From d46b6d79700d183fc6ecab67c23ea524130be913 Mon Sep 17 00:00:00 2001 From: LEAN-ESX Date: Tue, 15 Oct 2019 22:50:02 -0700 Subject: [PATCH 1/7] x86: Enable fast strings on Intel CPUs if BIOS hasn't config for kernel 4.9 --- .../luci-app-ssr-plus/po/zh-cn/ssr-plus.po | 6 ++ ...ings-on-Intel-if-BIOS-hasn-t-already.patch | 57 +++++++++++++++++++ 2 files changed, 63 insertions(+) create mode 100644 target/linux/x86/patches-4.9/900-x86-Enable-fast-strings-on-Intel-if-BIOS-hasn-t-already.patch diff --git a/package/lean/luci-app-ssr-plus/po/zh-cn/ssr-plus.po b/package/lean/luci-app-ssr-plus/po/zh-cn/ssr-plus.po index b261d79c08..28fd353d04 100644 --- a/package/lean/luci-app-ssr-plus/po/zh-cn/ssr-plus.po +++ b/package/lean/luci-app-ssr-plus/po/zh-cn/ssr-plus.po @@ -511,3 +511,9 @@ msgstr "仅常用端口（不走P2P流量到代理）" msgid "Ping Latency" msgstr "Ping延迟" + +msgid "Bypass Domain List" +msgstr "域名白名单" + +msgid "Black Domain List" +msgstr "域名黑名单" diff --git a/target/linux/x86/patches-4.9/900-x86-Enable-fast-strings-on-Intel-if-BIOS-hasn-t-already.patch b/target/linux/x86/patches-4.9/900-x86-Enable-fast-strings-on-Intel-if-BIOS-hasn-t-already.patch new file mode 100644 index 0000000000..b23ab971a9 --- /dev/null +++ b/target/linux/x86/patches-4.9/900-x86-Enable-fast-strings-on-Intel-if-BIOS-hasn-t-already.patch @@ -0,0 +1,57 @@ +diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c +index 1905ce9..a4a3ef2 100644 +--- a/arch/x86/kernel/cpu/intel.c ++++ b/arch/x86/kernel/cpu/intel.c +@@ -124,6 +124,7 @@ + static void early_init_intel(struct cpuinfo_x86 *c) + { + u64 misc_enable; ++ bool allow_fast_string = true; + + /* Unmask CPUID levels if masked: */ + if (c->x86 > 6 || (c->x86 == 6 && c->x86_model >= 0xd)) { +@@ -233,20 +234,39 @@ + * Ingo Molnar reported a Pentium D (model 6) and a Xeon + * (model 2) with the same problem. + */ +- if (c->x86 == 15) ++ if (c->x86 == 15) { ++ allow_fast_string = false; + if (msr_clear_bit(MSR_IA32_MISC_ENABLE, + MSR_IA32_MISC_ENABLE_FAST_STRING_BIT) > 0) + pr_info("kmemcheck: Disabling fast string operations\n"); ++ } + #endif + + /* +- * If fast string is not enabled in IA32_MISC_ENABLE for any reason, +- * clear the fast string and enhanced fast string CPU capabilities. ++ * If BIOS didn't enable fast string operation, try to enable ++ * it ourselves. If that fails, then clear the fast string ++ * and enhanced fast string CPU capabilities. + */ + if (c->x86 > 6 || (c->x86 == 6 && c->x86_model >= 0xd)) { + rdmsrl(MSR_IA32_MISC_ENABLE, misc_enable); ++ ++ if (allow_fast_string && ++ !(misc_enable & MSR_IA32_MISC_ENABLE_FAST_STRING)) { ++ misc_enable |= MSR_IA32_MISC_ENABLE_FAST_STRING; ++ wrmsrl_safe(MSR_IA32_MISC_ENABLE, misc_enable); ++ ++ /* Re-read to make sure it stuck. */ ++ rdmsrl(MSR_IA32_MISC_ENABLE, misc_enable); ++ ++ if (misc_enable & MSR_IA32_MISC_ENABLE_FAST_STRING) ++ printk_once(KERN_INFO "BIOS disabled fast string operation, re-enabled sucessfully.\n"); ++ } ++ + if (!(misc_enable & MSR_IA32_MISC_ENABLE_FAST_STRING)) { +- pr_info("Disabled fast string operations\n"); ++ if (allow_fast_string) ++ printk_once(KERN_INFO FW_WARN "BIOS disabled fast string operation, re-enable failed.\n"); ++ else ++ printk_once(KERN_INFO "Disabled fast string operations\n"); + setup_clear_cpu_cap(X86_FEATURE_REP_GOOD); + setup_clear_cpu_cap(X86_FEATURE_ERMS); + } + From f1ff7a5f25ba0e56dbbceb2a307f09ffe7794f52 Mon Sep 17 00:00:00 2001 From: LEAN-ESX Date: Tue, 15 Oct 2019 23:46:27 -0700 Subject: [PATCH 2/7] x64: disable PAGE_TABLE_ISOLATION --- target/linux/x86/64/config-4.9 | 2 +- target/linux/x86/Makefile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/target/linux/x86/64/config-4.9 b/target/linux/x86/64/config-4.9 index 019df57d2c..9a54e8e594 100644 --- a/target/linux/x86/64/config-4.9 +++ b/target/linux/x86/64/config-4.9 @@ -254,7 +254,7 @@ CONFIG_NR_CPUS=128 # CONFIG_NUMA is not set CONFIG_OUTPUT_FORMAT="elf64-x86-64" CONFIG_PADATA=y -CONFIG_PAGE_TABLE_ISOLATION=y +CONFIG_PAGE_TABLE_ISOLATION=n CONFIG_PARAVIRT=y CONFIG_PARAVIRT_CLOCK=y # CONFIG_PARAVIRT_DEBUG is not set diff --git a/target/linux/x86/Makefile b/target/linux/x86/Makefile index 4fc9cf49c0..4915a35340 100644 --- a/target/linux/x86/Makefile +++ b/target/linux/x86/Makefile @@ -21,7 +21,7 @@ include $(INCLUDE_DIR)/target.mk DEFAULT_PACKAGES += partx-utils mkf2fs fdisk e2fsprogs wpad kmod-usb-hid \ kmod-ath5k kmod-ath9k kmod-ath9k-htc kmod-ath10k kmod-rt2800-usb kmod-e1000e kmod-igb kmod-igbvf kmod-ixgbe kmod-pcnet32 kmod-tulip kmod-vmxnet3 kmod-i40e kmod-i40evf kmod-fs-f2fs \ -htop lm-sensors autocore automount autosamba luci-app-zerotier luci-app-ipsec-vpnd luci-app-pptp-server luci-proto-bonding luci-app-zerotier luci-app-unblockmusic luci-app-docker \ +htop lm-sensors autocore automount autosamba luci-app-zerotier luci-app-ipsec-vpnd luci-app-pptp-server luci-proto-bonding luci-app-zerotier luci-app-unblockmusic luci-app-transmission luci-app-docker \ ath10k-firmware-qca988x ath10k-firmware-qca9888 ath10k-firmware-qca9984 brcmfmac-firmware-43602a1-pcie intel-microcode amd64-microcode\ alsa-utils kmod-ac97 kmod-sound-hda-core kmod-sound-hda-codec-realtek kmod-sound-hda-codec-via kmod-sound-via82xx kmod-usb-audio \ kmod-usb-net kmod-usb-net-asix kmod-usb-net-asix-ax88179 kmod-usb-net-rtl8150 kmod-usb-net-rtl8152 \ From eed55e8a0fc34c8b8abf8d5c7e7181fb38b5ab9a Mon Sep 17 00:00:00 2001 From: LEAN-ESX Date: Tue, 15 Oct 2019 23:55:36 -0700 Subject: [PATCH 3/7] x64: auto load AVX crypto kernel module --- target/linux/x86/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/linux/x86/Makefile b/target/linux/x86/Makefile index 4915a35340..aff72b948b 100644 --- a/target/linux/x86/Makefile +++ b/target/linux/x86/Makefile @@ -22,7 +22,7 @@ include $(INCLUDE_DIR)/target.mk DEFAULT_PACKAGES += partx-utils mkf2fs fdisk e2fsprogs wpad kmod-usb-hid \ kmod-ath5k kmod-ath9k kmod-ath9k-htc kmod-ath10k kmod-rt2800-usb kmod-e1000e kmod-igb kmod-igbvf kmod-ixgbe kmod-pcnet32 kmod-tulip kmod-vmxnet3 kmod-i40e kmod-i40evf kmod-fs-f2fs \ htop lm-sensors autocore automount autosamba luci-app-zerotier luci-app-ipsec-vpnd luci-app-pptp-server luci-proto-bonding luci-app-zerotier luci-app-unblockmusic luci-app-transmission luci-app-docker \ -ath10k-firmware-qca988x ath10k-firmware-qca9888 ath10k-firmware-qca9984 brcmfmac-firmware-43602a1-pcie intel-microcode amd64-microcode\ +ath10k-firmware-qca988x ath10k-firmware-qca9888 ath10k-firmware-qca9984 brcmfmac-firmware-43602a1-pcie intel-microcode amd64-microcode kmod-crypto-misc \ alsa-utils kmod-ac97 kmod-sound-hda-core kmod-sound-hda-codec-realtek kmod-sound-hda-codec-via kmod-sound-via82xx kmod-usb-audio \ kmod-usb-net kmod-usb-net-asix kmod-usb-net-asix-ax88179 kmod-usb-net-rtl8150 kmod-usb-net-rtl8152 \ shadowsocks-libev-ss-redir v2ray shadowsocksr-libev-server shadowsocksr-libev-ssr-local dsmboot cfdisk From dcf59f634127c3895a460bb80d717b99eef86310 Mon Sep 17 00:00:00 2001 From: LEAN-ESX Date: Wed, 16 Oct 2019 03:21:08 -0700 Subject: [PATCH 4/7] luci-app-docker: access docker container from WAN can be enabled/disabled --- package/lean/luci-app-docker/Makefile | 2 +- .../luci-app-docker/luasrc/controller/docker.lua | 2 +- .../luci-app-docker/luasrc/model/cbi/docker.lua | 10 +++++----- package/lean/luci-app-docker/po/zh-cn/docker.po | 4 ++-- package/lean/luci-app-docker/root/etc/config/docker | 6 ------ .../lean/luci-app-docker/root/etc/config/dockerd | 4 ++++ package/lean/luci-app-docker/root/etc/docker-pppoe | 13 ------------- .../lean/luci-app-docker/root/etc/init.d/dockerd | 10 ++++++++-- .../luci-app-docker/root/etc/uci-defaults/docker | 7 +++++++ 9 files changed, 28 insertions(+), 30 deletions(-) delete mode 100644 package/lean/luci-app-docker/root/etc/config/docker create mode 100644 package/lean/luci-app-docker/root/etc/config/dockerd delete mode 100755 package/lean/luci-app-docker/root/etc/docker-pppoe diff --git a/package/lean/luci-app-docker/Makefile b/package/lean/luci-app-docker/Makefile index 7a1784fca0..19ea282eda 100755 --- a/package/lean/luci-app-docker/Makefile +++ b/package/lean/luci-app-docker/Makefile @@ -10,7 +10,7 @@ LUCI_TITLE:=Luci for Docker-CE LUCI_DEPENDS:=+docker-ce LUCI_PKGARCH:=all PKG_VERSION:=1 -PKG_RELEASE:=7 +PKG_RELEASE:=8 include $(TOPDIR)/feeds/luci/luci.mk diff --git a/package/lean/luci-app-docker/luasrc/controller/docker.lua b/package/lean/luci-app-docker/luasrc/controller/docker.lua index 46ef03ce28..93b8f6618d 100644 --- a/package/lean/luci-app-docker/luasrc/controller/docker.lua +++ b/package/lean/luci-app-docker/luasrc/controller/docker.lua @@ -1,7 +1,7 @@ module("luci.controller.docker", package.seeall) function index() - if not nixio.fs.access("/etc/config/docker") then + if not nixio.fs.access("/etc/config/dockerd") then return end diff --git a/package/lean/luci-app-docker/luasrc/model/cbi/docker.lua b/package/lean/luci-app-docker/luasrc/model/cbi/docker.lua index e998670d8d..750418b762 100644 --- a/package/lean/luci-app-docker/luasrc/model/cbi/docker.lua +++ b/package/lean/luci-app-docker/luasrc/model/cbi/docker.lua @@ -2,10 +2,10 @@ local running = (luci.sys.call("pidof portainer >/dev/null") == 0) local button = "" if running then - button = "      

" + button = "      


" end -m = Map("docker", "Docker CE", translate("Docker is a set of platform-as-a-service (PaaS) products that use OS-level virtualization to deliver software in packages called containers.")) +m = Map("dockerd", "Docker CE", translate("Docker is a set of platform-as-a-service (PaaS) products that use OS-level virtualization to deliver software in packages called containers.") .. button) m:section(SimpleSection).template = "docker/docker_status" @@ -13,12 +13,12 @@ m:section(SimpleSection).template = "docker/docker_status" s = m:section(TypedSection, "docker") s.anonymous = true -wan_mode = s:option(Flag, "enabled", translate("Enable WAN access Dokcer")) +wan_mode = s:option(Flag, "wan_mode", translate("Enable WAN access Dokcer"), translate("Enable WAN access docker mapped ports")) wan_mode.default = 0 wan_mode.rmempty = false -wan_mode.description = translate(("!") .. button) -o = s:option(Button,"certificate",translate("Docker Readme First")) + +o = s:option(Button,"readme",translate("Docker Readme First")) o.inputtitle = translate("Download DockerReadme.pdf") o.description = translate("Please download DockerReadme.pdf to read when first-running") o.inputstyle = "reload" diff --git a/package/lean/luci-app-docker/po/zh-cn/docker.po b/package/lean/luci-app-docker/po/zh-cn/docker.po index c0b24e3155..b95369aacf 100644 --- a/package/lean/luci-app-docker/po/zh-cn/docker.po +++ b/package/lean/luci-app-docker/po/zh-cn/docker.po @@ -4,7 +4,7 @@ msgstr "" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2015-06-23 20:16+0800\n" "PO-Revision-Date: 2015-06-23 20:17+0800\n" -"Last-Translator: 981213 \n" +"Last-Translator: coolsnowwolf \n" "Language-Team: PandoraBox Team\n" "Language: zh_CN\n" "MIME-Version: 1.0\n" @@ -27,7 +27,7 @@ msgid "Enable WAN access Dokcer" msgstr "允许 WAN 访问 Dokcer" msgid "Enable WAN access docker mapped ports" -msgstr "允许 WAN 访问 Dokcer 映射后的端口（易受攻击，不推荐！）" +msgstr "允许 WAN 访问 Dokcer 映射后的端口（易受攻击！）。

推荐禁用该选项后，用系统防火墙选择性映射 172.17.0.X:XX 端口到 WAN" msgid "Docker Readme First" msgstr "Docker 初始化无脑配置教程" diff --git a/package/lean/luci-app-docker/root/etc/config/docker b/package/lean/luci-app-docker/root/etc/config/docker deleted file mode 100644 index 94d95300aa..0000000000 --- a/package/lean/luci-app-docker/root/etc/config/docker +++ /dev/null @@ -1,6 +0,0 @@ - -config docker - option wan_mode '1' - option enable '1' - option enabled '0' - diff --git a/package/lean/luci-app-docker/root/etc/config/dockerd b/package/lean/luci-app-docker/root/etc/config/dockerd new file mode 100644 index 0000000000..b73c0a3e38 --- /dev/null +++ b/package/lean/luci-app-docker/root/etc/config/dockerd @@ -0,0 +1,4 @@ + +config docker + option wan_mode '0' + diff --git a/package/lean/luci-app-docker/root/etc/docker-pppoe b/package/lean/luci-app-docker/root/etc/docker-pppoe deleted file mode 100755 index a9989aadab..0000000000 --- a/package/lean/luci-app-docker/root/etc/docker-pppoe +++ /dev/null @@ -1,13 +0,0 @@ -#!/bin/sh - -sleep 10 - -docker_ok=$(iptables -t filter -L FORWARD | grep DOCKER) - -while [ -z "$docker_ok" ]; do - echo "DOCKER Chain not ready" && sleep 10 - docker_ok=$(iptables -t filter -L FORWARD | grep DOCKER) -done - -iptables -D FORWARD -i pppoe-wan -o docker0 -j DROP 2>/dev/null -iptables -I FORWARD -i pppoe-wan -o docker0 -j DROP diff --git a/package/lean/luci-app-docker/root/etc/init.d/dockerd b/package/lean/luci-app-docker/root/etc/init.d/dockerd index 9a3d72f6c5..5d6f36bf2b 100755 --- a/package/lean/luci-app-docker/root/etc/init.d/dockerd +++ b/package/lean/luci-app-docker/root/etc/init.d/dockerd @@ -5,12 +5,18 @@ START=25 start_service() { local nofile=$(cat /proc/sys/fs/nr_open) + local wanmode=$(uci get dockerd.@docker[0].wan_mode) + + if [ $wanmode = "1" ] ;then + dockerwan=" " + else + dockerwan="--iptables=false" + fi procd_open_instance procd_set_param stderr 1 - procd_set_param command /usr/bin/dockerd + procd_set_param command /usr/bin/dockerd $dockerwan procd_set_param limits nofile="${nofile} ${nofile}" procd_close_instance - /etc/docker-pppoe &>/dev/null & } diff --git a/package/lean/luci-app-docker/root/etc/uci-defaults/docker b/package/lean/luci-app-docker/root/etc/uci-defaults/docker index d7bfee271d..e03f477838 100755 --- a/package/lean/luci-app-docker/root/etc/uci-defaults/docker +++ b/package/lean/luci-app-docker/root/etc/uci-defaults/docker @@ -1,4 +1,11 @@ #!/bin/sh +uci -q batch <<-EOF >/dev/null + delete ucitrack.@dockerd[-1] + add ucitrack dockerd + set ucitrack.@dockerd[-1].init=dockerd + commit ucitrack +EOF + rm -f /tmp/luci-indexcache exit 0 From c0d39bb8e1d22a29c118a9f72b802b4ac9eccc75 Mon Sep 17 00:00:00 2001 From: LEAN-ESX Date: Wed, 16 Oct 2019 03:45:30 -0700 Subject: [PATCH 5/7] luci-app-ssr-plus: fix cccat.me too slow to subscribe --- package/lean/luci-app-ssr-plus/Makefile | 2 +- .../root/usr/share/shadowsocksr/subscribe.sh | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/lean/luci-app-ssr-plus/Makefile b/package/lean/luci-app-ssr-plus/Makefile index a7d05b116f..f489f5cd2c 100644 --- a/package/lean/luci-app-ssr-plus/Makefile +++ b/package/lean/luci-app-ssr-plus/Makefile @@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=luci-app-ssr-plus PKG_VERSION:=1 -PKG_RELEASE:=112 +PKG_RELEASE:=113 PKG_CONFIG_DEPENDS:= CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_Shadowsocks \ CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_V2ray \ diff --git a/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/subscribe.sh b/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/subscribe.sh index 1211740281..56bc6735cc 100755 --- a/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/subscribe.sh +++ b/package/lean/luci-app-ssr-plus/root/usr/share/shadowsocksr/subscribe.sh @@ -69,14 +69,14 @@ do echo_date "从 ${subscribe_url[o]} 获取订阅" echo_date "开始更新在线订阅列表..." echo_date "开始下载订阅链接到本地临时文件，请稍等..." - subscribe_data=$(wget-ssl --user-agent="User-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" --no-check-certificate -T 3 -O- ${subscribe_url[o]}) + subscribe_data=$(wget-ssl --user-agent="User-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" --no-check-certificate -t 10 -T 10 -O- ${subscribe_url[o]}) curl_code=$? # 计算group的hashkey ssr_grouphashkey=$(echo "${subscribe_url[o]}" | md5sum | cut -d ' ' -f1) if [ ! $curl_code -eq 0 ];then echo_date "下载订阅成功..." echo_date "开始解析节点信息..." - subscribe_data=$(wget-ssl --no-check-certificate -T 3 -O- ${subscribe_url[o]}) + subscribe_data=$(wget-ssl --no-check-certificate -t 10 -T 10 -O- ${subscribe_url[o]}) curl_code=$? fi if [ $curl_code -eq 0 ];then From 5e2b2fe8e917812459cb6dcf9571c8f2dbf5e7e1 Mon Sep 17 00:00:00 2001 From: LEAN-ESX Date: Wed, 16 Oct 2019 04:11:06 -0700 Subject: [PATCH 6/7] luci-app-ssr-plus: speedup start-delay when server-node disable ping --- package/lean/luci-app-ssr-plus/Makefile | 2 +- package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/lean/luci-app-ssr-plus/Makefile b/package/lean/luci-app-ssr-plus/Makefile index f489f5cd2c..1da23f6f2c 100644 --- a/package/lean/luci-app-ssr-plus/Makefile +++ b/package/lean/luci-app-ssr-plus/Makefile @@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=luci-app-ssr-plus PKG_VERSION:=1 -PKG_RELEASE:=113 +PKG_RELEASE:=115 PKG_CONFIG_DEPENDS:= CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_Shadowsocks \ CONFIG_PACKAGE_$(PKG_NAME)_INCLUDE_V2ray \ diff --git a/package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr b/package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr index 90904204e0..3079e369e0 100755 --- a/package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr +++ b/package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr @@ -67,7 +67,7 @@ gen_config_file() { elif [ "$host" != "${host#*:[0-9a-fA-F]}" ] ;then hostip=${host} else - hostip=`ping ${host} -s 1 -c 1 | grep PING | cut -d'(' -f 2 | cut -d')' -f1` + hostip=`nslookup ${host} | grep 'Address 1' | sed 's/Address 1: //g'` if echo $hostip|grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$">/dev/null; then hostip=${hostip} else @@ -143,7 +143,7 @@ start_rules() { elif [ "$server" != "${server#*:[0-9a-fA-F]}" ] ;then server=${server} else - server=`ping ${server} -s 1 -c 1 | grep PING | cut -d'(' -f 2 | cut -d')' -f1` + server=`nslookup ${server} | grep 'Address 1' | sed 's/Address 1: //g'` if echo $server|grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$">/dev/null; then echo $server >/etc/ssr_ip else From 426b3643ccb89c988a131381cbe2abb6f67932a5 Mon Sep 17 00:00:00 2001 From: LEAN-ESX Date: Wed, 16 Oct 2019 08:25:40 -0700 Subject: [PATCH 7/7] kernel:seccomp disable by default --- config/Config-kernel.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/Config-kernel.in b/config/Config-kernel.in index 472cb87c7c..96aaed768e 100644 --- a/config/Config-kernel.in +++ b/config/Config-kernel.in @@ -650,13 +650,13 @@ config KERNEL_POSIX_MQUEUE config KERNEL_SECCOMP_FILTER bool - default y if !SMALL_FLASH + default n config KERNEL_SECCOMP bool "Enable seccomp support" depends on !(TARGET_uml) select KERNEL_SECCOMP_FILTER - default y if !SMALL_FLASH + default n help Build kernel with support for seccomp.