Repository navigation
fix(kernel): enable gaming desktop sandboxes and VPN devices - #628
Merged
Merged
Conversation
The actual OGC ISO boots but cannot run Flatpak apps with USER_NS disabled, and Tailscale cannot create its missing TUN device. Enable and assert namespace, memory-cgroup, seccomp, and TUN support before compile and when unpacking cached kernels. This intentionally invalidates the compiled kernel-cache tag. Assisted-by: GPT-6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This was referenced Oct 7, 2026
![hivecommons-hive[bot]](https://avatars.githubusercontent.com/in/3568013?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Reviewed at 00e6660.
correctness
- low:
tests/test_ogc_kernel_features.py:30-38only provesverify_configrejects a fixture missing each symbol; it never asserts the build path actually sets them. The existing gate test (tests/test_iso_ci.py:73-78) pairs each required symbol withassertRegex(script, r"--(?:enable|module) SYMBOL"), so deletingscripts/install-ogc-kernel.sh:175-176would still pass the new suite. Add the six symbols to that regex check (or replicate it).
style
- low: the new file re-implements the
required_config/verify_configextraction harness already intests/test_iso_ci.py:67-71(EvidenceTests.test_ogc_config_gate_rejects_each_missing_live_boot_feature). Extending that list withNAMESPACES USER_NS MEMCG SECCOMP SECCOMP_FILTER TUNwould cover both points above without a second parser of the same script.
No findings from: security, intent-alignment, docs-currency.
Confidence: 5/5 (safe)
— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88
castrojo
approved these changes
Oct 10, 2026
castrojo
left a comment
castrojo
left a comment
Contributor
There was a problem hiding this comment.
Substantive review: config changes enable essential sandbox and networking features (USER_NS, NAMESPACES, MEMCG, SECCOMP, SECCOMP_FILTER, TUN) in install-ogc-kernel.sh and enforce them via verify_config; docs updated in kernel-cache.md and unit tests added in test_ogc_kernel_features.py. CI clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Gaming and NVIDIA-gaming ISOs installed and logged into GNOME on OGC 7.1.8, but the Flatpak terminal never launched. The pinned x86 defconfig omits USER_NS (init/Kconfig defaults it off), and installed serial logs showed Tailscale repeatedly failing because CONFIG_TUN was absent.
Enable and assert NAMESPACES, USER_NS, MEMCG, SECCOMP, SECCOMP_FILTER and modular TUN before compiling. Apply the same required-config checks when unpacking cached kernels. Source and vendor version pins are unchanged. The content tag deliberately moves to d063d7298440a152; native workflow 37590462764 built and cosign-verified fresh cache digest 3f6deaec1ccd6243ade804f44b17379e60178a155e7155eb7634c1e65f4431c5.
Validation: full just check (906 tests), full pre-commit and all four native image checks passed at 00e6660. Execute the actual config verifier against a complete fixture and six independently missing features. Includes kernel-cache skill learning. Pinned source: https://github.com/OpenGamingCollective/linux/blob/86a4e13f16fb876282a12cc7680b3eb73d990e6b/init/Kconfig#L1426.
Combined candidate 007710c passed every configured flavor in the offline installed ISO KVM gate: https://github.com/projectbluefin/utah/actions/runs/37593481086. All four composed, booted live, installed to LUKS, unlocked and logged into GNOME Wayland with a visible Flatpak terminal. Independently recomputed raw payload hashes match all four guest bootc digests; all 37 declared Flatpak refs, RPM/GPG guards, default-on timers and countme opt-out passed. Gaming boots OGC 7.1.8 with working unprivileged user namespaces and TUN; NVIDIA module vermagic matches each running kernel. Desktop/About screenshots visually inspected.
Stacked on #566 for correct bootc/live kernel selection. Merge dependencies and obtain independent main approval before merging. Physical GPU and Secure Boot acceptance remain separate. Refs #127, #15, #24.