Enabled hardening configs default to build.

[abhilash-manna]

This PR introduces support for merging hardening.config into the kernel configuration for linux-qcom-next.
The goal is to ensure that security hardening options are applied consistently across all builds.

What’s Changed
Added logic to include hardening.config during kernel configuration using merge_config.sh.
Introduced a new variable KBUILD_CONFIG_EXTRA (aligned with KBUILD naming conventions) to manage internal kernel configuration files like hardening.config.
Maintained separation between internal configs and external fragments (*.cfg) managed via SRC_URI.

Why This Change
Kernel builds previously lacked default hardening options, which could lead to reduced security.
This update ensures that compiler-based mitigations and other hardening features are applied by default.

Verification
verified build on QCS9100-ride-sx. Kernel configuration includes hardening options as expected.

Ref: 1201#issuecomment-3543906617

[vkraleti]

If we are enabling by default why distro feature is needed? Can't CONFIG_LIST be populated unconditionally?

[abhilash-manna]

Opt-Out Support: The hardened feature remains configurable, allowing users to explicitly remove it from DISTRO_FEATURES if they choose to disable hardening.

[lumag]

So, any user not using Kas will not get hardened features? Why do we have them here then? We are not publishing binary images.

[abhilash-manna]

Acknowledged. updated and remove dependency on the hardened feature.

[lumag]

So, any user not using Kas will not get hardened features? Why do we have them here then? We are not publishing binary images.

[quaresmajose]

Good to drop the hardening distro feature that doesn't seem to exist anywhere in all ohter layers.

[lumag]

Please write proper commit subject and message. For the subject you are changing particular recipe rather than full meta-qcom layer. Then please rewrite commit message into a normal English text, describing the issue that you are trying to solve and what is to be done (use imperative language).

[abhilash-manna]

Please write proper commit subject and message. For the subject you are changing particular recipe rather than full meta-qcom layer. Then please rewrite commit message into a normal English text, describing the issue that you are trying to solve and what is to be done (use imperative language).

Updated commit message per suggestion

[quaresmajose]

LGTM. thanks

[lumag]

This seems to break building of kgsl-dlkm module. Could you please take a look, why?

[ricardosalveti]

2025-11-19 16:37:57 - ERROR - ERROR: kgsl-dlkm-0.0+git-r0 do_package_qa: QA Issue: File /usr/lib/modules/6.18.0-rc5-00249-g53919c1f684a/updates/.debug/msm_kgsl.ko in package kgsl-dlkm-dbg contains reference to TMPDIR [buildpaths]

Interesting, wonder which new option is causing that for this module in particular.

[abhilash-manna]

2025-11-19 16:37:57 - ERROR - ERROR: kgsl-dlkm-0.0+git-r0 do_package_qa: QA Issue: File /usr/lib/modules/6.18.0-rc5-00249-g53919c1f684a/updates/.debug/msm_kgsl.ko in package kgsl-dlkm-dbg contains reference to TMPDIR [buildpaths]

Interesting, wonder which new option is causing that for this module in particular.

CONFIG_KSTACK_ERASE is causing package_qa errors in the kgsl & camx module (similar errors observed).
This configuration is critical for security and must remain enabled.
To address QA failures without disabling this option, we are considering adding the following directive to the kgsl-dlkm and camx-dlkm recipes :

INSANE_SKIP:${PN}-dbg += "buildpaths"

This would apply only to the debug package.
Discussions are ongoing with the respective technical teams to review this approach.

[lumag]

2025-11-19 16:37:57 - ERROR - ERROR: kgsl-dlkm-0.0+git-r0 do_package_qa: QA Issue: File /usr/lib/modules/6.18.0-rc5-00249-g53919c1f684a/updates/.debug/msm_kgsl.ko in package kgsl-dlkm-dbg contains reference to TMPDIR [buildpaths]
Interesting, wonder which new option is causing that for this module in particular.

CONFIG_KSTACK_ERASE is causing package_qa errors in the kgsl & camx module (similar errors observed). This configuration is critical for security and must remain enabled. To address QA failures without disabling this option, we are considering adding the following directive to the kgsl-dlkm and camx-dlkm recipes :

INSANE_SKIP:${PN}-dbg += "buildpaths"

No. This would mean that the builds are not binary-reproducible. So, NAK.

This would apply only to the debug package. Discussions are ongoing with the respective technical teams to review this approach.

[ricardosalveti]

Yes, we need to understand what is causing TMPDIR to be exposed and see if we can fix the kernel or if we should fix the recipes, adding to INSANE_SKIP is not acceptable.