feat(virtio-linux): further strip out unnecessary kconfigs - #569
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe virtio Linux build disables unsupported hardware drivers and unused kernel features for virtio microVM guests. It retains the broader network-filesystem subsystem and required virtio, 9p, and EFI stub options. ChangesVirtio guest configuration
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/virtio-linux/build.sh`:
- Around line 327-328: Add KEXEC_FILE to the nope configuration entries in the
build script, alongside KEXEC CRASH_DUMP, and verify the generated published
configuration contains no CONFIG_KEXEC=y, CONFIG_KEXEC_FILE=y, or
CONFIG_KEXEC_CORE=y.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 08296bce-a3d5-4eef-84f2-ba66c6960135
📒 Files selected for processing (1)
packages/virtio-linux/build.sh
| nope HIBERNATION | ||
| nope KEXEC CRASH_DUMP |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/sh
set -eu
config="${OUTPUT_DIR:?}/usr/share/virtio-linux/config"
for sym in KEXEC KEXEC_FILE KEXEC_CORE CRASH_DUMP; do
if grep -qx "CONFIG_${sym}=y" "$config"; then
echo "unexpected CONFIG_${sym}=y" >&2
exit 1
fi
doneRepository: gominimal/pkgs
Length of output: 204
🏁 Script executed:
#!/bin/sh
set -eu
printf '%s\n' '--- build script structure ---'
ast-grep outline packages/virtio-linux/build.sh 2>/dev/null || true
printf '%s\n' '--- relevant build script sections ---'
sed -n '1,90p' packages/virtio-linux/build.sh
sed -n '280,355p' packages/virtio-linux/build.sh
printf '%s\n' '--- configuration and architecture references ---'
rg -n --no-heading 'nope|defconfig|KEXEC|CRASH_DUMP|KERNEL_ARCH|ARCH|aarch64|arm64|olddefconfig|savedefconfig|config' packages/virtio-linux/build.sh packages/virtio-linux/build.nclRepository: gominimal/pkgs
Length of output: 13902
🏁 Script executed:
#!/bin/sh
set -eu
printf '%s\n' '--- nope() and final configuration checks ---'
sed -n '82,112p' packages/virtio-linux/build.sh
sed -n '350,375p' packages/virtio-linux/build.sh
printf '%s\n' '--- repository references ---'
rg -n --no-heading 'FORBIDDEN|CONFIG_KEXEC_FILE|KEXEC_FILE|KEXEC_CORE' .Repository: gominimal/pkgs
Length of output: 2281
🌐 Web query:
Linux v6.12 Kconfig KEXEC_FILE KEXEC_CORE KEXEC dependency init/Kconfig
💡 Result:
In Linux kernel v6.12, the configuration options related to kexec are consolidated within the kernel/Kconfig.kexec file [1][2]. The dependencies and relationships between KEXEC, KEXEC_FILE, and KEXEC_CORE are structured as follows: KEXEC_CORE This is a hidden boolean configuration symbol that acts as a core dependency for both the traditional kexec and the file-based kexec interfaces [3][1][4]. It does not have user-visible prompt text and is selected by both KEXEC and KEXEC_FILE [3][1]. KEXEC (Enable kexec system call) This option enables the traditional kexec system call [3][1]. - Depends on: ARCH_SUPPORTS_KEXEC (defined by individual architectures) [3][1]. - Selects: KEXEC_CORE [3][1]. KEXEC_FILE (Enable kexec file based system call) This option enables the newer, file-based kexec system call that uses file descriptors for the kernel and initramfs [3][1]. - Depends on: ARCH_SUPPORTS_KEXEC_FILE (defined by individual architectures) [3][1]. - Selects: KEXEC_CORE [3][1]. - Additionally selects: CRYPTO and CRYPTO_LIB_SHA256 (or CRYPTO_SHA256, depending on the specific kernel branch) to support the required cryptographic verification of the kernel image [3][1][4][5]. In summary, KEXEC_CORE is the underlying infrastructure required by both KEXEC and KEXEC_FILE, and both options explicitly select it to ensure it is enabled when either is configured [1][6]. The architecture-specific support is enforced by the ARCH_SUPPORTS_KEXEC and ARCH_SUPPORTS_KEXEC_FILE dependencies, which prevent these features from being enabled on architectures that do not support them [2].
Citations:
- 1: https://github.com/torvalds/linux/blob/master/kernel/Kconfig.kexec
- 2: steev/linux@89cde45
- 3: https://github.com/bytesatwork/ti-linux-kernel/blob/baw-ti-linux-6.12.y-11.01.05/kernel/Kconfig.kexec
- 4: https://gbmc.googlesource.com/linux/+/4412b8b23de24a94a0b78ac283db043c833a3975/kernel/Kconfig.kexec
- 5: https://elixir.bootlin.com/linux/v7.1-rc6/source/kernel/Kconfig.kexec
- 6: https://docs.kernel.org/6.11/admin-guide/kdump/kdump.html
Security Misconfiguration (CWE-16)
Reachability: Internal · Exploitability: Difficult
Disable KEXEC_FILE too.
KEXEC_FILE independently selects KEXEC_CORE, so disabling only KEXEC can leave the file-based kexec path enabled. Add KEXEC_FILE to nope and verify that the published configuration contains no CONFIG_KEXEC=y, CONFIG_KEXEC_FILE=y, or CONFIG_KEXEC_CORE=y.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/virtio-linux/build.sh` around lines 327 - 328, Add KEXEC_FILE to the
nope configuration entries in the build script, alongside KEXEC CRASH_DUMP, and
verify the generated published configuration contains no CONFIG_KEXEC=y,
CONFIG_KEXEC_FILE=y, or CONFIG_KEXEC_CORE=y.
198e181 to
e2d03e3
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
Summary by CodeRabbit