tests/vm: add stock profile and a vanilla x86_64 reference kernel

`stock`: an unprivileged user (uid 1000) on an out-of-the-box kernel — every
sysctl left at its kernel default (kptr_restrict=0, dmesg_restrict=0,
perf_event_paranoid=2), neither weakened (unlike `default`) nor hardened.

`x86_64-vanilla`: a vanilla upstream-defconfig x86_64 from the pinned kernel.org
source, kept out of the default build set and staged under its own name so it
never shadows the Alpine matrix kernel.

Together they produce reproducible documentation samples from a neutral kernel
at default settings.

Author: bcoles

tests/vm/README.md

@@ -58,6 +58,7 @@ it is wider but still contains the truth — the correct outcome under restricti
 | `default`  | root, `kptr_restrict=0` | the easy case — kallsyms readable |
 | `hide`     | root, `kptr_restrict=2` | the pin must come from inference |
 | `hardened` | uid 1000, `kptr=2` + `dmesg_restrict=1` + `perf=3` | the realistic unprivileged floor (file-derived facts only) |
+| `stock`    | uid 1000, kernel-default sysctls (`kptr=0`, `dmesg_restrict=0`, `perf=2`) | an unprivileged user on an out-of-the-box kernel — nothing weakened or hardened |
 | `nokaslr`  | `nokaslr` on the cmdline | the KASLR-disabled pin |
 
 ## Architectures

tests/vm/build-kernel

@@ -37,11 +37,13 @@ LINUX_VERSION=${LINUX_VERSION:-6.15.6}
 LINUX_MIRROR=${LINUX_MIRROR:-https://cdn.kernel.org/pub/linux/kernel}
 JOBS=${JOBS:-$(nproc 2>/dev/null || echo 1)}
 
-# Default build set: the gap arches that boot and validate here. armeb has a spec
-# (below) but is excluded — the cross set's only big-endian arm toolchain is ARMv5
-# BE32, which can neither run on an ARMv7 BE8 kernel nor boot a BE32 kernel under
-# qemu; building it would stage a kernel `tests/vm/run` cannot validate. Build it
-# explicitly (`build-kernel armeb`) if a BE8-capable armv7 toolchain is added.
+# Default build set: the gap arches that boot and validate here. Two specs below
+# are excluded from the default and built only on request:
+#   armeb          — the cross set's only big-endian arm toolchain is ARMv5 BE32,
+#                    which can neither run on an ARMv7 BE8 kernel nor boot a BE32
+#                    kernel under qemu, so the staged kernel cannot be validated.
+#   x86_64-vanilla — Alpine already ships x86_64; this is a neutral upstream build
+#                    for reference/documentation, not a gap to fill.
 ALL_ARCHES="mips mipsel riscv32 ppc32"
 
 # arch -> "tc-prefix kernel-ARCH defconfig image endian"
@@ -55,6 +57,10 @@ spec_for() {
   riscv32) echo "riscv32  riscv   rv32_defconfig     Image   -" ;;
   ppc32)   echo "powerpc  powerpc pmac32_defconfig   vmlinux -" ;;
   armeb)   echo "armeb    arm     multi_v7_defconfig zImage  be" ;;
+  # Not a gap arch — Alpine ships x86_64. This is a vanilla upstream-defconfig
+  # x86_64 kept for a neutral reference build (e.g. documentation samples),
+  # staged under its own name so it never shadows the Alpine matrix kernel.
+  x86_64-vanilla) echo "x86_64   x86     x86_64_defconfig   bzImage -" ;;
   *)       echo "" ;;
   esac
 }

tests/vm/init.c

@@ -153,8 +153,12 @@ int main(void) {
    *               inference (exercises the engine, not the kallsyms shortcut).
    *   hardened  — drop to uid 1000 with kptr_restrict=2, dmesg_restrict=1,
    *               perf_event_paranoid=3: the realistic unprivileged-attacker
-   *               floor, where only file-derived facts survive. */
-  int hide = 0, hardened = 0;
+   *               floor, where only file-derived facts survive.
+   *   stock     — drop to uid 1000 but leave every sysctl at its kernel default
+   *               (kptr_restrict=0, dmesg_restrict=0, perf_event_paranoid=2):
+   *               an unprivileged user on an out-of-the-box kernel, neither
+   *               weakened nor hardened by us. */
+  int hide = 0, hardened = 0, stock = 0;
   {
     int cf = open("/proc/cmdline", O_RDONLY);
     char cb[512];
@@ -167,6 +171,8 @@ int main(void) {
           hide = 1;
         if (strstr(cb, "hardened"))
           hardened = 1;
+        if (strstr(cb, "stock"))
+          stock = 1;
       }
       close(cf);
     }
@@ -203,6 +209,15 @@ int main(void) {
   } else if (hide) {
     write_file("/proc/sys/kernel/kptr_restrict", "2\n");
     printf("=== profile: hide — root, kptr_restrict=2 (no kallsyms) ===\n");
+  } else if (stock) {
+    /* Kernel-default sysctls, nothing weakened or hardened by us: vanilla
+     * defaults are kptr_restrict=0, dmesg_restrict=0, perf_event_paranoid=2.
+     * Reset perf from the -1 used for the ground-truth dump; leave kptr and
+     * dmesg at their defaults. Run unprivileged. */
+    write_file("/proc/sys/kernel/perf_event_paranoid", "2\n");
+    uid = 1000;
+    printf("=== profile: stock — uid=1000, kernel-default sysctls "
+           "(kptr_restrict=0, dmesg_restrict=0, perf_event_paranoid=2) ===\n");
   } else {
     printf("=== profile: default — root, kptr_restrict=0 ===\n");
   }

tests/vm/run

@@ -72,6 +72,7 @@ mipsel      | -           | local| mipsel       | mipsel      | -M malta
 riscv32     | -           | local| riscv32      | riscv32     | -M virt                | ttyS0
 ppc32       | -           | local| powerpc      | ppc         | -M g3beige             | ttyS0
 armeb       | -           | local| armeb        | arm         | -M virt                | ttyAMA0
+x86_64-vanilla | -        | local| x86_64       | x86_64      | -M q35 -cpu max        | ttyS0
 '
 
 trim() { echo "$1" | xargs; }
@@ -254,6 +255,7 @@ EOF
     default)  ;;
     hide)     append="$append hidekptr" ;;
     hardened) append="$append hardened" ;;
+    stock)    append="$append stock" ;;
     nokaslr)  append="$append nokaslr" ;;
     *) echo "  unknown mode: $mode"; return 2 ;;
   esac