release v6.18.42-seanfarm30 #14

Merged

pipeline-bot merged 1 commit from _promote/v6.18.42-seanfarm30 into main 2026-08-08 01:29:23 +00:00

Conversation 0 Commits 1 Files changed 1 +2

pipeline-bot commented 2026-08-08 01:29:22 +00:00

Collaborator

Copy link

No description provided.

pipeline-bot added 1 commit 2026-08-08 01:29:22 +00:00

feat(kernel): compile in the LSMs the config already declares ... 00401ff399

CONFIG_LSM lists "landlock,lockdown,yama,integrity,apparmor,bpf", but only
apparmor and bpf are built. On a running worker
/sys/kernel/security/lsm reads "capability,apparmor,bpf", so the landlock and
yama entries in that list are inert.

This cluster runs arbitrary code as a service, so the gap matters. Without yama
there is no kernel.yama.ptrace_scope, and any process can ptrace another process
of the same uid. Landlock gives unprivileged workloads a way to sandbox
themselves.

Enable the two LSMs that the declared list already names:
  CONFIG_SECURITY_YAMA=y
  CONFIG_SECURITY_LANDLOCK=y

Lockdown stays off deliberately. CONFIG_MODULES=n already does its main job, and
it interacts with BPF program loading, which Tetragon depends on.

Verify after the roll: /sys/kernel/security/lsm must gain landlock and yama, and
/proc/sys/kernel/yama/ptrace_scope must exist.

pipeline-bot merged commit 00401ff399 into main 2026-08-08 01:29:23 +00:00

pipeline-bot deleted branch _promote/v6.18.42-seanfarm30 2026-08-08 01:29:23 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/linux!14

No description provided.