How to configure Security recommendations provided by AGL- documentation

After our discussion in the Application Framework call I would close this. Essentially it is the task of the implementer to choose the options for the use-case and the hardware used. So this too specific and we cannot do a single configuration at this point.

Thanks for the resolution, , it cleared some points out. But can you give me some details from the point of security on kernel level & Platform level which AGL provide by default, keeping it as a base . Say for example I downloaded lamprey version of AGL and what is the default level of security I am getting by default, from the open-source side.

A few of them are directly set in kernel configuration fragments that AGL applies to kernels built with the supported upstream build process for the reference platforms, look in meta-agl/meta-agl-core/recipes-kernel/linux/linux, the others are dependent on the defconfig provided by the BSP vendor kernel.  The thing to note is the document that you are looking at is considered very out of date at this point with the reality of how AGL is used (see my previous comment).  All downstream AGL members are expected to be doing their own security hardening and using their own custom kernel configurations.  There is definitely some potential for AGL upstream to more explicitly enable a base set of zero or low impact hardening options in the default kernel configurations that are used in testing and demos on the reference platforms, but there is no guarantee that doing so is useful to Tier1s or OEMs as they are not necessarily going to pick up any of our upstream kernel configuration.  Please let me know if this addresses your question.

Can you please confirm me if AGL has directly recommended these safety configurations on kernel level from their end? Can the configurations be implemented on  AGL?

Those are kernel configuration settings, so application is somewhat BSP dependent.  AGL does attempt to provide a consistent mechanism for applying kernel configuration fragments (.cfg files), but that is only enabled for the BSP layer kernels that are supported in the upstream tree (so e.g. the Renesas linux-renesas kernel for the rcar3 platforms).  Look at meta-agl/recipes-kernel/linux/linux-agl-config.inc to get an idea how AGL manages that for different BSP kernel recipes.

In general, AGL members have indicated that they consider security hardening something that they do in-house, so currently the upstream tree has not worked to ensure all of those settings are enabled on all platforms.  That is something that could potentially be revisited.  To add configuration in your own tree if required, you would need to add a kernel recipe bbappend in your own product layer to add a kernel configuration fragment or fragments to adjust the configuration.