alecStewart1
Apprentice
Joined: 03 Jul 2022
Posts: 174
|
 Posted: Thu Dec 26, 2024 9:02 pm Post subject: Dist-kernel 6.12.6 reboot to black screen |
 |
|
Hey gang,
So I'm on the verge of getting back up and running on my desktop after having forgotten to update the BIOS in awhile.
I updated to sys-kernel/gentoo-kernel 6.12.6, and everything compiled fine and I had to run dispatch-conf.
However, I rebooted and selected the dist-kernel created EFI file in my boot menu and I'm greeted with a black screen.
emerge --info
| Code: |
Portage 3.0.66.1 (python 3.12.8-final-0, default/linux/amd64/23.0/split-usr/hardened, gcc-14, glibc-2.40-r5, 6.12.3-artix1-1 x86_64)
=================================================================
System uname: Linux-6.12.3-artix1-1-x86_64-12th_Gen_Intel-R-_Core-TM-_i5-12600K-with-glibc2.40
KiB Mem: 32641784 total, 28956040 free
KiB Swap: 8388604 total, 8388604 free
Timestamp of repository CachyOS-kernels: Fri, 20 Dec 2024 03:03:34 +0000
Head commit of repository CachyOS-kernels: 64cafd61bb499328164d3afcd04e7b00750598ed
Timestamp of repository gentoobr: Sun, 22 Dec 2024 19:48:26 +0000
Head commit of repository gentoobr: adeeb9d04ce1534cce5adc175ca35cec0386f2c0
Timestamp of repository wayland-desktop: Sun, 22 Dec 2024 19:48:25 +0000
Head commit of repository wayland-desktop: 2437ec78201b2f946b8edb1cf594694431f9c7c5
Timestamp of repository steam-overlay: Sun, 22 Dec 2024 19:48:21 +0000
Head commit of repository steam-overlay: fc25c23144765c2fcc4726aa19448b0ed507fc3e
Head commit of repository librewolf: 9190b1d169578c7c223de90bb8c346c418307eaa
Timestamp of repository guru: Tue, 24 Dec 2024 12:03:22 +0000
Head commit of repository guru: 8bed6838d4a3085b3a90e4501a23fe115ffffb2c
Timestamp of repository gentoo: Tue, 24 Dec 2024 15:18:45 +0000
Head commit of repository gentoo: 75d00f02a570cf602fa4b1fef35f317b7f95dd33
Timestamp of repository haskell: Mon, 23 Dec 2024 18:48:24 +0000
Head commit of repository haskell: 9da6b597358f982da15ea161a4383fcd7ec60710
sh bash 5.2_p37
ld GNU ld (Gentoo 2.43 p3) 2.43.1
app-misc/pax-utils: 1.3.8::gentoo
app-shells/bash: 5.2_p37::gentoo
dev-build/autoconf: 2.72-r1::gentoo
dev-build/automake: 1.16.5-r2::gentoo
dev-build/cmake: 3.30.6::gentoo
dev-build/libtool: 2.4.7-r4::gentoo
dev-build/make: 4.4.1-r100::gentoo
dev-build/meson: 1.6.1::gentoo
dev-lang/perl: 5.40.0::gentoo
dev-lang/python: 3.11.11_p1::gentoo, 3.12.8::gentoo, 3.13.1::gentoo
dev-lang/rust-bin: 1.77.1-r101::gentoo, 1.82.0-r101::gentoo, 1.83.0::gentoo
llvm-core/clang: 18.1.8-r6::gentoo, 19.1.6::gentoo
llvm-core/lld: 18.1.8::gentoo, 19.1.6::gentoo
llvm-core/llvm: 18.1.8-r6::gentoo, 19.1.6::gentoo
sys-apps/baselayout: 2.17::gentoo
sys-apps/openrc: 0.55.1::gentoo
sys-apps/sandbox: 2.39::gentoo
sys-devel/binutils: 2.43-r2::gentoo
sys-devel/binutils-config: 5.5.2::gentoo
sys-devel/gcc: 14.2.1_p20241221::gentoo
sys-devel/gcc-config: 2.12.1::gentoo
sys-kernel/linux-headers: 6.6-r1::gentoo (virtual/os-headers)
sys-libs/glibc: 2.40-r5::gentoo
Repositories:
CachyOS-kernels
location: /var/db/repos/CachyOS-kernels
sync-type: git
sync-uri: https://github.com/gentoo-mirror/CachyOS-kernels.git
masters: gentoo
volatile: False
gentoobr
location: /var/db/repos/gentoobr
sync-type: git
sync-uri: https://github.com/gentoo-mirror/gentoobr.git
masters: gentoo
volatile: False
local-repo
location: /var/db/repos/local-repo
masters: gentoo
priority: 2
volatile: False
wayland-desktop
location: /var/db/repos/wayland-desktop
sync-type: git
sync-uri: https://github.com/gentoo-mirror/wayland-desktop.git
masters: gentoo
priority: 6
volatile: False
steam-overlay
location: /var/db/repos/steam-overlay
sync-type: git
sync-uri: https://github.com/gentoo-mirror/steam-overlay.git
masters: gentoo
priority: 7
volatile: False
librewolf
location: /var/db/repos/librewolf
sync-type: git
sync-uri: https://codeberg.org/librewolf/gentoo.git
masters: gentoo
priority: 8
volatile: False
guru
location: /var/db/repos/guru
sync-type: git
sync-uri: https://github.com/gentoo-mirror/guru.git
masters: gentoo
priority: 9
volatile: False
gentoo
location: /var/db/repos/gentoo
sync-type: git
sync-uri: https://github.com/gentoo-mirror/gentoo.git
priority: 10
volatile: False
haskell
location: /var/db/repos/haskell
sync-type: git
sync-uri: https://github.com/gentoo-mirror/haskell.git
masters: gentoo
priority: 11
volatile: False
ACCEPT_KEYWORDS="amd64"
ACCEPT_LICENSE="*"
AR="llvm-ar"
CBUILD="x86_64-pc-linux-gnu"
CC="clang"
CFLAGS="-O2 -march=alderlake -pipe -mno-cldemote -mno-kl -mno-sgx -mno-widekl -mshstk -fstack-protector-strong -fomit-frame-pointer"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo"
CPP="clang-cpp"
CPPFLAGS="-O2 -march=alderlake -pipe -mno-cldemote -mno-kl -mno-sgx -mno-widekl -mshstk -fstack-protector-strong -fomit-frame-pointer"
CXX="clang++"
CXXFLAGS="-O2 -march=alderlake -pipe -mno-cldemote -mno-kl -mno-sgx -mno-widekl -mshstk -fstack-protector-strong -fomit-frame-pointer"
DISTDIR="/var/cache/distfiles"
ENV_UNSET="CARGO_HOME DBUS_SESSION_BUS_ADDRESS DISPLAY GDK_PIXBUF_MODULE_FILE GOBIN GOPATH PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR XDG_STATE_HOME"
FCFLAGS="-O2 -pipe"
FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs binpkg-multi-instance buildpkg-live config-protect-if-modified distlocks downgrade-backup ebuild-locks fixlafiles ipc-sandbox merge-sync merge-wait mount-sandbox multilib-strict network-sandbox news parallel-fetch parallel-install pid-sandbox pkgdir-index-trusted preserve-libs protect-owned qa-unresolved-soname-deps sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr"
FFLAGS="-O2 -march=alderlake -pipe -mno-cldemote -mno-kl -mno-sgx -mno-widekl -mshstk -fstack-protector-strong -fomit-frame-pointer"
GENTOO_MIRRORS="https://mirror.csclub.uwaterloo.ca/gentoo-distfiles/ https://ftp.uni-hannover.de/gentoo/ https://mirror.netcologne.de/gentoo/ https://packages.hs-regensburg.de/gentoo-distfiles/ https://www.mirrorservice.org/sites/distfiles.gentoo.org/ https://gentoo.osuosl.org/ https://mirrors.rit.edu/gentoo/"
LANG="en_US.utf8"
LD="ld.lld"
LDFLAGS="-fuse-ld=mold -Wl,-O2 -Wl,--sort-common -Wl,--as-needed -Wl,-S"
LEX="flex"
LINGUAS="en en_US en-US ja ko zh-CN zh-TW"
MAKEOPTS="-j12"
NM="llvm-nm"
OBJCOPY="llvm-objcopy"
OBJDUMP="llvm-objdump"
PKGDIR="/var/cache/binpkgs"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git"
PORTAGE_TMPDIR="/var/tmp/portage"
RANLIB="llvm-ranlib"
RUSTFLAGS="-C target-cpu=native -C opt-level=3 -C strip=symbols -C embed-bitcode=yes"
SHELL="/usr/bin/bash"
STRIP="llvm-strip"
USE="X a52 aac acl acpi alsa amd64 apparmor audit bluetooth bzip2 caps cet clang crypt cups cxx dbus default-compiler-rt default-lld dga dri drm elogind emacs ffmpeg filecaps fontconfig gdbm gif gstreamer gui hardened iconv jpeg libtirpc llvm llvm-libunwind lto mp3 mp4 mpeg multilib ncurses ogg opengl openmp openrc opus oss pam pcre pic pie pipewire png readline savedconfig screencast seccomp sound split-usr ssl ssp svg syslog test-rust threads truetype udev udisks unicode upower usb vaapi vdpau verify-sig vorbis vtv vulkan wayland wifi xattr xcb xft xml xtpax zlib" ABI_X86="64 32" ADA_TARGET="gcc_12" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_anon authn_dbm authn_file authz_dbm authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir env expires ext_filter file_cache filter headers include info log_config logio mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes avx avx2 f16c fma3 mmx mmxext pclmul popcnt rdrand sha sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock greis isync itrax navcom oceanserver oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 tsip tripmate tnt ublox" GRUB_PLATFORMS="efi-64" GUILE_SINGLE_TARGET="3-0" GUILE_TARGETS="3-0" INPUT_DEVICES="libinput" KERNEL="linux" L10N="en en_US en-US ja ko zh-CN zh-TW" LCD_DEVICES="bayrad cfontz glk hd44780 lb216 lcdm001 mtxorb text" LUA_SINGLE_TARGET="luajit" LUA_TARGETS="lua5-4 luajit" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php8-2" POSTGRES_TARGETS="postgres16" PYTHON_SINGLE_TARGET="python3_12" PYTHON_TARGETS="python3_11 python3_12" QEMU_SOFTMMU_TARGETS="x86_64" QEMU_USER_TARGETS="x86_64" RUBY_TARGETS="ruby31 ruby32" VIDEO_CARDS="amdgpu radeonsi" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipp2p iface geoip fuzzy condition tarpit sysrq proto logmark ipmark dhcpmac delude chaos account"
Unset: ADDR2LINE, ARFLAGS, AS, ASFLAGS, CCLD, CONFIG_SHELL, CTARGET, CXXFILT, ELFEDIT, EMERGE_DEFAULT_OPTS, EXTRA_ECONF, F77FLAGS, FC, GCOV, GPROF, INSTALL_MASK, LC_ALL, LFLAGS, LIBTOOL, MAKE, MAKEFLAGS, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PYTHONPATH, READELF, SIZE, STRINGS, YACC, YFLAGS
|
/etc/portage/savedconfig/sys-kernel/gentoo-kernel-6.12.6
Don't know if this is helpful,
kernel-hardening-checker -c /etc/portage/savedconfig/sys-kernel/gentoo-kernel-6.12.6
| Code: |
[+] Kconfig file to check: /etc/portage/savedconfig/sys-kernel/gentoo-kernel-6.12.6
[+] Detected microarchitecture: X86_64
[+] Detected kernel version: (6, 12, 6)
[+] Detected compiler: CLANG 190106
=========================================================================================================================
option_name | type |desired_val | decision | reason | check_result
=========================================================================================================================
CONFIG_BUG |kconfig| y |defconfig | self_protection | OK
CONFIG_SLUB_DEBUG |kconfig| y |defconfig | self_protection | OK
CONFIG_THREAD_INFO_IN_TASK |kconfig| y |defconfig | self_protection | OK
CONFIG_IOMMU_SUPPORT |kconfig| y |defconfig | self_protection | OK
CONFIG_STACKPROTECTOR |kconfig| y |defconfig | self_protection | OK
CONFIG_STACKPROTECTOR_STRONG |kconfig| y |defconfig | self_protection | OK
CONFIG_STRICT_KERNEL_RWX |kconfig| y |defconfig | self_protection | OK
CONFIG_STRICT_MODULE_RWX |kconfig| y |defconfig | self_protection | OK
CONFIG_REFCOUNT_FULL |kconfig| y |defconfig | self_protection | OK: version >= (5, 4, 208)
CONFIG_INIT_STACK_ALL_ZERO |kconfig| y |defconfig | self_protection | OK
CONFIG_CPU_MITIGATIONS |kconfig| y |defconfig | self_protection | OK
CONFIG_RANDOMIZE_BASE |kconfig| y |defconfig | self_protection | OK
CONFIG_VMAP_STACK |kconfig| y |defconfig | self_protection | OK
CONFIG_DEBUG_WX |kconfig| y |defconfig | self_protection | OK
CONFIG_WERROR |kconfig| y |defconfig | self_protection | OK
CONFIG_X86_MCE |kconfig| y |defconfig | self_protection | OK
CONFIG_SYN_COOKIES |kconfig| y |defconfig | self_protection | OK
CONFIG_MICROCODE |kconfig| y |defconfig | self_protection | OK
CONFIG_MICROCODE_INTEL |kconfig| y |defconfig | self_protection | OK: CONFIG_MICROCODE is "y"
CONFIG_MICROCODE_AMD |kconfig| y |defconfig | self_protection | OK: CONFIG_MICROCODE is "y"
CONFIG_X86_SMAP |kconfig| y |defconfig | self_protection | OK: version >= (5, 19, 0)
CONFIG_X86_UMIP |kconfig| y |defconfig | self_protection | OK
CONFIG_X86_MCE_INTEL |kconfig| y |defconfig | self_protection | OK
CONFIG_X86_MCE_AMD |kconfig| y |defconfig | self_protection | OK
CONFIG_MITIGATION_RETPOLINE |kconfig| y |defconfig | self_protection | OK
CONFIG_MITIGATION_RFDS |kconfig| y |defconfig | self_protection | OK
CONFIG_MITIGATION_SPECTRE_BHI |kconfig| y |defconfig | self_protection | OK
CONFIG_RANDOMIZE_MEMORY |kconfig| y |defconfig | self_protection | OK
CONFIG_X86_KERNEL_IBT |kconfig| y |defconfig | self_protection | OK
CONFIG_MITIGATION_PAGE_TABLE_ISOLATION |kconfig| y |defconfig | self_protection | OK
CONFIG_MITIGATION_SRSO |kconfig| y |defconfig | self_protection | OK
CONFIG_INTEL_IOMMU |kconfig| y |defconfig | self_protection | OK
CONFIG_AMD_IOMMU |kconfig| y |defconfig | self_protection | OK
CONFIG_LIST_HARDENED |kconfig| y | kspp | self_protection | OK
CONFIG_RANDOM_KMALLOC_CACHES |kconfig| y | kspp | self_protection | OK
CONFIG_SLAB_MERGE_DEFAULT |kconfig| is not set | kspp | self_protection | OK
CONFIG_BUG_ON_DATA_CORRUPTION |kconfig| y | kspp | self_protection | OK
CONFIG_SLAB_FREELIST_HARDENED |kconfig| y | kspp | self_protection | OK
CONFIG_SLAB_FREELIST_RANDOM |kconfig| y | kspp | self_protection | OK
CONFIG_SHUFFLE_PAGE_ALLOCATOR |kconfig| y | kspp | self_protection | OK
CONFIG_FORTIFY_SOURCE |kconfig| y | kspp | self_protection | OK
CONFIG_DEBUG_LIST |kconfig| y | kspp | self_protection | OK
CONFIG_DEBUG_VIRTUAL |kconfig| y | kspp | self_protection | OK
CONFIG_DEBUG_SG |kconfig| y | kspp | self_protection | OK
CONFIG_INIT_ON_ALLOC_DEFAULT_ON |kconfig| y | kspp | self_protection | OK
CONFIG_STATIC_USERMODEHELPER |kconfig| y | kspp | self_protection | OK
CONFIG_SCHED_CORE |kconfig| y | kspp | self_protection | OK
CONFIG_SECURITY_LOCKDOWN_LSM |kconfig| y | kspp | self_protection | OK
CONFIG_SECURITY_LOCKDOWN_LSM_EARLY |kconfig| y | kspp | self_protection | OK
CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY|kconfig| y | kspp | self_protection | OK
CONFIG_DEBUG_CREDENTIALS |kconfig| y | kspp | self_protection | OK: version >= (6, 6, 8)
CONFIG_DEBUG_NOTIFIERS |kconfig| y | kspp | self_protection | OK: CONFIG_CFI_CLANG is "y"
CONFIG_SCHED_STACK_END_CHECK |kconfig| y | kspp | self_protection | OK: CONFIG_VMAP_STACK is "y"
CONFIG_KFENCE |kconfig| y | kspp | self_protection | OK
CONFIG_KFENCE_SAMPLE_INTERVAL |kconfig| 100 | kspp | self_protection | OK
CONFIG_RANDSTRUCT_FULL |kconfig| y | kspp | self_protection | OK
CONFIG_HARDENED_USERCOPY |kconfig| y | kspp | self_protection | OK
CONFIG_HARDENED_USERCOPY_FALLBACK |kconfig| is not set | kspp | self_protection | OK: is not found
CONFIG_HARDENED_USERCOPY_PAGESPAN |kconfig| is not set | kspp | self_protection | OK: is not found
CONFIG_GCC_PLUGIN_LATENT_ENTROPY |kconfig| y | kspp | self_protection | FAIL: CONFIG_CC_IS_GCC is not "y"
CONFIG_MODULE_SIG |kconfig| y | kspp | self_protection | OK
CONFIG_MODULE_SIG_ALL |kconfig| y | kspp | self_protection | OK
CONFIG_MODULE_SIG_SHA512 |kconfig| y | kspp | self_protection | OK
CONFIG_MODULE_SIG_FORCE |kconfig| y | kspp | self_protection | OK
CONFIG_INIT_ON_FREE_DEFAULT_ON |kconfig| y | kspp | self_protection | OK
CONFIG_EFI_DISABLE_PCI_DMA |kconfig| y | kspp | self_protection | OK
CONFIG_RESET_ATTACK_MITIGATION |kconfig| y | kspp | self_protection | OK
CONFIG_UBSAN_BOUNDS |kconfig| y | kspp | self_protection | OK
CONFIG_UBSAN_LOCAL_BOUNDS |kconfig| y | kspp | self_protection | OK
CONFIG_UBSAN_TRAP |kconfig| y | kspp | self_protection | OK
CONFIG_UBSAN_SANITIZE_ALL |kconfig| y | kspp | self_protection | OK: CONFIG_UBSAN_BOUNDS is "y"
CONFIG_GCC_PLUGIN_STACKLEAK |kconfig| y | kspp | self_protection | FAIL: CONFIG_CC_IS_GCC is not "y"
CONFIG_STACKLEAK_METRICS |kconfig| is not set | kspp | self_protection | FAIL: CONFIG_CC_IS_GCC is not "y"
CONFIG_STACKLEAK_RUNTIME_DISABLE |kconfig| is not set | kspp | self_protection | FAIL: CONFIG_CC_IS_GCC is not "y"
CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT |kconfig| y | kspp | self_protection | OK
CONFIG_PAGE_TABLE_CHECK |kconfig| y | kspp | self_protection | OK
CONFIG_PAGE_TABLE_CHECK_ENFORCED |kconfig| y | kspp | self_protection | OK
CONFIG_CFI_CLANG |kconfig| y | kspp | self_protection | OK
CONFIG_CFI_PERMISSIVE |kconfig| is not set | kspp | self_protection | OK
CONFIG_HW_RANDOM_TPM |kconfig| y | kspp | self_protection | OK
CONFIG_DEFAULT_MMAP_MIN_ADDR |kconfig| 65536 | kspp | self_protection | OK
CONFIG_IOMMU_DEFAULT_DMA_STRICT |kconfig| y | kspp | self_protection | OK
CONFIG_IOMMU_DEFAULT_PASSTHROUGH |kconfig| is not set | kspp | self_protection | OK
CONFIG_INTEL_IOMMU_DEFAULT_ON |kconfig| y | kspp | self_protection | OK
CONFIG_MITIGATION_SLS |kconfig| y | kspp | self_protection | OK
CONFIG_INTEL_IOMMU_SVM |kconfig| y | kspp | self_protection | OK
CONFIG_AMD_IOMMU_V2 |kconfig| y | kspp | self_protection | OK: version >= (6, 7, 0)
CONFIG_SECURITY |kconfig| y |defconfig | security_policy | OK
CONFIG_SECURITY_YAMA |kconfig| y | kspp | security_policy | OK
CONFIG_SECURITY_LANDLOCK |kconfig| y | kspp | security_policy | OK
CONFIG_SECURITY_SELINUX_DISABLE |kconfig| is not set | kspp | security_policy | OK: is not found
CONFIG_SECURITY_SELINUX_BOOTPARAM |kconfig| is not set | kspp | security_policy | OK: is not found
CONFIG_SECURITY_SELINUX_DEVELOP |kconfig| is not set | kspp | security_policy | OK: is not found
CONFIG_SECURITY_WRITABLE_HOOKS |kconfig| is not set | kspp | security_policy | OK: is not found
CONFIG_SECURITY_SELINUX_DEBUG |kconfig| is not set | kspp | security_policy | OK: is not found
CONFIG_SECURITY_SELINUX |kconfig| y |a13xp0p0v | security_policy | OK: CONFIG_SECURITY_APPARMOR is "y"
CONFIG_SECCOMP |kconfig| y |defconfig |cut_attack_surface| OK
CONFIG_SECCOMP_FILTER |kconfig| y |defconfig |cut_attack_surface| OK
CONFIG_BPF_UNPRIV_DEFAULT_OFF |kconfig| y |defconfig |cut_attack_surface| OK
CONFIG_STRICT_DEVMEM |kconfig| y |defconfig |cut_attack_surface| OK: CONFIG_DEVMEM is "is not set"
CONFIG_X86_INTEL_TSX_MODE_OFF |kconfig| y |defconfig |cut_attack_surface| OK
CONFIG_SECURITY_DMESG_RESTRICT |kconfig| y | kspp |cut_attack_surface| OK
CONFIG_ACPI_CUSTOM_METHOD |kconfig| is not set | kspp |cut_attack_surface| OK: is not found
CONFIG_COMPAT_BRK |kconfig| is not set | kspp |cut_attack_surface| OK
CONFIG_DEVKMEM |kconfig| is not set | kspp |cut_attack_surface| OK: is not found
CONFIG_BINFMT_MISC |kconfig| is not set | kspp |cut_attack_surface| OK
CONFIG_INET_DIAG |kconfig| is not set | kspp |cut_attack_surface| OK
CONFIG_KEXEC |kconfig| is not set | kspp |cut_attack_surface| OK
CONFIG_PROC_KCORE |kconfig| is not set | kspp |cut_attack_surface| OK
CONFIG_LEGACY_PTYS |kconfig| is not set | kspp |cut_attack_surface| OK
CONFIG_HIBERNATION |kconfig| is not set | kspp |cut_attack_surface| OK
CONFIG_COMPAT |kconfig| is not set | kspp |cut_attack_surface| FAIL: "y"
CONFIG_IA32_EMULATION |kconfig| is not set | kspp |cut_attack_surface| FAIL: "y"
CONFIG_X86_X32 |kconfig| is not set | kspp |cut_attack_surface| OK: is not found
CONFIG_X86_X32_ABI |kconfig| is not set | kspp |cut_attack_surface| OK: is not found
CONFIG_MODIFY_LDT_SYSCALL |kconfig| is not set | kspp |cut_attack_surface| OK
CONFIG_OABI_COMPAT |kconfig| is not set | kspp |cut_attack_surface| OK: is not found
CONFIG_X86_MSR |kconfig| is not set | kspp |cut_attack_surface| OK
CONFIG_LEGACY_TIOCSTI |kconfig| is not set | kspp |cut_attack_surface| OK
CONFIG_MODULE_FORCE_LOAD |kconfig| is not set | kspp |cut_attack_surface| OK
CONFIG_MODULES |kconfig| is not set | kspp |cut_attack_surface| FAIL: "y"
CONFIG_DEVMEM |kconfig| is not set | kspp |cut_attack_surface| OK
CONFIG_IO_STRICT_DEVMEM |kconfig| y | kspp |cut_attack_surface| OK: CONFIG_DEVMEM is "is not set"
CONFIG_LDISC_AUTOLOAD |kconfig| is not set | kspp |cut_attack_surface| OK
CONFIG_X86_VSYSCALL_EMULATION |kconfig| is not set | kspp |cut_attack_surface| OK: CONFIG_LEGACY_VSYSCALL_NONE is "y"
CONFIG_COMPAT_VDSO |kconfig| is not set | kspp |cut_attack_surface| OK
CONFIG_DRM_LEGACY |kconfig| is not set |maintainer|cut_attack_surface| OK: is not found
CONFIG_FB |kconfig| is not set |maintainer|cut_attack_surface| FAIL: "y"
CONFIG_VT |kconfig| is not set |maintainer|cut_attack_surface| FAIL: "y"
CONFIG_BLK_DEV_FD |kconfig| is not set |maintainer|cut_attack_surface| FAIL: "m"
CONFIG_BLK_DEV_FD_RAWCMD |kconfig| is not set |maintainer|cut_attack_surface| OK
CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT |kconfig| is not set |maintainer|cut_attack_surface| OK: is not found
CONFIG_N_GSM |kconfig| is not set |maintainer|cut_attack_surface| OK
CONFIG_ZSMALLOC_STAT |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_DEBUG_KMEMLEAK |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_BINFMT_AOUT |kconfig| is not set | grsec |cut_attack_surface| OK: is not found
CONFIG_KPROBE_EVENTS |kconfig| is not set | grsec |cut_attack_surface| OK: is not found
CONFIG_UPROBE_EVENTS |kconfig| is not set | grsec |cut_attack_surface| OK: is not found
CONFIG_GENERIC_TRACER |kconfig| is not set | grsec |cut_attack_surface| OK: is not found
CONFIG_FUNCTION_TRACER |kconfig| is not set | grsec |cut_attack_surface| OK: is not found
CONFIG_STACK_TRACER |kconfig| is not set | grsec |cut_attack_surface| OK: is not found
CONFIG_HIST_TRIGGERS |kconfig| is not set | grsec |cut_attack_surface| OK: is not found
CONFIG_BLK_DEV_IO_TRACE |kconfig| is not set | grsec |cut_attack_surface| OK: is not found
CONFIG_PROC_VMCORE |kconfig| is not set | grsec |cut_attack_surface| OK: is not found
CONFIG_PROC_PAGE_MONITOR |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_USELIB |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_CHECKPOINT_RESTORE |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
CONFIG_USERFAULTFD |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_HWPOISON_INJECT |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_MEM_SOFT_DIRTY |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_DEVPORT |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_DEBUG_FS |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
CONFIG_NOTIFIER_ERROR_INJECTION |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_FAIL_FUTEX |kconfig| is not set | grsec |cut_attack_surface| OK: is not found
CONFIG_PUNIT_ATOM_DEBUG |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_ACPI_CONFIGFS |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_EDAC_DEBUG |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_DRM_I915_DEBUG |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_DVB_C8SECTPFE |kconfig| is not set | grsec |cut_attack_surface| OK: is not found
CONFIG_MTD_SLRAM |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_MTD_PHRAM |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_IO_URING |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_KCMP |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
CONFIG_RSEQ |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
CONFIG_LATENCYTOP |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_KCOV |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_PROVIDE_OHCI1394_DMA_INIT |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_SUNRPC_DEBUG |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_X86_16BIT |kconfig| is not set | grsec |cut_attack_surface| OK: is not found
CONFIG_BLK_DEV_UBLK |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_SMB_SERVER |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_XFS_ONLINE_SCRUB_STATS |kconfig| is not set | grsec |cut_attack_surface| OK: is not found
CONFIG_CACHESTAT_SYSCALL |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_PREEMPTIRQ_TRACEPOINTS |kconfig| is not set | grsec |cut_attack_surface| OK: is not found
CONFIG_ENABLE_DEFAULT_TRACERS |kconfig| is not set | grsec |cut_attack_surface| OK: is not found
CONFIG_PROVE_LOCKING |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_TEST_DEBUG_VIRTUAL |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_MPTCP |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_TLS |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_TIPC |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_IP_SCTP |kconfig| is not set | grsec |cut_attack_surface| FAIL: "m"
CONFIG_KGDB |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_PTDUMP_DEBUGFS |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_X86_PTDUMP |kconfig| is not set | grsec |cut_attack_surface| OK: is not found
CONFIG_DEBUG_CLOSURES |kconfig| is not set | grsec |cut_attack_surface| OK
CONFIG_BCACHE_CLOSURES_DEBUG |kconfig| is not set | grsec |cut_attack_surface| OK: is not found
CONFIG_STAGING |kconfig| is not set | clipos |cut_attack_surface| OK
CONFIG_KSM |kconfig| is not set | clipos |cut_attack_surface| OK
CONFIG_KALLSYMS |kconfig| is not set | clipos |cut_attack_surface| OK
CONFIG_KEXEC_FILE |kconfig| is not set | clipos |cut_attack_surface| OK
CONFIG_CRASH_DUMP |kconfig| is not set | clipos |cut_attack_surface| OK: is not found
CONFIG_USER_NS |kconfig| is not set | clipos |cut_attack_surface| FAIL: "y"
CONFIG_X86_CPUID |kconfig| is not set | clipos |cut_attack_surface| OK
CONFIG_X86_IOPL_IOPERM |kconfig| is not set | clipos |cut_attack_surface| FAIL: "y"
CONFIG_ACPI_TABLE_UPGRADE |kconfig| is not set | clipos |cut_attack_surface| OK
CONFIG_EFI_CUSTOM_SSDT_OVERLAYS |kconfig| is not set | clipos |cut_attack_surface| FAIL: "y"
CONFIG_AIO |kconfig| is not set | clipos |cut_attack_surface| FAIL: "y"
CONFIG_MAGIC_SYSRQ |kconfig| is not set | clipos |cut_attack_surface| OK
CONFIG_MAGIC_SYSRQ_SERIAL |kconfig| is not set |grapheneos|cut_attack_surface| OK: is not found
CONFIG_EFI_TEST |kconfig| is not set | lockdown |cut_attack_surface| FAIL: "m"
CONFIG_MMIOTRACE_TEST |kconfig| is not set | lockdown |cut_attack_surface| OK: is not found
CONFIG_KPROBES |kconfig| is not set | lockdown |cut_attack_surface| OK
CONFIG_BPF_SYSCALL |kconfig| is not set | lockdown |cut_attack_surface| FAIL: "y"
CONFIG_MMIOTRACE |kconfig| is not set |a13xp0p0v |cut_attack_surface| OK: is not found
CONFIG_LIVEPATCH |kconfig| is not set |a13xp0p0v |cut_attack_surface| OK: is not found
CONFIG_IP_DCCP |kconfig| is not set |a13xp0p0v |cut_attack_surface| OK
CONFIG_FTRACE |kconfig| is not set |a13xp0p0v |cut_attack_surface| OK
CONFIG_VIDEO_VIVID |kconfig| is not set |a13xp0p0v |cut_attack_surface| OK: is not found
CONFIG_INPUT_EVBUG |kconfig| is not set |a13xp0p0v |cut_attack_surface| OK
CONFIG_CORESIGHT |kconfig| is not set |a13xp0p0v |cut_attack_surface| OK: is not found
CONFIG_XFS_SUPPORT_V4 |kconfig| is not set |a13xp0p0v |cut_attack_surface| OK: is not found
CONFIG_BLK_DEV_WRITE_MOUNTED |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "y"
CONFIG_FAULT_INJECTION |kconfig| is not set |a13xp0p0v |cut_attack_surface| OK
CONFIG_ARM_PTDUMP_DEBUGFS |kconfig| is not set |a13xp0p0v |cut_attack_surface| OK: is not found
CONFIG_ARM_PTDUMP |kconfig| is not set |a13xp0p0v |cut_attack_surface| OK: is not found
CONFIG_LKDTM |kconfig| is not set |a13xp0p0v |cut_attack_surface| OK
CONFIG_TRIM_UNUSED_KSYMS |kconfig| y |a13xp0p0v |cut_attack_surface| OK
CONFIG_COREDUMP |kconfig| is not set | clipos | harden_userspace | OK
CONFIG_ARCH_MMAP_RND_BITS |kconfig| 32 |a13xp0p0v | harden_userspace | OK
CONFIG_X86_USER_SHADOW_STACK |kconfig| y | kspp | harden_userspace | OK
[+] Config check is finished: 'OK' - 198 / 'FAIL' - 22
|
Nothing suspicious in dmesg, but I can post some of that too if needed. I'm checking things on a liveusb.
lspci -nnk
/etc/default/uefi-mkconfig
| Code: |
ENTRY_LABEL_LIMIT=false
KERNEL_CONFIG="%entry_id %linux_name Linux %kernel_version ; root=UUID="963bf518-69b3-41af-8366-617ba5aa3ef5" ro quiet init_on_alloc=1 init_on_free=1 spectre_v2=on spec_store_bypass_disable=seccomp randomize_kstack_offset=on random.trust_cpu=off slab_nomerge pti=on page_poison=1 page_alloc.shuffle=1 mds=full,nosmt iommu=force iommu.passthrough=0 iommu.strict=1 mce=0 vsyscall=none rng_core.default_quality=512 apparmor=1 security=apparmor lsm=landlock,yama,integrity,apparmor,bpf driver=free amdgpu.modeset=1 snd-usb-audio.quirk_alias=0db0419c:0b051917 video=DP-1:2560x1440@165 zswap.enabled=1 zswap.compressor=zstd zswap.zpool=zsmalloc zswap.max_pool_percent=15"
|
emerge -pv sys-kernel/gentoo-kernel
| Code: |
[ebuild R ~] sys-kernel/gentoo-kernel-6.12.6:6.12.6::gentoo USE="debug experimental hardened initramfs modules-compress modules-sign savedconfig strip -generic-uki -secureboot -test" 0 KiB
|
EDIT:
Updated kernel config. |
|
Kernel & Hardware
