Modifying Kernel Configurations
Relevant source files
The following files were used as context for generating this wiki page:
The gokrazy-kernel-buggy-linux-7_0 project provides a specialized Linux 7.0 amd64 kernel package designed for Tailscale's natlab/vmtest environment. This kernel intentionally preserves a UDP GSO (Generic Segmentation Offload) regression to facilitate testing of mitigation behaviors in software even when the underlying host kernel is patched.
Sources: README.md:3-7, empty.go:6-9
Build Process Architecture
The kernel build process automates the acquisition of Linux source code and the application of custom configuration parameters. The build-buggy-linux-7_0.bash script manages the lifecycle of the kernel image from download to compilation.
Build Workflow
The following diagram illustrates the sequence of operations performed to generate the bootable vmlinuz image.
The script downloads the Linux 7.0 kernel, applies the standard architecture configuration, appends project-specific overrides, and compiles the result into a compressed bootable image.
Sources: build-buggy-linux-7_0.bash:1-20
Kernel Configuration Categories
Configuration modifications are defined in config.addendum.txt. These settings enable necessary drivers for virtualized environments, network testing, and specific diagnostic requirements.
Networking and Firewalling
The kernel enables comprehensive support for nftables and ipv6, while explicitly disabling specific connection tracking helpers to prevent NAT slipstreaming attacks.
| Configuration Flag | Value | Purpose |
|---|---|---|
CONFIG_IPV6 | y | Enables IPv6 support |
CONFIG_NF_TABLES | y | Enables nftables framework |
CONFIG_WIREGUARD | y | Enables WireGuard VPN support |
CONFIG_NF_CONNTRACK_FTP | n | Disables FTP NAT helper |
CONFIG_NF_CONNTRACK_SIP | n | Disables SIP NAT helper |
Sources: config.addendum.txt:1-8, config.addendum.txt:27-72
Virtualization and Driver Support
Support for QEMU q35 and virtio devices ensures compatibility with the vmtest infrastructure. This includes specific support for the Intel igb NIC required for UDP GSO diagnostic paths.
- Virtio Support: Includes
CONFIG_VIRTIO_PCI,CONFIG_VIRTIO_BLK, andCONFIG_VIRTIO_NETfor storage and network abstraction. - Intel IGB:
CONFIG_IGBis enabled to provide thetx-udp-segmentationandtx-gso-partialfeatures required for regression testing. - Storage:
CONFIG_SQUASHFSis enabled to support the root file system.
Sources: config.addendum.txt:10-14, config.addendum.txt:94-100, config.addendum.txt:103-108, README.md:12-16
Runtime Parameters
The kernel utilizes a specific command line defined in cmdline.txt to control boot behavior and error handling.
| Parameter | Action |
|---|---|
root=/dev/sda2 | Specifies the second partition of the first disk as the root filesystem. |
ro | Mounts the root filesystem as read-only. |
init=/gokrazy/init | Defines the gokrazy init system as the primary process. |
panic=10 | Reboots the system 10 seconds after a kernel panic. |
oops=panic | Forces a kernel panic on an "oops" condition. |
Sources: cmdline.txt:1
Development and Integration
The kernel is packaged as a Go module to be used as a KernelPackage in gokrazy deployments.
Developers can use go.mod replacements to point to a local checkout of this repository during development before a module version is officially published.
Sources: README.md:18-28, empty.go:1-9
The configuration also ensures that the kernel does not require local distribution signing material by setting CONFIG_SYSTEM_TRUSTED_KEYS to an empty string.
Sources: config.addendum.txt:140-141