Please target staging.

I rebased on staging sry for the notifications. This has the potential to break some custom kernel configs or change the behavior of the system (like IDIAG not being enabled anymore etc). So if you see this, adjust your kernel config to the new (better) behavior.

dont merge yet it breaks boot :(

The merging strategy should probably complain about conflicts, not favour enabling options, so that any conflicts have to be resolved explicitly (and IMHO the best way to do that would then be to sprinkle mkDefaults on the individual relevant settings in common-config.nix).

Ah sorry, just saw the PR mentioned at the beginning. So basically I agree with that approach :)

At the very least we can test for something like this:

      with subtest("Check CONFIG_INET_DIAG is disabled"):
          machine.succeed("zcat /proc/config.gz | grep CONFIG_INET_DIAG=n")
          machine.fail("${pkgs.iproute2}/bin/ss")

And we'll need latestKernel.hardened to pass.
Looks like virtio_scsi is missing, I think that's what you meant by "it breaks boot"?

@NeQuissimus I'd favour the approach in #90065, what do you think?

@lheckemann That approach is a bit more targeted. We can prefer that, sure.

I marked this as stale due to inactivity. → More info