| <html devsite> |
| <head> |
| <title>Kernel Configuration</title> |
| <meta name="project_path" value="/_project.yaml" /> |
| <meta name="book_path" value="/_book.yaml" /> |
| </head> |
| <body> |
| <!-- |
| Copyright 2017 The Android Open Source Project |
| |
| Licensed under the Apache License, Version 2.0 (the "License"); |
| you may not use this file except in compliance with the License. |
| You may obtain a copy of the License at |
| |
| http://www.apache.org/licenses/LICENSE-2.0 |
| |
| Unless required by applicable law or agreed to in writing, software |
| distributed under the License is distributed on an "AS IS" BASIS, |
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| See the License for the specific language governing permissions and |
| limitations under the License. |
| --> |
| |
| |
| |
| <p>Use the following configuration settings as a base for an Android kernel |
| configuration. Settings are organized into <code>android-base</code> and |
| <code>android-recommended</code> .cfg files: |
| |
| <ul> |
| <li><code>android-base</code>. These options enable core Android features and |
| should be enabled by all devices.</li> |
| |
| <li><code>android-recommended</code>. These options enable advanced Android |
| features and are optional for devices.</li> |
| </ul> |
| |
| <p>Both the android-base.cfg and android-recommended.cfg files are located in |
| the android-common kernel repo at |
| <a href="https://android.googlesource.com/kernel/common/">https://android.googlesource.com/kernel/common/</a>. |
| <p>In version 4.8 of the upstream Linux kernel, a new location (kernel/configs) |
| was designated for kernel configuration fragments. The android base and |
| recommended config fragments are located in that directory for branches based on |
| 4.8 or later. For kernel branches based on releases prior to 4.8, the config |
| fragments are located in the android/ directory.</p> |
| |
| <p>For details on controls already undertaken to strengthen the kernel on your |
| devices, see <a href="/security/overview/kernel-security.html">System |
| and Kernel Security</a>. For details on required settings, see the |
| <a href="/compatibility/cdd.html">Android Compatibility Definition |
| Document (CDD)</a>.</p> |
| |
| <h2 id="generating">Generating kernel config</h2> |
| <p>For devices that have a minimalist defconfig, you can use the following to |
| enable options:</p> |
| |
| <pre class="devsite-click-to-copy"> |
| ARCH=<em>arch</em> scripts/kconfig/merge_config.sh <em>path</em>/<em>device</em>_defconfig android/configs/android-base.cfg android/configs/android-recommended.cfg |
| </pre> |
| |
| <p>This generates a .config file you can use to save a new defconfig or |
| compile a new kernel with Android features enabled.</p> |
| |
| <h2 id="usb">Enabling USB host mode options</h2> |
| |
| <p>For USB host mode audio, enable the following options:</p> |
| <pre class="devsite-click-to-copy"> |
| CONFIG_SND_USB=y |
| CONFIG_SND_USB_AUDIO=y |
| # CONFIG_USB_AUDIO is for a peripheral mode (gadget) driver |
| </pre> |
| |
| <p>For USB host mode MIDI, enable the following option:</p> |
| <pre class="devsite-click-to-copy"> |
| CONFIG_SND_USB_MIDI=y |
| </pre> |
| |
| <h2 id="Seccomp-BPF-TSYNC">Seccomp-BPF with TSYNC</h2> |
| <p>Seccomp-BPF is a kernel security technology that enables the creation of |
| sandboxes to restrict the system calls a process is allowed to make. The TSYNC |
| feature enables the use of Seccomp-BPF from multithreaded programs. This ability |
| is limited to architectures that have seccomp support upstream: ARM, ARM64, x86, |
| and x86_64.</p> |
| |
| <h3 id="backport-ARM-32">Backporting for Kernel 3.10 for ARM-32, X86, X86_64</h3> |
| |
| <p>Ensure that <code>CONFIG_SECCOMP_FILTER=y</code> is enabled in the Kconfig |
| (verified as of the Android 5.0 CTS), then cherry-pick the following changes |
| from the AOSP kernel/common:android-3.10 repository: <a href="https://android. |
| googlesource.com/kernel/common/+log/9499cd23f9d05ba159 |
| fac6d55dc35a7f49f9ce76..a9ba4285aa5722a3b4d84888e78ba8adc0046b28">9499cd23f9d05ba159fac6d55dc35a7f49f9ce76..a9ba4285aa5722a3b4d84888e78ba8adc0046b28</a> |
| </p> |
| |
| <ul> |
| <li><a href="https://android.googlesource.com/kernel/common/+/a03a2426ea9f1d9dada33cf4a824f63e8f916c9d">a03 |
| a242 arch: Introduce smp_load_acquire(), smp_store_release()</a> by Peter |
| Zijlstra</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/987a0f1102321853565c4bfecde6a5a58ac6db11">987a0f |
| 1 introduce for_each_thread() to replace the buggy while_each_thread()</a> by |
| Oleg Nesterov</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/2a30a4386e4a7e1283157c4cf4cfcc0306b22ac8">2a30a43 |
| seccomp: create internal mode-setting function</a> by Kees Cook</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+ |
| /b8a9cff6dbe9cfddbb4d17e2dea496e523544687">b8a9cff |
| seccomp: extract check/assign mode helpers</a> by Kees Cook</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/8908dde5a7fdca974374b0dbe6dfb10f69df7216">8908dde |
| seccomp: split mode setting routines</a> by Kees Cook</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/e985fd474debedb269fba27006eda50d0b6f07ef">e985fd4 seccomp: add |
| "seccomp" syscall</a> by Kees Cook</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/9d0ff |
| 694bc22fb458acb763811a677696c60725b">9d0ff69 |
| sched: move no_new_privs into new atomic flags</a> by Kees Cook</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/b6a12bf4dd762236c7f637b19cfe10a268304b9b">b6a12bf |
| seccomp: split filter prep from check and apply</a> by Kees Cook</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/61b6b882a0abfeb627d25a069cfa1d232b84c8eb">61b6b88 |
| seccomp: introduce writer locking</a> by Kees Cook</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/c852ef778224ecf5fe995d74ad96087038778bca">c852ef7 |
| seccomp: allow mode setting across threads</a> by Kees Cook</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/f14a5db2398afed8f416d244e6da6b23940997c6">f14a5db |
| seccomp: implement SECCOMP_FILTER_FLAG_TSYNC</a> by Kees Cook</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/9ac860041db |
| 860a59bfd6ac82b31d6b6f76ebb52">9ac8600 |
| seccomp: Replace BUG(!spin_is_locked()) with assert_spin_lock</a> by Guenter |
| Roeck</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/900e9fd0d5d15c596cacfb89ce007c933cea6e1c">900e9fd |
| seccomp: fix syscall numbers for x86 and x86_64</a> by Lee Campbell</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/a9ba4285aa5722a3b4d84888e78ba8adc0046b28">a9ba428 |
| ARM: add seccomp syscall</a> by Kees Cook</li> |
| </ul> |
| |
| <h3 id="backport-ARM-64">Backporting for Kernel 3.10 for ARM-64</h3> |
| <p>Ensure <code>CONFIG_SECCOMP_FILTER=y</code> is enabled in the Kconfig |
| (verified as of the Android 5.0 CTS), then cherry-pick the following changes |
| from the AOSP kernel/common:android-3.10 repository:</p> |
| <ul> |
| <li><a href="https://android.googlesource.com/kernel/common/+/cfc7e99e9e3900056028a7d90072e9ea0d886f8d">cfc7e99e9 |
| arm64: Add __NR_* definitions for compat syscalls</a> by JP Abgrall</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/bf11863d45eb3dac0d0cf1f818ded11ade6e28d3">bf11863 |
| arm64: Add audit support</a> by AKASHI Takahiro</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/3 |
| e21c0bb663a23436e0eb3f61860d4fedc233bab">3e21c0b |
| arm64: audit: Add audit hook in syscall_trace_enter/exit()</a> by JP Abgrall</li> |
| <li><a href="https://android.googlesource.com/kernel |
| /common/+/9499cd23f9d05ba159fac6d55dc35a7f49f9ce76">9499cd2 |
| syscall_get_arch: remove useless function arguments</a> by Eric Paris</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/2a30a4386e4a7e1283157c4cf4cfcc0306b22ac8">2a30a43 |
| seccomp: create internal mode-setting function</a> by Kees Cook</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/b8a9cff6dbe9cfddbb4d17e2dea496e523544687">b8a9 |
| cff seccomp: extract check/assign mode helpers</a> by Kees Cook</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/8908dde5a7fdca974374b0dbe6dfb10f69df7216">8908dde |
| seccomp: split mode setting routines</a> by Kees Cook</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/e985fd474debedb269fba27006eda50d0b6f07ef">e985fd4 |
| seccomp: add "seccomp" syscall</a> by Kees Cook</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/9d0ff694bc22fb458acb763811a677696c60725b">9d0ff69 |
| sched: move no_new_privs into new atomic flags</a> by Kees Cook</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/b6a12bf4dd762236c7f637b19cfe10a268304b9b">b6a12bf |
| seccomp: split filter prep from check and apply</a> by Kees Cook</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/61b6b882a0abfeb627d25a069cfa1d232b84c8eb">61b6b88 |
| seccomp: introduce writer locking</a> by Kees Cook</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/c852ef778224ecf5fe995d74ad96087038778bca">c852ef7 |
| seccomp: allow mode setting across threads</a> by Kees Cook</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/f14a5db2398afed8f416d244e6da6b23940997c6">f14a5db |
| seccomp: implement SECCOMP_FILTER_FLAG_TSYNC</a> by Kees Cook</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/9ac860041db860a59bfd6ac82b31d6b6f76ebb52">9ac8600 |
| seccomp: Replace BUG(!spin_is_locked()) with assert_spin_lock</a> by Guenter |
| Roeck</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/900e9fd0d5d15c596cacfb89ce007c933cea6e1c">900e9fd |
| seccomp: fix syscall numbers for x86 and x86_64</a> by Lee Campbell</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/a9ba4285aa5722a3b4d84888e78ba8adc0046b28">a9ba428 |
| ARM: add seccomp syscall</a> by Kees Cook</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/41900903483eb96602dd72e719a798c208118aad">4190090 |
| ARM: 8087/1: ptrace: reload syscall number after secure_computing() check</a> by |
| Will Deacon</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/abbfed9ed1a78701ef3db74f5287958feb897035">abbfed9 |
| arm64: ptrace: add PTRACE_SET_SYSCALL</a> by AKASHI Takahiro</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/feb28436457d33fef9f264635291432df4b74122">feb2843 |
| arm64: ptrace: allow tracer to skip a system call</a> by AKASHI Takahiro</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/dab10731da65a0deba46402ca9fadf6974676cc8">dab1073 |
| asm-generic: add generic seccomp.h for secure computing mode 1</a> by AKASHI |
| Takahiro</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/4f12b53f28a751406a27ef7501a22f9e32a9c30b">4f1 |
| 2b53 add seccomp syscall for compat task</a> by AKASHI Takahiro</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/77227239d20ac6381fb1aee7b7cc902f0d14cd85">7722723 |
| arm64: add SIGSYS siginfo for compat task</a> by AKASHI Takahiro</li> |
| <li><a href="https://android.googlesource.com/kernel/common/+/210957c2bb3b4d111963bb296e2c42beb8721929">210957c |
| arm64: add seccomp support</a> by AKASHI Takahiro</li> |
| </ul> |
| |
| </body> |
| </html> |
