Skip to content

JayJersan/linux-kernel-configs

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

79 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Linux Kernel Configs for Popular Distros

CI status

There is often a need to check a kernel config and other OS configuration to make a dev/design decision. The question often pops-up, does the popular distributions support the kernel config that the implementation expects? This is an attempt to answer that.

My specific use-case: KubeArmor leverages LSMs (Linux Security Modules) and eBPF for in-kernel policy controls. We had to refer to kernel configs for making design/dev decisions regarding whether we can depend on a certain kernel primitive. The boot configs part of this repo helped in making an informed choice.

Distribution Details

Distro Arch Kernel Kernel Config hostnamectl os-release
Amazon Linux 2022 x86_64 5.10.75 config file file
Amazon Linux 2023 x86_64 6.1.19 config file file
Amazon Linux 2 x86_64 4.14.252 config file NotAvailable
Amazon Linux 2 x86_64 5.10.75 config file NotAvailable
Amazon Linux 2 x86_64 5.15.86 config file file
Amazon Linux 2 x86_64 5.4.226 config file file
Arch Linux x86 6.2.1 config file file
CentOS Linux 7 (Core) x86_64 3.10.0 config file file
CentOS Linux 8 x86_64 4.18.0 config file NotAvailable
CentOS Linux 8 x86_64 4.18.0 config file file
Container-Optimized OS from Google x86_64 5.10.90 config file file
Container-Optimized OS from Google x86_64 5.4.144 config file NotAvailable
Debian GNU/Linux 10 (buster) x86 4.19.181 config file NotAvailable
Fedora CoreOS 35.20211203.3.0 x86_64 5.15.6 config file file
Flatcar Container Linux by Kinvolk 3033.2.0 (Oklo) x86 5.10.84 config file file
k3OS v0.21.5-k3s2r1 x86 5.4.0 config NotAvailable file
Oracle Linux Server 8.6 x86_64 4.18.0 config file file
Oracle Linux Server 8.7 x86_64 5.15.0 config file file
Oracle Linux Server 8.8 x86_64 5.15.0 config file file
Pop!_OS 21.04 x86 5.11.0 config file file
Pop!_OS 21.10 x86 5.15.5 config file file
RancherOS v1.5.8 x86 4.14.138 config NotAvailable file
Raspbian GNU/Linux 10 (buster) arm 5.10.17 config file file
Red Hat Enterprise Linux 8.1 (Ootpa) x86_64 4.18.0 config file file
Red Hat Enterprise Linux 8.4 (Ootpa) x86_64 4.18.0 config file NotAvailable
Red Hat Enterprise Linux 8.5 (Ootpa) x86_64 4.18.0 config file file
Red Hat Enterprise Linux 9.2 (Plow) x86_64 5.14.0 config file file
Red Hat Enterprise Linux Server 7.9 (Maipo) x86_64 3.10.0 config file file
Rocky Linux 8.7 (Green Obsidian) x86_64 4.18.0 config file file
Rocky Linux 9.0 (Blue Onyx) x86_64 5.14.0 config file file
SUSE Linux Enterprise Server 12 SP5 x86_64 4.12.14 config file NotAvailable
SUSE Linux Enterprise Server 15 SP3 x86 5.3.18 config file NotAvailable
Ubuntu 16.04.7 LTS x86 4.15.0 config file file
Ubuntu 18.04.6 LTS x86 4.15.0 config file file
Ubuntu 18.04.6 LTS x86_64 5.4.0 config file NotAvailable
Ubuntu 20.04.3 LTS x86_64 5.11.0 config file NotAvailable
Ubuntu 20.04.3 LTS x86 5.11.0 config file file
VMware Photon OS/Linux x86_64 5.10.61 config file file

Compositions

Kernel Audit Support

Distro Arch Kernel CONFIG_AUDIT CONFIG_AUDIT_ARCH CONFIG_AUDITSYSCALL
Amazon Linux 2022 x86_64 5.10.75 ✔️ ✔️ ✔️
Amazon Linux 2023 x86_64 6.1.19 ✔️ ✔️ ✔️
Amazon Linux 2 x86_64 4.14.252 ✔️ ✔️ ✔️
Amazon Linux 2 x86_64 5.10.75 ✔️ ✔️ ✔️
Amazon Linux 2 x86_64 5.15.86 ✔️ ✔️ ✔️
Amazon Linux 2 x86_64 5.4.226 ✔️ ✔️ ✔️
Arch Linux x86 6.2.1 ✔️ ✔️ ✔️
CentOS Linux 7 (Core) x86_64 3.10.0 ✔️ ✔️ ✔️
CentOS Linux 8 x86_64 4.18.0 ✔️ ✔️ ✔️
CentOS Linux 8 x86_64 4.18.0 ✔️ ✔️ ✔️
Container-Optimized OS from Google x86_64 5.10.90 ✔️ ✔️ ✔️
Container-Optimized OS from Google x86_64 5.4.144 ✔️ ✔️ ✔️
Debian GNU/Linux 10 (buster) x86 4.19.181 ✔️ ✔️ ✔️
Fedora CoreOS 35.20211203.3.0 x86_64 5.15.6 ✔️ ✔️ ✔️
Flatcar Container Linux by Kinvolk 3033.2.0 (Oklo) x86 5.10.84 ✔️ ✔️ ✔️
k3OS v0.21.5-k3s2r1 x86 5.4.0 ✔️ ✔️ ✔️
Oracle Linux Server 8.6 x86_64 4.18.0 ✔️ ✔️ ✔️
Oracle Linux Server 8.7 x86_64 5.15.0 ✔️ ✔️ ✔️
Oracle Linux Server 8.8 x86_64 5.15.0 ✔️ ✔️ ✔️
Pop!_OS 21.04 x86 5.11.0 ✔️ ✔️ ✔️
Pop!_OS 21.10 x86 5.15.5 ✔️ ✔️ ✔️
RancherOS v1.5.8 x86 4.14.138 ✔️ ✔️ ✔️
Raspbian GNU/Linux 10 (buster) arm 5.10.17 ✔️ ✔️
Red Hat Enterprise Linux 8.1 (Ootpa) x86_64 4.18.0 ✔️ ✔️ ✔️
Red Hat Enterprise Linux 8.4 (Ootpa) x86_64 4.18.0 ✔️ ✔️ ✔️
Red Hat Enterprise Linux 8.5 (Ootpa) x86_64 4.18.0 ✔️ ✔️ ✔️
Red Hat Enterprise Linux 9.2 (Plow) x86_64 5.14.0 ✔️ ✔️ ✔️
Red Hat Enterprise Linux Server 7.9 (Maipo) x86_64 3.10.0 ✔️ ✔️ ✔️
Rocky Linux 8.7 (Green Obsidian) x86_64 4.18.0 ✔️ ✔️ ✔️
Rocky Linux 9.0 (Blue Onyx) x86_64 5.14.0 ✔️ ✔️ ✔️
SUSE Linux Enterprise Server 12 SP5 x86_64 4.12.14 ✔️ ✔️ ✔️
SUSE Linux Enterprise Server 15 SP3 x86 5.3.18 ✔️ ✔️ ✔️
Ubuntu 16.04.7 LTS x86 4.15.0 ✔️ ✔️ ✔️
Ubuntu 18.04.6 LTS x86 4.15.0 ✔️ ✔️ ✔️
Ubuntu 18.04.6 LTS x86_64 5.4.0 ✔️ ✔️ ✔️
Ubuntu 20.04.3 LTS x86_64 5.11.0 ✔️ ✔️ ✔️
Ubuntu 20.04.3 LTS x86 5.11.0 ✔️ ✔️ ✔️
VMware Photon OS/Linux x86_64 5.10.61 ✔️ ✔️ ✔️

This table lists kernel audit support. There is a userspace auditd daemon that is a separate accessory tooling leveraging kernel audit support. This table has nothing to do with userspace components.

BPF/eBPF Support

Distro Arch Kernel CONFIG_BPF CGROUP_BPF BPF_SYSCALL BPF_JIT BPF_LSM BPF_KPROBE_OVERRIDE BPFILTER NET_ACT_BPF NET_CLS_BPF BPF_EVENTS LWTUNNEL_BPF BPF_STREAM_PARSER NETFILTER_XT_MATCH_BPF IPV6_SEG6_BPF
Amazon Linux 2022 x86_64 5.10.75 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Amazon Linux 2023 x86_64 6.1.19 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Amazon Linux 2 x86_64 4.14.252 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Amazon Linux 2 x86_64 5.10.75 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Amazon Linux 2 x86_64 5.15.86 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Amazon Linux 2 x86_64 5.4.226 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Arch Linux x86 6.2.1 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
CentOS Linux 7 (Core) x86_64 3.10.0 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
CentOS Linux 8 x86_64 4.18.0 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
CentOS Linux 8 x86_64 4.18.0 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Container-Optimized OS from Google x86_64 5.10.90 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Container-Optimized OS from Google x86_64 5.4.144 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Debian GNU/Linux 10 (buster) x86 4.19.181 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Fedora CoreOS 35.20211203.3.0 x86_64 5.15.6 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Flatcar Container Linux by Kinvolk 3033.2.0 (Oklo) x86 5.10.84 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
k3OS v0.21.5-k3s2r1 x86 5.4.0 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Oracle Linux Server 8.6 x86_64 4.18.0 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Oracle Linux Server 8.7 x86_64 5.15.0 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Oracle Linux Server 8.8 x86_64 5.15.0 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Pop!_OS 21.04 x86 5.11.0 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Pop!_OS 21.10 x86 5.15.5 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
RancherOS v1.5.8 x86 4.14.138 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Raspbian GNU/Linux 10 (buster) arm 5.10.17 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Red Hat Enterprise Linux 8.1 (Ootpa) x86_64 4.18.0 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Red Hat Enterprise Linux 8.4 (Ootpa) x86_64 4.18.0 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Red Hat Enterprise Linux 8.5 (Ootpa) x86_64 4.18.0 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Red Hat Enterprise Linux 9.2 (Plow) x86_64 5.14.0 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Red Hat Enterprise Linux Server 7.9 (Maipo) x86_64 3.10.0 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Rocky Linux 8.7 (Green Obsidian) x86_64 4.18.0 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Rocky Linux 9.0 (Blue Onyx) x86_64 5.14.0 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
SUSE Linux Enterprise Server 12 SP5 x86_64 4.12.14 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
SUSE Linux Enterprise Server 15 SP3 x86 5.3.18 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Ubuntu 16.04.7 LTS x86 4.15.0 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Ubuntu 18.04.6 LTS x86 4.15.0 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Ubuntu 18.04.6 LTS x86_64 5.4.0 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Ubuntu 20.04.3 LTS x86_64 5.11.0 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
Ubuntu 20.04.3 LTS x86 5.11.0 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️ ✔️
VMware Photon OS/Linux x86_64 5.10.61 ✔️ ✔️ ✔️ ✔️ ✔️ ✔️

CGROUP_BPF: Support for eBPF programs attached to cgroups. Allow attaching eBPF programs to a cgroup using the bpf(2) syscall command BPF_PROG_ATTACH.

LSM Support

Distro Arch Kernel BPF LSM AppArmor SELinux LandLock SMACK
Amazon Linux 2022 x86_64 5.10.75 ✔️ ✔️
Amazon Linux 2023 x86_64 6.1.19 ✔️ ✔️
Amazon Linux 2 x86_64 4.14.252 ✔️
Amazon Linux 2 x86_64 5.10.75 ✔️ ✔️
Amazon Linux 2 x86_64 5.15.86 ✔️ ✔️
Amazon Linux 2 x86_64 5.4.226 ✔️
Arch Linux x86 6.2.1 ✔️ ✔️ ✔️ ✔️ ✔️
CentOS Linux 7 (Core) x86_64 3.10.0 ✔️
CentOS Linux 8 x86_64 4.18.0 ✔️
CentOS Linux 8 x86_64 4.18.0 ✔️ ✔️
Container-Optimized OS from Google x86_64 5.10.90 ✔️ ✔️
Container-Optimized OS from Google x86_64 5.4.144 ✔️
Debian GNU/Linux 10 (buster) x86 4.19.181 ✔️ ✔️
Fedora CoreOS 35.20211203.3.0 x86_64 5.15.6 ✔️ ✔️ ✔️
Flatcar Container Linux by Kinvolk 3033.2.0 (Oklo) x86 5.10.84 ✔️ ✔️
k3OS v0.21.5-k3s2r1 x86 5.4.0 ✔️ ✔️ ✔️
Oracle Linux Server 8.6 x86_64 4.18.0 ✔️ ✔️
Oracle Linux Server 8.7 x86_64 5.15.0 ✔️ ✔️ ✔️
Oracle Linux Server 8.8 x86_64 5.15.0 ✔️ ✔️ ✔️
Pop!_OS 21.04 x86 5.11.0 ✔️ ✔️ ✔️ ✔️
Pop!_OS 21.10 x86 5.15.5 ✔️ ✔️ ✔️ ✔️ ✔️
RancherOS v1.5.8 x86 4.14.138 ✔️ ✔️ ✔️
Raspbian GNU/Linux 10 (buster) arm 5.10.17 ✔️
Red Hat Enterprise Linux 8.1 (Ootpa) x86_64 4.18.0 ✔️
Red Hat Enterprise Linux 8.4 (Ootpa) x86_64 4.18.0 ✔️
Red Hat Enterprise Linux 8.5 (Ootpa) x86_64 4.18.0 ✔️ ✔️
Red Hat Enterprise Linux 9.2 (Plow) x86_64 5.14.0 ✔️ ✔️
Red Hat Enterprise Linux Server 7.9 (Maipo) x86_64 3.10.0 ✔️
Rocky Linux 8.7 (Green Obsidian) x86_64 4.18.0 ✔️ ✔️
Rocky Linux 9.0 (Blue Onyx) x86_64 5.14.0 ✔️ ✔️
SUSE Linux Enterprise Server 12 SP5 x86_64 4.12.14 ✔️ ✔️
SUSE Linux Enterprise Server 15 SP3 x86 5.3.18 ✔️ ✔️ ✔️
Ubuntu 16.04.7 LTS x86 4.15.0 ✔️ ✔️ ✔️
Ubuntu 18.04.6 LTS x86 4.15.0 ✔️ ✔️ ✔️
Ubuntu 18.04.6 LTS x86_64 5.4.0 ✔️ ✔️ ✔️
Ubuntu 20.04.3 LTS x86_64 5.11.0 ✔️ ✔️ ✔️
Ubuntu 20.04.3 LTS x86 5.11.0 ✔️ ✔️ ✔️
VMware Photon OS/Linux x86_64 5.10.61 ✔️ ✔️ ✔️

Few LSMs are not stackable. For example, AppArmor and SELinux are not stackable. If you find that support for both SELinux and AppArmor are available, then only one can be enabled at boot time.

BPF LSM is the new kid on the block. BPF LSM depends on bpf-helpers and they vary from kernel to kernel.

Seccomp Support

Distro Arch Kernel Seccomp Seccomp Filter
Amazon Linux 2022 x86_64 5.10.75 ✔️ ✔️
Amazon Linux 2023 x86_64 6.1.19 ✔️ ✔️
Amazon Linux 2 x86_64 4.14.252 ✔️ ✔️
Amazon Linux 2 x86_64 5.10.75 ✔️ ✔️
Amazon Linux 2 x86_64 5.15.86 ✔️ ✔️
Amazon Linux 2 x86_64 5.4.226 ✔️ ✔️
Arch Linux x86 6.2.1 ✔️ ✔️
CentOS Linux 7 (Core) x86_64 3.10.0 ✔️ ✔️
CentOS Linux 8 x86_64 4.18.0 ✔️ ✔️
CentOS Linux 8 x86_64 4.18.0 ✔️ ✔️
Container-Optimized OS from Google x86_64 5.10.90 ✔️ ✔️
Container-Optimized OS from Google x86_64 5.4.144 ✔️ ✔️
Debian GNU/Linux 10 (buster) x86 4.19.181 ✔️ ✔️
Fedora CoreOS 35.20211203.3.0 x86_64 5.15.6 ✔️ ✔️
Flatcar Container Linux by Kinvolk 3033.2.0 (Oklo) x86 5.10.84 ✔️ ✔️
k3OS v0.21.5-k3s2r1 x86 5.4.0 ✔️ ✔️
Oracle Linux Server 8.6 x86_64 4.18.0 ✔️ ✔️
Oracle Linux Server 8.7 x86_64 5.15.0 ✔️ ✔️
Oracle Linux Server 8.8 x86_64 5.15.0 ✔️ ✔️
Pop!_OS 21.04 x86 5.11.0 ✔️ ✔️
Pop!_OS 21.10 x86 5.15.5 ✔️ ✔️
RancherOS v1.5.8 x86 4.14.138 ✔️ ✔️
Raspbian GNU/Linux 10 (buster) arm 5.10.17 ✔️ ✔️
Red Hat Enterprise Linux 8.1 (Ootpa) x86_64 4.18.0 ✔️ ✔️
Red Hat Enterprise Linux 8.4 (Ootpa) x86_64 4.18.0 ✔️ ✔️
Red Hat Enterprise Linux 8.5 (Ootpa) x86_64 4.18.0 ✔️ ✔️
Red Hat Enterprise Linux 9.2 (Plow) x86_64 5.14.0 ✔️ ✔️
Red Hat Enterprise Linux Server 7.9 (Maipo) x86_64 3.10.0 ✔️ ✔️
Rocky Linux 8.7 (Green Obsidian) x86_64 4.18.0 ✔️ ✔️
Rocky Linux 9.0 (Blue Onyx) x86_64 5.14.0 ✔️ ✔️
SUSE Linux Enterprise Server 12 SP5 x86_64 4.12.14 ✔️ ✔️
SUSE Linux Enterprise Server 15 SP3 x86 5.3.18 ✔️ ✔️
Ubuntu 16.04.7 LTS x86 4.15.0 ✔️ ✔️
Ubuntu 18.04.6 LTS x86 4.15.0 ✔️ ✔️
Ubuntu 18.04.6 LTS x86_64 5.4.0 ✔️ ✔️
Ubuntu 20.04.3 LTS x86_64 5.11.0 ✔️ ✔️
Ubuntu 20.04.3 LTS x86 5.11.0 ✔️ ✔️
VMware Photon OS/Linux x86_64 5.10.61 ✔️ ✔️

Contributions welcome...

Adding a new distro

Use following command to create a Distro/Kernel specific folder with the corresponding markdowns:

curl -s https://raw.githubusercontent.com/nyrahul/linux-kernel-configs/main/lk-config-get.sh | bash -s

if curl is not available, use wget ...

wget -q -O- https://raw.githubusercontent.com/nyrahul/linux-kernel-configs/main/lk-config-get.sh  | bash -s
  1. Copy the folder to your github fork
  2. Run make
  3. Raise a PR
Adding a new composition

Composition means a set of kernel configuration options shown in the context of all the distros. "LSM Support", "Seccomp Support" are examples of the compositions.

To create a new composition:

  1. Create a new composition file. Use tools/compositions/lsm.yaml as ref.
  2. Do a make
  3. Check if the composition is reflected in the README.md
  4. Raise a PR with the changes

About

Linux kernel configs for popular distros.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Shell 98.7%
  • Makefile 1.3%