<--

Kernel Configuration Pseudo Guide

Current base: Linux 6.9.y

This aims to be a guide for configuring a Linux kernel for a modern x86_64 machine containing hardware commonly found in laptops, desktops, and other consumer computers. Note, this guide will sway more minimally, meaning some features that are not strictly required will not be enabled. All features will be built directly into kernel, no modules. This article will not attempt to cover all possible configuration options, as it omits entire sections that are not relevant on such systems, as well as some hardware-specific configuration. Please also refer to the kernel's help text for further information on respective options. I am not a kernel developer and nothing here is guaranteed to be functionally accurate. If you feel anything mentioned is wrong or should be switched around, please contact me. This article assumes some prior knowledge of your system (eg. lspci, lscpu, lsusb, dmidecode, /proc/devices, etc.) and general kernel configuration/installation, such as obtaining source, generating and maintaining .config, methods of configuration, compilation, and installation. Throughout, the following acronyms will be used top level options
general setup
processor type and features
mitigations for speculative execution vulnerabilities
power management and acpi options
bus options
binary emulations
general architecture-dependent options
enable the block layer
executable file formats
memory management options
networking support
file systems
security options
cryptographic api
library routines
kernel hacking

Top Level Options

General setup

Processor type and features

Mitigations for speculative execution vulnerabilities

Power management and ACPI options

Bus options (PCI etc.)

  • Support mmconfig PCI space access (PCI_MMCONFIG): Y, STD
  • Read CNB20LE Host Bridge Windows (CONFIG_PCI_CNB20LE_QUIRK): N
  • ISA bus support on modern systems (CONFIG_ISA_BUS): N
  • ISA-style DMA support (CONFIG_ISA_DMA_API): N
  • Binary Emulations

  • IA32 Emulation (CONFIG_IA32_EMULATION): N, unless using 32-bit applications
  • General architecture-dependent options

  • Optimize very unlikely/likely branche (CONFIG_JUMP_LABEL): Y
  • Static key selftest (CONFIG_STATIC_KEYS_SELFTEST): N, DEV
  • Static call selftest (CONFIG_STATIC_CALL_SELFTEST): N, DEV
  • Enable seccomp to safely execute untrusted bytecode (CONFIG_SECCOMP): Y, STD
  • Show seccomp filter cache status in /proc/pid/seccomp_cache (CONFIG_SECCOMP_CACHE_DEBUG): N, DEV
  • Stack Protector buffer overflow detection (CONFIG_STACKPROTECTOR): Y, SEC
  • Strong Stack Protector (CONFIG_STACKPROTECTOR_STRONG): Y, SEC
  • Link Time Optimization (LTO): None
  • Number of bits to use for ASLR of mmap base address (CONFIG_ARCH_MMAP_RND_BITS): 28
  • Provide system calls for 32-bit time_t (CONFIG_COMPAT_32BIT_TIME): Y, STD
  • Use a virtually-mapped stack (CONFIG_VMAP_STACK): Y, SEC
  • Support for randomizing kernel stack offset on syscall entry (CONFIG_RANDOMIZE_KSTACK_OFFSET): Y, SEC
  • Default state of kernel stack offset randomization (CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT): Y, SEC
  • Enable the block layer

  • Legacy autoloading support (CONFIG_BLOCK_LEGACY_AUTOLOAD): N, OLD
  • Block layer SG support v4 helper lib (CONFIG_BLK_DEV_BSGLIB): N, auto enabled if needed
  • Block layer data integrity support (CONFIG_BLK_DEV_INTEGRITY): N
  • Allow writing to mounted block devices (CONFIG_BLK_DEV_WRITE_MOUNTED): Y, STD
  • Zoned block device support (CONFIG_BLK_DEV_ZONED): N
  • Block layer bio throttling support (CONFIG_BLK_DEV_THROTTLING): N, VIRT
  • Enable support for block device writeback throttling (CONFIG_BLK_WBT): Y
  • Enable writeback throttling by default (CONFIG_BLK_WBT_MQ): N
  • Enable support for latency based cgroup IO protection (CONFIG_BLK_CGROUP_IOLATENCY): N, VIRT
  • Enable support for cost model based cgroup IO controller (CONFIG_BLK_CGROUP_IOCOST): N, VIRT
  • Cgroup I/O controller for assigning an I/O priority class (CONFIG_BLK_CGROUP_IOPRIO): N, VIRT
  • Logic for interfacing with Opal enabled SEDs (CONFIG_BLK_SED_OPAL): N
  • Enable inline encryption support in block layer (CONFIG_BLK_INLINE_ENCRYPTION): N
  • Partition Types
  • IO Schedulers
  • Executable file formats

  • Kernel support for ELF binaries (CONFIG_BINFMT_ELF): Y, STD
  • Write ELF core dumps with partial segments (CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS): Y
  • Kernel support for scripts starting with #! (CONFIG_BINFMT_SCRIPT): Y, STD
  • Kernel support for MISC binaries (CONFIG_BINFMT_MISC): N, SEC
  • Enable core dump support (CONFIG_COREDUMP): Y
  • Memory Management options

  • Support for paging of anonymous memory (swap) (CONFIG_SWAP): Y, STD
  • Slab allocator options
  • Page allocator randomization (CONFIG_SHUFFLE_PAGE_ALLOCATOR): Y, SEC
  • Disable heap randomization (CONFIG_COMPAT_BRK): N, OLD
  • Sparse Memory virtual memmap (CONFIG_SPARSE_VMEMMAP): Y, STD
  • Memory hotplug (MEMORY_HOTPLUG): N, VIRT
  • Allow for memory compaction (CONFIG_COMPACTION): Y, STD
  • Free page reporting (CONFIG_PAGE_REPORTING): N, VIRT
  • Page migration (CONFIG_MIGRATION): Y, auto enabled if needed
  • Maximum scale factor of PCP (Per-CPU pageset) batch allocate/free (CONFIG_PCP_BATCH_SCALE_MAX): 5
  • Enable KSM for page merging (CONFIG_KSM): N, VIRT
  • Low address space to protect from user allocation (CONFIG_DEFAULT_MMAP_ADDR): 65536
  • Enable recovery from hardware memory errors (CONFIG_MEMORY_FAILURE): N, unless you have ECC memory
  • Transparent Hugepage Support (CONFIG_TRANSPARENT_HUGEPAGE): N, unless you have large amounts of memory
  • Contiguous Memory Allocator (CONFIG_CMA): N
  • Defer initialisation of struct pages to kthreads (CONFIG_DEFERRED_PAGE_INIT): N
  • Enable idle page tracking (CONFIG_IDLE_PAGE_TRACKING): N
  • Support DMA zone (ZONE_DMA): Y
  • Support DMA32 zone (ZONE_DMA32): Y
  • Enable VM event counters /proc/vmstat (CONFIG_VM_EVENT_COUNTERS): Y
  • Collect percpu memory statistics (CONFIG_PERCPU_STATS): N, DEV
  • Enable a module to run time tests on dma_pool (CONFIG_DMAPOOL_TEST): N, DEV
  • Enable memfd_create() system call (MEMFD_CREATE): Y
  • Enable memfd_secreat() system call (CONFIG_SECRETMEM): Y
  • Anonymous VMA name support (CONFIG_ANON_VMA_NAME): N, SEC
  • Enable userfaultfd() system call (CONFIG_USERFAULTFD): N, VIRT
  • Multi-Gen LRU (CONFIG_LRU_GEN): N
  • Data Access Monitoring
  • Network support

  • Networking options
  • Amateur Radio support (CONIG_HAMRADIO): N
  • CAN bus subsystem support (CONFIG_CAN): N, used in vehicles
  • Bluetooth subsystem support (CONFIG_BT): Y, if desired
  • RxRPC session sockets (CONFIG_AF_RXRPC): N
  • KCM sockets (CONFIG_AF_KCM): N
  • MCTP core protocol support (CONFIG_MCTP): N
  • Wireless (WIRELESS): Y, if needed
  • RF switch subsystem support (CONFIG_RFKILL): N, may be needed for some network/bt cards
  • Plan 9 Resource Sharing Support (9P2000) (CONFIG_NET_9P): N, VIRT
  • CAIF support (CONFIG_CAIF): N
  • Ceph core library (CONFIG_CEPH_LIB): N
  • NFC subsystem support (CONFIG_NFC): N, EMB
  • Packet-sampling netlink channel (CONFIG_PSAMPLE): N
  • Inter-FE based on IETF ForCES InterFE LFB (CONFIG_NET_IFE): N
  • Network light weight tunnels (CONFIG_LWTUNNEL): N
  • Generic failover module (CONFIG_FAILOVER): N, VIRT
  • Netlink interface for ethtool (CONFIG_ETHTOOL_NETLINK): N
  • File systems

    Security Options

    Cryptographic API

    Library routines

    The system will automatically enable the necessary things here. The following are generally what's needed.

    Kernel hacking

    Most options here are development related, but some offer security enhancements.