From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id 3124CA5D3; Thu, 25 Jun 2026 20:21:25 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id 5FF82A585; Thu, 25 Jun 2026 20:21:21 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_PASS,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS autolearn=unavailable autolearn_force=no version=4.0.1 Received: from mail-106112.protonmail.ch (mail-106112.protonmail.ch [79.135.106.112]) by atuin.qyliss.net (Postfix) with ESMTPS id 9B516A4ED for ; Thu, 25 Jun 2026 20:21:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=colbyt.com; s=protonmail; t=1782418879; x=1782678079; bh=v0aLImSvjlGrsDuLZrjZXQLLS6k3Wre5ChiGCmtE2bc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:From:To: Cc:Date:Subject:Reply-To:Feedback-ID:Message-ID:BIMI-Selector; b=gJqxyx9Z1FPbwZEpytMIYHLLWMgVTFYk6gPMrXJRDGX2pSLBh0sZzyQsoq7cmczcQ zFPmiu7Tklo4D8fb1zFt709O/Tn9aEt3v1cFZSnl23rkTNhKQlRZb97W84onQ+QZwI 81D5KOkEMcx+Qwc7Mvi43xdb32Ts/ZrsHfEnxnOqjljgyPaZPuTGC6rQoX4s6ESmb/ sqUTo8I8mdkBJuKK9fWBrbZ+r3fdyQSqaMew7PvEdJtaYcy9zpj6qENfIn8/7gag/h pbgpIhoLWzTecD3bGKX8c8deOmcGRkbDMpK8hFXFD6yatdSL1G9A1AI8CzUH7lipUA bSnD1EZjeIhFg== X-Pm-Submission-Id: 4gmVZ55KGGz1DDr8 From: colbyt To: devel@spectrum-os.org Subject: [PATCH 5/5] host/rootfs: enable IPE in the host kernel Date: Thu, 25 Jun 2026 13:20:13 -0700 Message-ID: <20260625202013.1417254-6-colby@colbyt.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260625202013.1417254-1-colby@colbyt.com> References: <20260625202013.1417254-1-colby@colbyt.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: PR53JBVFJRV5U3FJIAU5UO6Q4FBB36G5 X-Message-ID-Hash: PR53JBVFJRV5U3FJIAU5UO6Q4FBB36G5 X-MailFrom: colby@colbyt.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: colbyt X-Mailman-Version: 3.3.10 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Enable the IPE LSM in the host kernel used by the Spectrum rootfs, including the QEMU host-rootfs run path. The generated kernel config already enables audit, audit syscall support, securityfs, and an LSM order containing ipe. Enabling SECURITY_IPE also selects the dm-verity root-hash provider for the host rootfs. This only enables kernel support. It does not install an IPE policy. Signed-off-by: colbyt --- host/rootfs/default.nix | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix index 6bfeefb..79baea4 100644 --- a/host/rootfs/default.nix +++ b/host/rootfs/default.nix @@ -51,7 +51,11 @@ let system.stateVersion = trivial.release; }); - kernel = linux_latest; + kernel = linux_latest.override { + structuredExtraConfig = with lib.kernel; { + SECURITY_IPE = yes; + }; + }; appvm = callSpectrumPackage ../../img/app { inherit (foot) terminfo; }; netvm = callSpectrumPackage ../../vm/sys/net { inherit (foot) terminfo; }; -- 2.54.0