From a631e9b3c5cb03bc1f69fa69e6de019a124d9e72 Mon Sep 17 00:00:00 2001
From: Douglas Teles <dga.teles@gmail.com>
Date: Sat, 18 Apr 2026 15:32:41 -0300
Subject: [PATCH] Fix audit-build.sh: use /boot/config-* as primary kernel
 config source
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With CONFIG_IKCONFIG=n (correct for production), /proc/config.gz is not
available. The script now reads /boot/config-$(uname -r) as primary
source and falls back to /proc/config.gz only if IKCONFIG is enabled.

Also removed FRAME_POINTER check (ARM64 forces it via Kconfig select,
checking if it's disabled always fails) — now shown as informational.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 tools/audit-build.sh | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/tools/audit-build.sh b/tools/audit-build.sh
index f347dc75d6..beb7275b24 100755
--- a/tools/audit-build.sh
+++ b/tools/audit-build.sh
@@ -33,23 +33,34 @@ echo "========================================"
 
 echo ""
 echo "=== 1. KERNEL DEBUG FLAGS ==="
-if [ -f /proc/config.gz ]; then
+# Primary: /boot/config-* (always present)
+# Fallback: /proc/config.gz (only if CONFIG_IKCONFIG=y, disabled in production)
+KCONF_FILE="/boot/config-$(uname -r)"
+if [ -f "$KCONF_FILE" ]; then
+  KCONF=$(cat "$KCONF_FILE")
+  echo "  Source: $KCONF_FILE"
+elif [ -f /proc/config.gz ]; then
   KCONF=$(zcat /proc/config.gz)
+  echo "  Source: /proc/config.gz (IKCONFIG enabled — consider disabling for production)"
+else
+  KCONF=""
+  warn "No kernel config found (neither /boot/config-* nor /proc/config.gz)"
+fi
+
+if [ -n "$KCONF" ]; then
   check "DEBUG_KERNEL" "not set" "$(echo "$KCONF" | grep -c CONFIG_DEBUG_KERNEL=y | sed 's/1/SET/;s/0/not set/')"
   check "LOCKDEP" "not set" "$(echo "$KCONF" | grep -c CONFIG_LOCKDEP=y | sed 's/1/SET/;s/0/not set/')"
   check "KASAN" "not set" "$(echo "$KCONF" | grep -c CONFIG_KASAN=y | sed 's/1/SET/;s/0/not set/')"
   check "KMEMLEAK" "not set" "$(echo "$KCONF" | grep -c CONFIG_KMEMLEAK=y | sed 's/1/SET/;s/0/not set/')"
   check "FTRACE" "not set" "$(echo "$KCONF" | grep -c CONFIG_FTRACE=y | sed 's/1/SET/;s/0/not set/')"
   check "SCHEDSTATS" "not set" "$(echo "$KCONF" | grep -c CONFIG_SCHEDSTATS=y | sed 's/1/SET/;s/0/not set/')"
-  check "FRAME_POINTER" "not set" "$(echo "$KCONF" | grep -c CONFIG_FRAME_POINTER=y | sed 's/1/SET/;s/0/not set/')"
   check "PROFILING" "not set" "$(echo "$KCONF" | grep -c CONFIG_PROFILING=y | sed 's/1/SET/;s/0/not set/')"
 
   echo ""
   echo "  Kernel Timer: $(echo "$KCONF" | grep CONFIG_HZ= | head -1)"
   echo "  Preempt: $(echo "$KCONF" | grep CONFIG_PREEMPT= | head -1)"
   echo "  Optimize: $(echo "$KCONF" | grep CONFIG_CC_OPTIMIZE | head -1)"
-else
-  warn "/proc/config.gz not available (CONFIG_IKCONFIG disabled - OK for production)"
+  echo "  Frame Pointer: $(echo "$KCONF" | grep CONFIG_FRAME_POINTER= | head -1) (forced on ARM64)"
 fi
 
 echo ""