Release Notes

Releases that share a common name are identical from the Sulka feature point of view, so entries may cover multiple releases that are based on different versions of Yocto. See Releases & Versioning for what the version numbers tell you.

2026.09 (1.1.0 / 0.7.0)

Important

Two changes in this release need action when you update:

  • Kernel module signing is now enforced by default, and the build fails until you provide the signing keys. See Module Signing.

  • SULKA_HARDEN_FSTAB has been renamed to SULKA_HARDEN_MOUNTS. If you set the old variable in your configuration, rename it.

The next release, due by the end of 2026, is the last one to support Scarthgap. If you are on the 0.n.n line, now is a good time to move to Wrynose.

Features

  • The distro configuration and the bbappends have been refactored so that the meta-layers can be used as generic hardening layers, by including a single configuration file in your own distro configuration. See Using the Hardening Without the Sulka Distro.

  • Kernel module signing is now enforced by default. The documentation walks through generating the keys, see Building Sulka and Module Signing.

  • A new option, SULKA_DISABLE_KERNEL_MODULES, builds a kernel without loadable module support. It is not enabled by default, except when SULKA_EXTRA_COMPLIANCY is enabled. See Disabling Kernel Modules.

  • The meta-selinux dependency is now genuinely optional, and only required when SELinux is the selected mandatory access control module.

  • /tmp is now mounted with noexec, nodev and nosuid on systemd systems as well, as it already was on sysvinit systems. As the option now covers more than the fstab, SULKA_HARDEN_FSTAB has been renamed to SULKA_HARDEN_MOUNTS. A test checking the mount options has been added. See Cannot Execute A Script From /tmp, /run Or /var if this affects your software.

  • auditd is now part of the core packages that are always installed.

Bug Fixes

  • Fixed build warnings about an incorrect S variable in two recipes. The warnings had no effect beyond the message itself. A test that catches build warnings has been added so they do not return unnoticed.

Maintenance

  • All the dependency layers, such as openembedded-core and meta-openembedded, have been updated.

Other