lkrg VS linux

I'm not an expert, but I can think of two things related to the integrity of Linux kernel. Linux has the ability to mark itself tainted 1 if you, as example, load proprietary drivers. On the other hand, there's Linux Kernel Runtime Guard (LKRG) 2 that performs integrity check on Linux kernel and detects exploits.

I'll try to make this as succinct as possible. I use the Linux Kernel Runtime Guard with my kernel as a security measure, and I use xbps-src to compile the kernel myself.

git repo for 5.15.y https://github.com/gregkh/linux branch: linux-5.15.y

Maintenance point releases are done by the Linux stable tree maintainers; see here: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/

Where did you get that URL? The clone URL is https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ (You're missing a "linux/" between scm and kernel.)

-> Generic Desktop (Performance) profile will be used. -> -> Installing dependencies [sudo] password for root:   Loading repository data... Reading installed packages... 'patch' is already installed. No update candidate for 'patch-2.7.6-3.5.x86_64'. The highest available version is already installed. 'gcc-c++' is already installed. No update candidate for 'gcc-c++-7-3.9.1.x86_64'. The highest available version is already installed. 'make' is already installed. No update candidate for 'make-4.2.1-7.3.2.x86_64'. The highest available version is already installed. 'ncurses-devel' is already installed. No update candidate for 'ncurses-devel-6.1-5.6.2.x86_64'. The highest available version is already installed. 'bison' is already installed. No update candidate for 'bison-3.0.4-3.3.1.x86_64'. The highest available version is already installed. 'flex' is already installed. No update candidate for 'flex-2.6.4-3.157.x86_64'. The highest available version is already installed. 'bc' is already installed. No update candidate for 'bc-1.07.1-11.37.x86_64'. The highest available version is already installed. 'libqt5-qtbase-common-devel' is already installed. No update candidate for 'libqt5-qtbase-common-devel-5.12.7-4.12.2.x86_64'. The highest available version is already installed. 'libelf-devel' is already installed. No update candidate for 'libelf-devel-0.168-4.5.3.x86_64'. The highest available version is already installed. 'libqt5-qtbase-devel' is already installed. No update candidate for 'libqt5-qtbase-devel-5.12.7-4.12.2.x86_64'. The highest available version is already installed. 'ccache' is already installed. No update candidate for 'ccache-3.4.2-1.9.x86_64'. The highest available version is already installed. 'git' is already installed. No update candidate for 'git-2.31.1-10.3.1.x86_64'. The highest available version is already installed. 'openssl-devel' not found in package names. Trying capabilities. 'libopenssl-devel' providing 'openssl-devel' is already installed. 'elfutils' is already installed. No update candidate for 'elfutils-0.168-4.5.3.x86_64'. The highest available version is already installed. 'rpm-build' is already installed. No update candidate for 'rpm-build-4.14.3-37.2.x86_64'. The highest available version is already installed. 'dwarves' is already installed. No update candidate for 'dwarves-1.19-bp153.1.13.x86_64'. The highest available version is already installed. 'lz4' is already installed. No update candidate for 'lz4-1.9.2-3.3.1.x86_64'. The highest available version is already installed. 'libXi-devel' is already installed. No update candidate for 'libXi-devel-1.7.9-3.2.1.x86_64'. The highest available version is already installed. 'pesign' is already installed. No update candidate for 'pesign-0.112-4.9.1.x86_64'. The highest available version is already installed. 'rpmdevtools' is already installed. No update candidate for 'rpmdevtools-8.10-bp153.1.12.noarch'. The highest available version is already installed. Resolving package dependencies... Nothing to do. kernel.org      https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git (fetch) kernel.org      https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git (push) googlesource.com        https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux-stable (fetch) googlesource.com        https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux-stable (push) -> Current branch: -> Reseting files to their original state fatal: ambiguous argument 'HEAD': unknown revision or path not in the working tree. Use '--' to separate paths from revisions, like this: 'git [...] -- [...]' -> exit cleanup done

I knew where to find the tarballs. I was asking where to find a git repo I could use to bisect in a more granular fashion. Anyway, someone else pointed me to https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/, which is what I needed (it has a branch that corresponds to the lts releases).

yes!!! but not lfs, let’s do this git clone --depth=1 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git cd linux cp /boot/uname -r-config ./.config # todo: correct? make bzImage ln -s arch/x86/boot/bzImage ../bzImage_x86 wget https://busybox.net/downloads/busybox-1.33.1.tar.bz2 tar xjvf busybox-1.33.1.tar.bz2 cd busybox-1.33.1/ make allnoconfig make menuconfig # set OS name to BusyBox/Linux cause we don’t use GNU make make install mv _install ../fs cd ../filesystem mkdir -pv {dev,proc,etc/init.d,sys,tmp} sudo mknod dev/console c 5 1 sudo mknod dev/null c 1 3 cat >> etc/motd << EOF I am a fat nerd anyway welcome to my distro EOF cat >> etc/inittab << EOF ::sysinit:/etc/init.d/rc ::askfirst:/bin/sh ::restart:/sbin/init ::ctrlaltdel:/sbin/reboot ::shutdown:/bin/umount -a -r EOF cat >> etc/init.d/rc << EOF #!/bin/sh mount -t proc none /proc mount -t sysfs none /sys clear cat /etc/motd /bin/sh EOF chmod +x etc/init.d/rc sudo chown -R root:root . find . | cpio -H newc -o | gzip -9 > ../rootfs.cpio.gz cd .. qemu-system-i386 -kernel bzImage_x86 -initrd rootfs.cpio.gz done

git clone https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Look at zswap_fontswap_load() in mm/zswap.c. It uses zpool_map_handle() (line 1261) to get a pointer for a single compressed page from zbud/z3fold/zsmalloc, and then decompresses it into the target page.