security(kernel): harden memory mapping and IOMMU defaults

Set CONFIG_LSM_MMAP_MIN_ADDR=65536 on both arches (was 0) and enable
CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT on aarch64. Both were set in
AZL 3.0. Bump azl_pkgrelease to 10 for the hardening changes.

- LSM_MMAP_MIN_ADDR=65536: prevents userspace from mapping low virtual
  addresses, blocking NULL-pointer dereference exploits. AZL 3.0 x86_64
  had 65536, aarch64 had 4096 — now consistent at 65536. Aligned with
  KSPP recommendations.
- ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT: IOMMU denies DMA by default for
  devices not explicitly assigned, preventing DMA attacks from
  compromised devices. Aligned with KSPP recommendations.

Author: rlmenge

base/comps/kernel/6.18-aarch64-azl.config

@@ -11226,7 +11226,7 @@ CONFIG_IOMMU_SVA=y
 CONFIG_IOMMU_IOPF=y
 CONFIG_ARM_SMMU=y
 # CONFIG_ARM_SMMU_LEGACY_DT_BINDINGS is not set
-# CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT is not set
+CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT=y
 CONFIG_ARM_SMMU_MMU_500_CPRE_ERRATA=y
 CONFIG_ARM_SMMU_QCOM=y
 # CONFIG_ARM_SMMU_QCOM_DEBUG is not set
@@ -13410,7 +13410,7 @@ CONFIG_SECURITY_NETWORK=y
 CONFIG_SECURITY_INFINIBAND=y
 CONFIG_SECURITY_NETWORK_XFRM=y
 CONFIG_SECURITY_PATH=y
-CONFIG_LSM_MMAP_MIN_ADDR=0
+CONFIG_LSM_MMAP_MIN_ADDR=65536
 # CONFIG_STATIC_USERMODEHELPER is not set
 CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y

base/comps/kernel/6.18-x86_64-azl.config

@@ -7536,7 +7536,7 @@ CONFIG_SECURITY_INFINIBAND=y
 CONFIG_SECURITY_NETWORK_XFRM=y
 CONFIG_SECURITY_PATH=y
 CONFIG_INTEL_TXT=y
-CONFIG_LSM_MMAP_MIN_ADDR=0
+CONFIG_LSM_MMAP_MIN_ADDR=65536
 # CONFIG_STATIC_USERMODEHELPER is not set
 CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y

base/comps/kernel/kernel.comp.toml

@@ -14,7 +14,7 @@ without = [
 
 [components.kernel.build.defines]
 # RPM release number for the Azure Linux kernel package
-azl_pkgrelease = "12"
+azl_pkgrelease = "13"
 # 4th version component from the AZL kernel source (6.18.5.1). Included in specrelease so it appears
 # in the RPM Release tag, uname -r, and /lib/modules/ path (e.g. 6.18.5-1.3.azl4.aarch64).
 kextraversion = "1"

locks/kernel.lock

@@ -2,5 +2,5 @@
 version = 1
 import-commit = '5271a1b047ef402ddee40242e02eda23fc273044'
 upstream-commit = '5271a1b047ef402ddee40242e02eda23fc273044'
-input-fingerprint = 'sha256:43678a80bce5e882c175c342ab03a9576d63a1a20e23f30ef6960d2bc32d0725'
+input-fingerprint = 'sha256:a54d85918f6e592a07c3fcbb62b3f44a88f96860145c39edd9183352b952b112'
 resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e'

specs/k/kernel/6.18-aarch64-azl.config

@@ -11226,7 +11226,7 @@ CONFIG_IOMMU_SVA=y
 CONFIG_IOMMU_IOPF=y
 CONFIG_ARM_SMMU=y
 # CONFIG_ARM_SMMU_LEGACY_DT_BINDINGS is not set
-# CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT is not set
+CONFIG_ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT=y
 CONFIG_ARM_SMMU_MMU_500_CPRE_ERRATA=y
 CONFIG_ARM_SMMU_QCOM=y
 # CONFIG_ARM_SMMU_QCOM_DEBUG is not set
@@ -13410,7 +13410,7 @@ CONFIG_SECURITY_NETWORK=y
 CONFIG_SECURITY_INFINIBAND=y
 CONFIG_SECURITY_NETWORK_XFRM=y
 CONFIG_SECURITY_PATH=y
-CONFIG_LSM_MMAP_MIN_ADDR=0
+CONFIG_LSM_MMAP_MIN_ADDR=65536
 # CONFIG_STATIC_USERMODEHELPER is not set
 CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y

specs/k/kernel/6.18-x86_64-azl.config

@@ -7536,7 +7536,7 @@ CONFIG_SECURITY_INFINIBAND=y
 CONFIG_SECURITY_NETWORK_XFRM=y
 CONFIG_SECURITY_PATH=y
 CONFIG_INTEL_TXT=y
-CONFIG_LSM_MMAP_MIN_ADDR=0
+CONFIG_LSM_MMAP_MIN_ADDR=65536
 # CONFIG_STATIC_USERMODEHELPER is not set
 CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y

specs/k/kernel/kernel.azl.macros

@@ -2,6 +2,6 @@
 # Do not edit manually; changes will be overwritten.
 %_without_debug 1
 %_without_selftests 1
-%azl_pkgrelease 12
+%azl_pkgrelease 13
 %azurelinux_version 3
 %kextraversion 1