From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id A1358A59D; Thu, 25 Jun 2026 20:21:22 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id 6C8E8A4D9; Thu, 25 Jun 2026 20:21:19 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_PASS,SPF_HELO_PASS autolearn=unavailable autolearn_force=no version=4.0.1 Received: from mail-244106.protonmail.ch (mail-244106.protonmail.ch [109.224.244.106]) by atuin.qyliss.net (Postfix) with ESMTPS id 664D0A4CF for ; Thu, 25 Jun 2026 20:21:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=colbyt.com; s=protonmail; t=1782418877; x=1782678077; bh=o34HgHW+lrkOF1ps/909VfD5sAXv1jSUCw/pGO+1l90=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:From:To: Cc:Date:Subject:Reply-To:Feedback-ID:Message-ID:BIMI-Selector; b=lPn7LbfjXo718Ce6L5ugc/1cj4/9mFqN7YZi8INfhFpqXEIIHHQlC71FxGpVUygGd kb9FgoiTOhhdPYaYJZG+sLQYTpmfMDDkopROZMV/BuPWpB6PoEUvFL45gtisUbYnUK XPtkt/eDQlgdHyeUzIOOw2b+r40P4fOzBPC9oKJ98D+md+CCLJcMbmHHWN4tWagxpq GU/QPvBa6RZ1HxHhdcczrxSdvFgad4L9n6kWgGcguCUL8lKX5LRW5BsZurQCiZZfNy acV4bKbJanQl/xdiXmVatFAVfzz6ZWAKANBiH4gx0lMNoFGW5da+Vf6w+Q8gF4toae d/ZLjB52B8WUw== X-Pm-Submission-Id: 4gmVZ42l1fz1DFGF From: colbyt To: devel@spectrum-os.org Subject: [PATCH 4/5] vm: enable IPE in sub-VM kernels Date: Thu, 25 Jun 2026 13:20:12 -0700 Message-ID: <20260625202013.1417254-5-colby@colbyt.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260625202013.1417254-1-colby@colbyt.com> References: <20260625202013.1417254-1-colby@colbyt.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: KFYJWDCTMYL7PUAS7VCASFNWVQFJQQDC X-Message-ID-Hash: KFYJWDCTMYL7PUAS7VCASFNWVQFJQQDC X-MailFrom: colby@colbyt.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: colbyt X-Mailman-Version: 3.3.10 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Enable the IPE LSM in the app VM and net VM kernels. The generated kernel config already enables audit, audit syscall support, securityfs, and an LSM order containing ipe. Enabling SECURITY_IPE also selects the dm-verity root-hash provider, which lets later policy work match files that come from the verified root. This does not install an IPE policy yet. Signed-off-by: colbyt --- img/app/default.nix | 1 + vm/sys/net/default.nix | 1 + 2 files changed, 2 insertions(+) diff --git a/img/app/default.nix b/img/app/default.nix index 23487e3..8496755 100644 --- a/img/app/default.nix +++ b/img/app/default.nix @@ -33,6 +33,7 @@ let FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER = lib.mkForce unset; FRAMEBUFFER_CONSOLE_DETECT_PRIMARY = lib.mkForce unset; FRAMEBUFFER_CONSOLE_ROTATION = lib.mkForce unset; + SECURITY_IPE = yes; RC_CORE = lib.mkForce unset; VIRTIO = yes; VIRTIO_BLK = yes; diff --git a/vm/sys/net/default.nix b/vm/sys/net/default.nix index 7f077a9..2f7e31d 100644 --- a/vm/sys/net/default.nix +++ b/vm/sys/net/default.nix @@ -39,6 +39,7 @@ let FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER = lib.mkForce unset; FRAMEBUFFER_CONSOLE_DETECT_PRIMARY = lib.mkForce unset; FRAMEBUFFER_CONSOLE_ROTATION = lib.mkForce unset; + SECURITY_IPE = yes; RC_CORE = lib.mkForce unset; VIRTIO = yes; VIRTIO_BLK = yes; -- 2.54.0