Skip to content
This repository has been archived by the owner on Nov 24, 2019. It is now read-only.

Commit

Permalink
defconfig: disable auditing support
Browse files Browse the repository at this point in the history
99% users don't need for auditing infrastructure.
And because SELinux is still works without it, so better to nuke it
to decrease the possibility of kernel attack surface and also
reduce a possibility of fast path regression.

Of course with fakeconfig too,
since this action is definitely prohibited by Android VTS

Signed-off-by: Nanda Oktavera <codeharuka.yusa@gmail.com>
  • Loading branch information
okitavera committed Sep 6, 2019
1 parent a95cbdb commit eb2ce33
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 6 deletions.
5 changes: 5 additions & 0 deletions .fakeconfig
@@ -1 +1,6 @@
# fakeconfig
CONFIG_AUDIT=y
CONFIG_AUDITSYSCALL=y
CONFIG_INTEGRITY_AUDIT=y
CONFIG_AUDIT_GENERIC=y
CONFIG_AUDIT_COMPAT_GENERIC=y
7 changes: 1 addition & 6 deletions arch/arm64/configs/grus_defconfig
Expand Up @@ -54,9 +54,8 @@ CONFIG_SWAP=y
CONFIG_CROSS_MEMORY_ATTACH=y
# CONFIG_FHANDLE is not set
# CONFIG_USELIB is not set
CONFIG_AUDIT=y
# CONFIG_AUDIT is not set
CONFIG_HAVE_ARCH_AUDITSYSCALL=y
# CONFIG_AUDITSYSCALL is not set

#
# IRQ subsystem
Expand Down Expand Up @@ -831,7 +830,6 @@ CONFIG_NETFILTER_XT_CONNMARK=y
#
# Xtables targets
#
# CONFIG_NETFILTER_XT_TARGET_AUDIT is not set
# CONFIG_NETFILTER_XT_TARGET_CHECKSUM is not set
CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y
CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
Expand Down Expand Up @@ -5262,7 +5260,6 @@ CONFIG_SECURITY_SMACK=y
# CONFIG_SECURITY_YAMA is not set
CONFIG_INTEGRITY=y
# CONFIG_INTEGRITY_SIGNATURE is not set
CONFIG_INTEGRITY_AUDIT=y
# CONFIG_IMA is not set
# CONFIG_EVM is not set
CONFIG_DEFAULT_SECURITY_SELINUX=y
Expand Down Expand Up @@ -5463,9 +5460,7 @@ CONFIG_CRC32_SLICEBY8=y
CONFIG_LIBCRC32C=y
# CONFIG_CRC8 is not set
CONFIG_XXHASH=y
CONFIG_AUDIT_GENERIC=y
CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
CONFIG_AUDIT_COMPAT_GENERIC=y
# CONFIG_RANDOM32_SELFTEST is not set
CONFIG_ZLIB_INFLATE=y
CONFIG_ZLIB_DEFLATE=y
Expand Down

0 comments on commit eb2ce33

Please sign in to comment.