Skip to content

[codex] security: allow absent usercopy default symbol #65

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Jess Sullivan (Jesssullivan) merged 1 commit into from
May 9, 2026
Merged

[codex] security: allow absent usercopy default symbol #65

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 16 additions & 1 deletion xr/scripts/check-security-config.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,21 @@ expect_value() {
fi
}

expect_value_when_available() {
local key="$1"
local expected="$2"
local actual

actual="$(config_line "${key}")"
if [[ -z "${actual}" ]]; then
echo " OK: ${key} absent in this kernel Kconfig"
elif [[ "${actual}" == "${key}=${expected}" ]]; then
echo " OK: ${key}=${expected}"
else
fail_key "${key}" "${expected} when available" "${actual}"
fi
}

expect_disabled_or_absent() {
local key="$1"
local actual
Expand Down Expand Up @@ -131,7 +146,7 @@ expect_value CONFIG_EVM y
# General hardening options that should not regress in this kernel lane.
expect_value CONFIG_BPF_UNPRIV_DEFAULT_OFF y
expect_value CONFIG_HARDENED_USERCOPY y
expect_value CONFIG_HARDENED_USERCOPY_DEFAULT_ON y
expect_value_when_available CONFIG_HARDENED_USERCOPY_DEFAULT_ON y
expect_value CONFIG_SLAB_FREELIST_HARDENED y
expect_value CONFIG_STRICT_DEVMEM y
expect_value CONFIG_LSM_MMAP_MIN_ADDR 65535
Expand Down
3 changes: 2 additions & 1 deletion xr/source-sync.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,8 @@ As of 2026-05-09:
repo-managed reserved-`CVE-2026-43500` RxRPC build route. The zero-fuzz DSC
carry conflict is fixed; the next proof gate is preserving the
`CONFIG_FW_LOADER_USER_HELPER=n` systemd/Rocky boot contract on this older
Kconfig.
Kconfig while allowing hardening symbols that do not exist yet in `6.12.y` to
be absent rather than disabled.
- RT candidate floor: `v7.0.1` with `patch-7.0.1-rt2`
- RT blockers: newest stable `v7.0.5` has no matching RT patch yet; `v6.18.13-rt4` fails the CVE-2026-31431 gate because the repo does not carry a 6.18.13 backport

Expand Down
Loading