From e0fb1098a4b0f5059f029fd88eff78ca244beec1 Mon Sep 17 00:00:00 2001 From: Xi Ruoyao Date: Wed, 8 Mar 2023 11:01:18 +0800 Subject: kernel: Recommend to disable CONFIG_EXPERT Let's not encourage users to try tricky things and shoot their own foot. For systemd, if CONFIG_EXPERT is disable, CONFIG_FHANDLE will be enabled automatically. So there is no need to enable CONFIG_EXPERT and then set CONFIG_FHANDLE manually. --- chapter10/kernel.xml | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) (limited to 'chapter10') diff --git a/chapter10/kernel.xml b/chapter10/kernel.xml index e7bcfdb87..4618cc18e 100644 --- a/chapter10/kernel.xml +++ b/chapter10/kernel.xml @@ -111,6 +111,7 @@ General setup ---> [ ] Compile the kernel with warnings as errors [CONFIG_WERROR] < > Enable kernel headers through /sys/kernel/kheaders.tar.xz [CONFIG_IKHEADERS] + [ ] Configure standard kernel features (expert users) [CONFIG_EXPERT] General architecture-dependent options ---> [*] Stack Protector buffer overflow detection [CONFIG_STACKPROTECTOR] [*] Strong Stack Protector [CONFIG_STACKPROTECTOR_STRONG] @@ -137,8 +138,7 @@ General setup ---> [*] Control Group support [CONFIG_CGROUPS] ---> [*] Memory controller [CONFIG_MEMCG] [ ] Enable deprecated sysfs features to support old userspace tools [CONFIG_SYSFS_DEPRECATED] - [*] Configure standard kernel features (expert users) [CONFIG_EXPERT] ---> - [*] open by fhandle syscalls [CONFIG_FHANDLE] + [ ] Configure standard kernel features (expert users) [CONFIG_EXPERT] General architecture-dependent options ---> [*] Enable seccomp to safely compute untrusted bytecode [CONFIG_SECCOMP] [*] Stack Protector buffer overflow detection [CONFIG_STACKPROTECTOR] @@ -236,6 +236,19 @@ Device Drivers ---> + + + + Configure standard kernel features (expert users) + + + + This will make some options show up in the configuration + interface but changing those options may be dangerous. Do not use + this unless you know what you are doing. + + + Strong Stack Protector -- cgit v1.2.3-54-g00ecf