIG_PPP) | `m` | `n` | `n` | `n` | `n` -[CONFIG_SLIP](./compare-with-al2-kernel.html#CONFIG_SLIP) | `m` | `n` | `n` | `n` | `n` -[CONFIG_XEN_PV](./compare-with-al2-kernel.html#CONFIG_XEN_PV) | `y` | N/A | `n` | N/A | `n` +`CONFIG` option | AL1/4.14/x86_64 | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 | AL2023/6.12/aarch64 | AL2023/6.12/x86_64 | AL2023/6.18/aarch64 | AL2023/6.18/x86_64 +---|---|---|---|---|---|---|--- +[CONFIG_HZ](./compare-with-al2-kernel.html#CONFIG_HZ) | `250` | `100` | `100` | `100` | `100` | `100` | `100` +[CONFIG_NR_CPUS](./compare-with-al2-kernel.html#CONFIG_NR_CPUS) | `8192` | `4096` | `8192` | `4096` | `8192` | `4096` | `8192` +[CONFIG_PANIC_ON_OOPS](./compare-with-al2-kernel.html#CONFIG_PANIC_ON_OOPS) | `n` | `y` | `y` | `y` | `y` | `y` | `y` +[CONFIG_PANIC_ON_OOPS_VALUE](./compare-with-al2-kernel.html#CONFIG_PANIC_ON_OOPS_VALUE) | `0` | `1` | `1` | `1` | `1` | N/A | N/A +[CONFIG_PPP](./compare-with-al2-kernel.html#CONFIG_PPP) | `m` | `m` | `m` | `m` | `m` | `m` | `m` +[CONFIG_SLIP](./compare-with-al2-kernel.html#CONFIG_SLIP) | `m` | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_XEN_PV](./compare-with-al2-kernel.html#CONFIG_XEN_PV) | `y` | N/A | `n` | N/A | `n` | N/A | `n`