Add two PAGE_TABLE_CHECK related checks from kspp
[kconfig-hardened-check.git] / issues.md
1 Export of Github issues for [a13xp0p0v/kernel-hardening-checker](https://github.com/a13xp0p0v/kernel-hardening-checker).
2
3 # [\#103 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/103) `open`: add disabling CONFIG_AIO (legacy POSIX AIO) as a recommendation
4
5 #### <img src="https://avatars.githubusercontent.com/u/1505226?u=0edff17ad0c4acebbd8660dc1854229d526a6dc4&v=4" width="50">[thestinger](https://github.com/thestinger) opened issue at [2024-01-08 05:31](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/103):
6
7 POSIX AIO is a legacy feature and adds significant attack surface, albeit not nearly as much as IO_URING. POSIX AIO was poorly designed and hardly got any usage. The glibc and musl implementation doesn't use the kernel implementation and it requires a dedicated library, but is essentially obsolete now beyond it being used before io_uring was an option and still not being replaced in rare applications using it. Essentially everything using it can fall back to not using it via thread pools though, with little impact to most people. High performance software would be using io_uring anyway, not this legacy approach.
8
9 As an example, Android used AIO for implementing the fastboot, adb and mtp USB gadget protocols with fallback to synchronous IO but then moved to using io_uring for fastboot and also adopted it for snapuserd too. io_uring is limited to fastbootd/snapuserd via SELinux, but AIO was allowed for everything. It would be best if they moved adb and mtp to io_uring too and removed the AIO system calls from the seccomp-bpf whitelist. Apps can't use io_uring and none use AIO in practice, particularly since they provide no bindings for it for apps to use, only the base OS.
10
11
12
13
14 -------------------------------------------------------------------------------
15
16 # [\#102 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/102) `open`: drop check for dependency-only CONFIG_GCC_PLUGINS due to Clang
17 **Labels**: `enhancement`
18
19
20 #### <img src="https://avatars.githubusercontent.com/u/1505226?u=0edff17ad0c4acebbd8660dc1854229d526a6dc4&v=4" width="50">[thestinger](https://github.com/thestinger) opened issue at [2024-01-08 05:10](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/102):
21
22 It makes sense to check for the functionality provided by the plugins if there's no Clang alternative, but it doesn't make sense to fail from an irrelevant dependency for those features being unavailable. For example, using CONFIG_INIT_STACK_ALL_ZERO is more secure than the STRUCTLEAK plugin anyway, and has insignificant performance overhead. There are already checks for the latent entropy, RANDSTRUCT and STACKLEAK plugins, but there could be alternatives to those for Clang, and not having GCC_PLUGINS enabled is irrelevant.
23
24 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2024-01-16 21:52](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/102#issuecomment-1894574347):
25
26 @thestinger, I agree. I'll think and return with the solution.
27
28
29 -------------------------------------------------------------------------------
30
31 # [\#101 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/101) `closed`: CONFIG_ARCH_MMAP_RND_BITS check is wrong for arm64
32 **Labels**: `question`
33
34
35 #### <img src="https://avatars.githubusercontent.com/u/1505226?u=0edff17ad0c4acebbd8660dc1854229d526a6dc4&v=4" width="50">[thestinger](https://github.com/thestinger) opened issue at [2024-01-08 04:37](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/101):
36
37 The expected value on arm64 for a 48-bit address space (4 level page tables with 4k pages) is 33, not 32, which makes the check fail even though it's higher. arm64 has configurable page size and page table levels. Typical Linux devices have 4k pages and 3 level page tables resulting in a 39-bit address space, providing much less ASLR entropy as the maximum. A hardened kernel should use 4 level page tables resulting in a 48-bit address space and an expected value of 33 here. 4k pages also provide more granularity for guard pages, although it's much less important on ARMv9 devices supporting MTE such as the Pixel 8 where a reserved tag can be used for 16 byte granularity guards rather than using pages.
38
39 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2024-01-16 21:37](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/101#issuecomment-1894555189):
40
41 Hi @thestinger,
42
43 I agree with you, currently the code already does this.
44
45 Quoting [__init__.py#L328](https://github.com/a13xp0p0v/kernel-hardening-checker/blob/master/kernel_hardening_checker/__init__.py#L328):
46 ```
47         # hackish refinement of the CONFIG_ARCH_MMAP_RND_BITS check
48         mmap_rnd_bits_max = parsed_kconfig_options.get('CONFIG_ARCH_MMAP_RND_BITS_MAX', None)
49         if mmap_rnd_bits_max:
50             override_expected_value(config_checklist, 'CONFIG_ARCH_MMAP_RND_BITS', mmap_rnd_bits_max)
51         else:
52             # remove the CONFIG_ARCH_MMAP_RND_BITS check to avoid false results
53             print('[-] Can\'t check CONFIG_ARCH_MMAP_RND_BITS without CONFIG_ARCH_MMAP_RND_BITS_MAX')
54             config_checklist[:] = [o for o in config_checklist if o.name != 'CONFIG_ARCH_MMAP_RND_BITS']
55 ```
56 So `kernel-hardening-checker` creates this recommendation dynamically.
57
58 The example output for `arm64_defconfig_6.6.config`:
59 ```
60 [+] Kconfig file to check: kernel_hardening_checker/config_files/defconfigs/arm64_defconfig_6.6.config
61 [+] Detected microarchitecture: ARM64
62 [+] Detected kernel version: 6.6
63 [+] Detected compiler: GCC 130001
64 ...
65 CONFIG_ARCH_MMAP_RND_BITS               |kconfig|     33     |    my    | harden_userspace | FAIL: "18"
66 ```
67 I'll create a new tag very soon, and this will get into the new release of the tool.
68
69 #### <img src="https://avatars.githubusercontent.com/u/1505226?u=0edff17ad0c4acebbd8660dc1854229d526a6dc4&v=4" width="50">[thestinger](https://github.com/thestinger) commented at [2024-01-16 21:40](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/101#issuecomment-1894558946):
70
71 I can also start testing with the git revision now before making recommendations, it just didn't occur to me that it had been a long time since the last stable release and I didn't see recent commits for those things.
72
73 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2024-01-16 21:48](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/101#issuecomment-1894569310):
74
75 @thestinger, thank you for testing!
76
77 Preparing a release of the tool corresponding to the new kernel version takes a lot of effort.
78
79 I hope to find resources to do that more often.
80
81
82 -------------------------------------------------------------------------------
83
84 # [\#100 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/100) `closed`: CONFIG_COMPAT_VDSO has a completely different meaning for arm64 and recommending disabling it doesn't make sense there
85 **Labels**: `question`
86
87
88 #### <img src="https://avatars.githubusercontent.com/u/1505226?u=0edff17ad0c4acebbd8660dc1854229d526a6dc4&v=4" width="50">[thestinger](https://github.com/thestinger) opened issue at [2024-01-08 04:34](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/100):
89
90 On arm64, CONFIG_COMPAT_VDSO determines whether the vdso is mapped in 32-bit processes at all. It's not a compatibility hack with security implications like it is on x86 but rather has a completely different meaning.
91
92 It makes sense to recommend disabling 32-bit ARM support as a whole (CONFIG_COMPAT), but there's no reason to recommend disabling this particular option.
93
94 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2024-01-16 21:26](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/100#issuecomment-1894537837):
95
96 Hello @thestinger,
97
98 Yes, the code already describes the same thing.
99 Quoting [checks.py#L298](https://github.com/a13xp0p0v/kernel-hardening-checker/blob/master/kernel_hardening_checker/checks.py#L298):
100 ```
101     if arch in ('X86_64', 'X86_32'):
102         l += [KconfigCheck('cut_attack_surface', 'kspp', 'COMPAT_VDSO', 'is not set')]
103               # CONFIG_COMPAT_VDSO disabled ASLR of vDSO only on X86_64 and X86_32;
104               # on ARM64 this option has different meaning
105 ```
106
107 #### <img src="https://avatars.githubusercontent.com/u/1505226?u=0edff17ad0c4acebbd8660dc1854229d526a6dc4&v=4" width="50">[thestinger](https://github.com/thestinger) commented at [2024-01-16 21:30](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/100#issuecomment-1894543152):
108
109 Ah, it's because https://github.com/a13xp0p0v/kernel-hardening-checker/commit/22728555223c98630180c2f642cc7e369424bd8a isn't in a stable tag yet and I was using the Arch Linux package instead of the latest revision.
110
111 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2024-01-16 21:31](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/100#issuecomment-1894544028):
112
113 Right! 
114 I'll create a new tag very soon, and this will get into the new release of the tool.
115
116
117 -------------------------------------------------------------------------------
118
119 # [\#99 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/99) `open`: skip CONFIG_DEBUG_NOTIFIERS requirement when CONFIG_CFI_CLANG is set with CONFIG_CFI_PERMISSIVE disabled
120 **Labels**: `enhancement`
121
122
123 #### <img src="https://avatars.githubusercontent.com/u/1505226?u=0edff17ad0c4acebbd8660dc1854229d526a6dc4&v=4" width="50">[thestinger](https://github.com/thestinger) opened issue at [2024-01-08 04:30](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/99):
124
125 CONFIG_DEBUG_NOTIFIERS only checks that the notifier function pointer is in kernel text. CFI already does that for everything that's not excluded from it. CONFIG_DEBUG_NOTIFIERS is obsolete when using CFI, and there should be no clear reason to enable it.
126
127 #### <img src="https://avatars.githubusercontent.com/u/1505226?u=0edff17ad0c4acebbd8660dc1854229d526a6dc4&v=4" width="50">[thestinger](https://github.com/thestinger) commented at [2024-01-16 20:27](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/99#issuecomment-1894462962):
128
129 This is partly motivated by CONFIG_DEBUG_NOTIFIERS being buggy on some architectures. It works properly on x86 but we had issues with it on arm64 previously. It's the only user of `func_ptr_is_kernel_text` so there's little motivation for that function to work universally for such a niche feature that's no longer even useful if you use CFI. The whole feature is this:
130
131 ```c
132 #ifdef CONFIG_DEBUG_NOTIFIERS
133                 if (unlikely(!func_ptr_is_kernel_text(nb->notifier_call))) {
134                         WARN(1, "Invalid notifier called!");
135                         nb = next_nb;
136                         continue;
137                 }
138 #endif
139 ```
140
141 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2024-01-16 20:40](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/99#issuecomment-1894479180):
142
143 @thestinger, thanks for the idea!
144
145 Added the commit  https://github.com/a13xp0p0v/kernel-hardening-checker/commit/cd5bb8a0364e6a28b2d03a8ac0d7520194a9f07a.
146
147 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2024-01-16 20:42](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/99#issuecomment-1894481143):
148
149 One moment, you are right, CFI_PERMISSIVE should be disabled as well.
150
151 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2024-01-16 21:20](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/99#issuecomment-1894530696):
152
153 Added the commit https://github.com/a13xp0p0v/kernel-hardening-checker/commit/65ff79dbe2c36347283d71d3fa1959030bf6838f.
154
155 Now the verbose result for checking this config ...
156 ```
157 # CONFIG_DEBUG_NOTIFIERS is not set
158 CONFIG_CFI_CLANG=y
159 CONFIG_CFI_PERMISSIVE=y
160 ```
161 ... looks like that:
162 ```
163 -------------------------------------------------------------------------------------------------------------------------
164     <<< OR >>>                                                                             | FAIL: "is not set"
165 CONFIG_DEBUG_NOTIFIERS                  |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
166     <<< AND >>>                                                                            | FAIL: CONFIG_CFI_PERMISSIVE is not "is not set"
167 CONFIG_CFI_CLANG                        |kconfig|     y      |   kspp   | self_protection  | OK
168 CONFIG_CFI_PERMISSIVE                   |kconfig| is not set |   kspp   | self_protection  | FAIL: "y"
169 -------------------------------------------------------------------------------------------------------------------------
170 ```
171 And the verbose result of checking this config...
172 ```
173 # CONFIG_DEBUG_NOTIFIERS is not set
174 CONFIG_CFI_CLANG=y
175 # CONFIG_CFI_PERMISSIVE is not set
176 ```
177 ... looks like that:
178 ```
179 -------------------------------------------------------------------------------------------------------------------------
180     <<< OR >>>                                                                             | OK: CONFIG_CFI_CLANG is "y"
181 CONFIG_DEBUG_NOTIFIERS                  |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
182     <<< AND >>>                                                                            | OK
183 CONFIG_CFI_CLANG                        |kconfig|     y      |   kspp   | self_protection  | OK
184 CONFIG_CFI_PERMISSIVE                   |kconfig| is not set |   kspp   | self_protection  | OK
185 -------------------------------------------------------------------------------------------------------------------------
186 ```
187
188
189 -------------------------------------------------------------------------------
190
191 # [\#98 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/98) `closed`: skip CONFIG_SCHED_STACK_END_CHECK requirement when CONFIG_VMAP_STACK is set
192 **Labels**: `enhancement`
193
194
195 #### <img src="https://avatars.githubusercontent.com/u/1505226?u=0edff17ad0c4acebbd8660dc1854229d526a6dc4&v=4" width="50">[thestinger](https://github.com/thestinger) opened issue at [2024-01-08 04:20](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/98):
196
197 CONFIG_SCHED_STACK_END_CHECK only provides stack exhaustion detection after it's already too late and it can be bypassed. CONFIG_VMAP_STACK provides reliable detection of stack exhaustion and there shouldn't be any need for CONFIG_SCHED_STACK_END_CHECK with it.
198
199 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2024-01-16 20:08](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/98#issuecomment-1894435929):
200
201 Hello @thestinger,
202
203 As I remember, SCHED_STACK_END_CHECK checks the magic value at the end of the kernel thread stack, and VMAP_STACK adds guard pages near it. So they do a bit different things, but VMAP_STACK is more reliable.
204
205 I agree with your point.
206
207 Added the commit https://github.com/a13xp0p0v/kernel-hardening-checker/commit/c0fc9e89d7a21dfd734bc6c3b946f835493502ca.
208
209 #### <img src="https://avatars.githubusercontent.com/u/1505226?u=0edff17ad0c4acebbd8660dc1854229d526a6dc4&v=4" width="50">[thestinger](https://github.com/thestinger) commented at [2024-01-16 20:24](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/98#issuecomment-1894458928):
210
211 > As I remember, SCHED_STACK_END_CHECK checks the magic value at the end of the kernel thread stack, and VMAP_STACK adds guard pages near it. So they do a bit different things, but VMAP_STACK is more reliable.
212
213 Yes, SCHED_STACK_END_CHECK checks a magic value at certain times such as exiting the kernel back to userspace, at which point the exploit can already have succeeded. The attacker may also have been able to clobber the value so that it's not detected. VMAP_STACK directly detects it with memory protection, which combined with making sure no large stack frames or VLAs exist prevents an overflow past the guard.
214
215
216 -------------------------------------------------------------------------------
217
218 # [\#97 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/97) `open`: Get rid of CONFIG_DEBUG_CREDENTIALS
219 **Labels**: `enhancement`
220
221
222 #### <img src="https://avatars.githubusercontent.com/u/23581360?v=4" width="50">[Sporif](https://github.com/Sporif) opened issue at [2023-12-22 15:37](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/97):
223
224 This config has been removed recently.
225
226 [master](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ae1914174a63a558113e80d24ccac2773f9f7b2b) 
227
228 [stable](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-6.6.y&id=207f135d819344c03333246f784f6666e652e081)
229
230 #### <img src="https://avatars.githubusercontent.com/u/1505226?u=0edff17ad0c4acebbd8660dc1854229d526a6dc4&v=4" width="50">[thestinger](https://github.com/thestinger) commented at [2024-01-08 04:14](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/97#issuecomment-1880362163):
231
232 The checking tool isn't only for the most recent kernel versions, and this was a mildly useful hardening feature despite not being designed as one. It would be possible to do a much better job, but people use what's available upstream.
233
234 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2024-01-16 19:27](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/97#issuecomment-1894377361):
235
236 Thanks for the info!
237
238 Later, I'll add the dependency on the kernel version for the CONFIG_DEBUG_CREDENTIALS check.
239
240
241 -------------------------------------------------------------------------------
242
243 # [\#96 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/96) `open`: new tag?
244 **Labels**: `question`
245
246
247 #### <img src="https://avatars.githubusercontent.com/u/4741819?v=4" width="50">[asarubbo](https://github.com/asarubbo) opened issue at [2023-12-07 12:04](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/96):
248
249 Hello @a13xp0p0v
250
251 [kernel-hardening-checker](https://github.com/a13xp0p0v/kernel-hardening-checker) it's really a great work!
252
253 I have recently added it into the [Gentoo tree](https://github.com/gentoo/gentoo/commit/151491904fa748c04cdff48a3884d52e18da9c0a) and I noticed that a lot of commits have been done after the last tag. Would you mind to issue a new minor release?
254 Thanks a lot
255
256 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-12-09 05:54](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/96#issuecomment-1848252596):
257
258 Hello @asarubbo, thanks for kind words!
259
260 I'm currently preparing a new release of the tool.  A new tag will appear soon.
261
262
263 -------------------------------------------------------------------------------
264
265 # [\#95 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/95) `closed`: Check for module force loading?
266 **Labels**: `enhancement`
267
268
269 #### <img src="https://avatars.githubusercontent.com/u/89150207?v=4" width="50">[vobst](https://github.com/vobst) opened issue at [2023-12-07 08:30](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/95):
270
271 Would it make sense to check for `CONFIG_MODULE_FORCE_LOAD`? It could prevent attackers from loading slightly mismatching kernel modules. However, but it seems kind of redundant given that you already recommend disabling modules or enforcing signatures. Maybe it could be checked as a fall back if both stronger measures are disabled.
272
273 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-12-09 05:51](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/95#issuecomment-1848251810):
274
275 Hello @vobst, thanks for the idea.
276
277 Added [e5f804e](https://github.com/a13xp0p0v/kernel-hardening-checker/commit/e5f804ede6ea7f66f674c2825396c15c216c718d).
278
279
280 -------------------------------------------------------------------------------
281
282 # [\#94 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/94) `merged`: add --kernel-version option
283
284 #### <img src="https://avatars.githubusercontent.com/u/1485263?v=4" width="50">[ffontaine](https://github.com/ffontaine) opened issue at [2023-11-29 16:46](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/94):
285
286 `--kernel-version` option will extract the version in `/proc/version`. This is especially useful on embedded systems where `config.gz` doesn't always contain the kernel version
287
288 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-12-01 13:38](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/94#issuecomment-1836135013):
289
290 Hello @ffontaine,
291
292 Nice idea, thanks!
293
294 I would ask for some small changes.
295
296
297 -------------------------------------------------------------------------------
298
299 # [\#93 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/93) `open`: added wsl config
300 **Labels**: `enhancement`
301
302
303 #### <img src="https://avatars.githubusercontent.com/u/8870284?u=ec42118bfcab2ddd30e7fb094422d250164c3150&v=4" width="50">[mrkoykang](https://github.com/mrkoykang) opened issue at [2023-11-15 01:58](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/93):
304
305 added wsl config files
306
307 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-11-22 09:33](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/93#issuecomment-1822409439):
308
309 Hello @mrkoykang,
310
311 Thanks for the pull request.
312
313 1) These two kconfig files are mostly identical. How about adding only the more recent one?
314
315 2) Could you please add a link to this kconfig in [this file](https://github.com/a13xp0p0v/kernel-hardening-checker/blob/master/kernel_hardening_checker/config_files/links.txt)?
316
317 Thanks!
318
319
320 -------------------------------------------------------------------------------
321
322 # [\#92 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/92) `open`: new make hardening.config available
323 **Labels**: `question`
324
325
326 #### <img src="https://avatars.githubusercontent.com/u/77795961?v=4" width="50">[osevan](https://github.com/osevan) opened issue at [2023-11-06 00:09](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/92):
327
328 https://github.com/torvalds/linux/blob/master/kernel/configs/hardening.config
329
330 https://www.phoronix.com/news/Linux-6.7-Hardening
331
332 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-11-22 10:07](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/92#issuecomment-1822464512):
333
334 Hello @osevan,
335
336 Thanks for the links.
337
338 Need your opinion: how should `kernel-hardening-checker` use this new `make` target?
339
340 #### <img src="https://avatars.githubusercontent.com/u/4741819?v=4" width="50">[asarubbo](https://github.com/asarubbo) commented at [2023-12-19 07:51](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/92#issuecomment-1862276038):
341
342 > Need your opinion: how should `kernel-hardening-checker` use this new `make` target?
343
344 Not sure I have understood at all the question, but just port these option into `kernel-hardening-checker` and update them from time to time is an option?
345
346 I mean to just monitor changes like this https://github.com/torvalds/linux/commits/master/kernel/configs/hardening.config
347
348
349 -------------------------------------------------------------------------------
350
351 # [\#91 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/91) `open`: Modify requirements for Android configs
352 **Labels**: `enhancement`
353
354
355 #### <img src="https://avatars.githubusercontent.com/u/65050545?u=3d095cc7726e6bbf544ea4857c4223033ea90921&v=4" width="50">[petervanvugt](https://github.com/petervanvugt) opened issue at [2023-10-30 19:27](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/91):
356
357 Android configs require various things that are currently disallowed in this tool. We can use CONFIG_ANDROID to detect Android configs and generate reports with fewer positives that cannot/should not be changed.
358
359
360 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-11-22 09:35](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/91#issuecomment-1822411251):
361
362 Hello @petervanvugt,
363
364 Nice idea, thanks.
365
366 Let's discuss some details.
367
368
369 -------------------------------------------------------------------------------
370
371 # [\#90 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/90) `merged`: Use /usr/bin/env in shebangs
372
373 #### <img src="https://avatars.githubusercontent.com/u/7258858?u=c524720e2844ffa8a2aa67944fde5af54031e06d&v=4" width="50">[SuperSandro2000](https://github.com/SuperSandro2000) opened issue at [2023-10-05 22:41](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/90):
374
375 This is guaranteed to work everything including NixOS
376
377 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-10-16 04:34](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/90#issuecomment-1763710410):
378
379 Merged. Thanks, @SuperSandro2000!
380
381
382 -------------------------------------------------------------------------------
383
384 # [\#89 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/89) `open`: Fix a false positive in REFCOUNT_FULL in recent 5.4.x
385
386 #### <img src="https://avatars.githubusercontent.com/u/4372440?v=4" width="50">[hlein](https://github.com/hlein) opened issue at [2023-09-22 03:41](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/89):
387
388 Extend VersionCheck to be able to take a three-tuple, x.y.z kernel version in order to properly recognise 5.4.208 as when this became the default behavior and thus CONFIG_REFCOUNT_FULL disappeared.
389
390
391 Closes: https://github.com/a13xp0p0v/kernel-hardening-checker/issues/88
392
393 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-10-04 18:13](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/89#issuecomment-1747405606):
394
395 @hlein, thanks for your pull request.
396
397 I think you need to adapt  `detect_kernel_version()` to get the third number of the kernel version from the kconfig file.
398
399 One more aspect: you need to compare this number in the `check()` method of the `VersionCheck` class. Otherwise it will return wrong results.
400
401 #### <img src="https://avatars.githubusercontent.com/u/4372440?v=4" width="50">[hlein](https://github.com/hlein) commented at [2023-10-04 18:29](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/89#issuecomment-1747427507):
402
403 > @hlein, thanks for your pull request.
404
405 > I think you need to adapt `detect_kernel_version()` to get the third number of the kernel version from the kconfig file.
406
407 Oh, you are probably right. I didn't have access to the box or config in question any more, so fabricated some data I was testing against; my tests must have been incomplete / accidentally-successful.
408
409 > One more aspect: you need to compare this number in the `check()` method of the `VersionCheck` class. Otherwise it will return wrong results.
410
411 Oof, you're right. I think I had done things a different way before refactoring the `self.ver_expected_print` out, but then lost the check against `self.ver_expected[2]` when cleaning up. Ugh!
412
413
414 -------------------------------------------------------------------------------
415
416 # [\#88 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/88) `open`: False positive on CONFIG_REFCOUNT_FULL in recent 5.4.x kernels
417
418 #### <img src="https://avatars.githubusercontent.com/u/4372440?v=4" width="50">[hlein](https://github.com/hlein) opened issue at [2023-09-22 03:07](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/88):
419
420 Similar to https://github.com/a13xp0p0v/kernel-hardening-checker/issues/30, `CONFIG_REFCOUNT_FULL` was removed from 5.4.x kernels starting with v5.4.208, because full refcount became always-on, in this commit:
421
422 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.4.y&id=d0d583484d2ed9f5903edbbfa7e2a68f78b950b0
423
424 Currently we complain when it is not found, like:
425 `CONFIG_REFCOUNT_FULL      |kconfig|     y      |defconfig | self_protection  | FAIL: is not found`
426
427 I don't know an easier way to find which kernel first included that commit other than:
428
429 ```
430 $ egrep url .git/config 
431         url = https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
432 $ git tag --contains d0d583484d2ed9f5903edbbfa7e2a68f78b950b0 | head -n2
433 v5.4.208
434 v5.4.209
435 ```
436 I think the fix is to return OK for 5.4.x where x >= 208.
437
438 Except... that's done via `VersionCheck` in `engine.py` which, if I'm reading it right, takes only major and minor versions, no third parameter:
439
440 ```
441 class VersionCheck:
442     def __init__(self, ver_expected):
443         assert(ver_expected and isinstance(ver_expected, tuple) and len(ver_expected) == 2), \
444                f'invalid version "{ver_expected}" for VersionCheck'
445 ```
446 So that function would have to be made a bit more flexible.
447
448 I don't know if other `CONFIG_*` knobs disappeared / became defaults in the middle of a given major.minor kernel version, but it would not surprise me.
449
450
451 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-10-04 17:58](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/88#issuecomment-1747385253):
452
453 Hello @hlein,
454
455 Thanks for your comment!
456
457 The REFCOUNT_FULL config option was removed from the mainline in the commit [fb041bb7c0a918b95c6889fc965cdc4a75b4c0ca](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v6.6-rc4&id=fb041bb7c0a918b95c6889fc965cdc4a75b4c0ca)
458
459 This commit appeared in the mainline kernel v5.5-rc1:
460 ```
461 $ cd linux/
462 $ git describe --match 'v*' --contains fb041bb7c0a918b95c6889fc965cdc4a75b4c0ca
463 v5.5-rc1~149^2~2
464 ```
465
466 The commit [d0d583484d2ed9f5903edbbfa7e2a68f78b950b0](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.4.y&id=d0d583484d2ed9f5903edbbfa7e2a68f78b950b0) is the backport of the upstream commit to the stable branch:
467 ```
468 $ cd linux-stable/
469 $ git describe --match 'v*' --contains d0d583484d2ed9f5903edbbfa7e2a68f78b950b0
470 v5.4.208~21
471 ```
472
473 I didn't find backports of this commit to other stable branches.
474
475 So, technically, it's not wrong to say that REFCOUNT_FULL was removed in v5.4.208 :) 
476
477 I'll take a look at your pull request. Thanks a lot!
478
479
480 -------------------------------------------------------------------------------
481
482 # [\#87 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/87) `open`: Add a check for IA32_EMULATION
483 **Labels**: `enhancement`
484
485
486 #### <img src="https://avatars.githubusercontent.com/u/325724?u=4446b76c0f4ebcbecb2678759f8d13817a67f85d&v=4" width="50">[jvoisin](https://github.com/jvoisin) opened issue at [2023-09-14 12:36](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/87):
487
488 As [reported by phoronix](https://www.phoronix.com/news/Linux-6.7-ia32_emulation-Boot), it's now possible to disable 32b support on amd64, to reduce attack surface.
489
490 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-11-22 10:09](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/87#issuecomment-1822468556):
491
492 Thanks @jvoisin,
493
494 This will be added in the next release of `kernel-hardening-checker`.
495
496 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-12-17 10:23](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/87#issuecomment-1859129322):
497
498 Hello @jvoisin,
499
500 The `ia32_emulation` boot param was introduced in Linux v6.7.
501
502 I'm currently preparing the `kernel-hardening-checker` release corresponding to the kernel v6.6.
503
504 So this boot option and `IA32_EMULATION_DEFAULT_DISABLED` will be added in the next release.
505
506 Thanks!
507
508
509 -------------------------------------------------------------------------------
510
511 # [\#86 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/86) `merged`: Add colors to output
512
513 #### <img src="https://avatars.githubusercontent.com/u/5826484?u=2cc3ddef5824379423495733759ef362d0600078&v=4" width="50">[frakman1](https://github.com/frakman1) opened issue at [2023-09-10 17:49](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/86):
514
515 Shows OK in green and FAIL in red
516
517 <img width="1047" alt="image" src="https://github.com/a13xp0p0v/kconfig-hardened-check/assets/5826484/d098d14f-2e1a-4569-af22-54ef2bc0eecb">
518
519 fixes #81
520
521 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-09-10 19:25](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/86#issuecomment-1712916729):
522
523 @frakman1, thanks for the pull request!
524
525 There are some small mistakes that break the tests.
526
527 Looking forward to your fixes.
528
529 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-09-11 18:25](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/86#issuecomment-1714376333):
530
531 Hello @frakman1, the CI tests are broken again.
532
533 Please see, the argument of `colorize_result()` may be None in the verbose mode of the tool.
534 So we need to add something like that at the beginning of the function:
535 ```
536     if input is None:
537         return input
538 ```
539
540 Also please fix two pylint warnings added by this PR:
541
542 1) W0311: Bad indentation. Found 17 spaces, expected 16 (bad-indentation)
543
544 2) W0622: Redefining built-in 'input' (redefined-builtin).
545 To fix this, you need to rename the argument of the function.
546
547 Thanks again!
548 Looking forward to the fixes.
549
550 #### <img src="https://avatars.githubusercontent.com/u/65553080?u=1e9e0de760ac0083c86dab588f627a0468cd714e&v=4" width="50">[codecov-commenter](https://github.com/codecov-commenter) commented at [2023-09-11 23:05](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/86#issuecomment-1714703072):
551
552 ## [Codecov](https://app.codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/86?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) Report
553 > Merging [#86](https://app.codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/86?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (374aee3) into [master](https://app.codecov.io/gh/a13xp0p0v/kconfig-hardened-check/commit/108eb7374967b0f66e70b68cca60a0548f12844c?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (108eb73) will **decrease** coverage by `1.32%`.
554 > The diff coverage is `87.50%`.
555
556 :exclamation: Your organization needs to install the [Codecov GitHub app](https://github.com/apps/codecov/installations/select_target) to enable full functionality.
557
558 ```diff
559 @@             Coverage Diff             @@
560 ##            master      #86      +/-   ##
561 ===========================================
562 - Coverage   100.00%   98.68%   -1.32%     
563 ===========================================
564   Files            6        5       -1     
565   Lines         1049      839     -210     
566   Branches       184      187       +3     
567 ===========================================
568 - Hits          1049      828     -221     
569 - Misses           0        5       +5     
570 - Partials         0        6       +6     
571 ```
572
573 | [Flag](https://app.codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/86/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) | Coverage Δ | |
574 |---|---|---|
575 | [engine_unit-test](https://app.codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/86/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) | `?` | |
576 | [functional_test](https://app.codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/86/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) | `98.68% <87.50%> (-0.23%)` | :arrow_down: |
577
578 Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov#carryforward-flags-in-the-pull-request-comment) to find out more.
579
580 | [Files Changed](https://app.codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/86?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) | Coverage Δ | |
581 |---|---|---|
582 | [kconfig\_hardened\_check/engine.py](https://app.codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/86?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov#diff-a2NvbmZpZ19oYXJkZW5lZF9jaGVjay9lbmdpbmUucHk=) | `94.58% <87.50%> (-5.42%)` | :arrow_down: |
583
584 ... and [1 file with indirect coverage changes](https://app.codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/86/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov)
585
586 :mega: We’re building smart automated test selection to slash your CI/CD build times. [Learn more](https://about.codecov.io/iterative-testing/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov)
587
588 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-09-12 17:40](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/86#issuecomment-1716159903):
589
590 @frakman1, thanks for the fixes!
591
592 I think we should better add colors to the `stdout_result` in the unit tests instead of filtering them out before `assertEqual()`.
593
594 That would allow to test that `colorize_result()` works as expected.
595
596 #### <img src="https://avatars.githubusercontent.com/u/5826484?u=2cc3ddef5824379423495733759ef362d0600078&v=4" width="50">[frakman1](https://github.com/frakman1) commented at [2023-09-12 22:12](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/86#issuecomment-1716580970):
597
598 I'm sorry, this is outside the scope of my knowledge or effort. Not intersted in re-writing test cases.
599
600 #### <img src="https://avatars.githubusercontent.com/u/5826484?u=2cc3ddef5824379423495733759ef362d0600078&v=4" width="50">[frakman1](https://github.com/frakman1) commented at [2023-09-13 22:14](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/86#issuecomment-1718385583):
601
602 Thank you!
603
604 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-09-13 22:50](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/86#issuecomment-1718412639):
605
606 Added f8f7033.
607
608 Thanks for you contribution, @frakman1!
609
610
611 -------------------------------------------------------------------------------
612
613 # [\#85 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/85) `merged`: Rename kconfig-hardened-check into kernel-hardening-checker
614
615 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) opened issue at [2023-09-10 12:18](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/85):
616
617 **kconfig-hardened-check** is a tool for checking the security hardening options of the Linux kernel.
618
619 In addition to Kconfig options, it now can check kernel cmdline arguments and sysctl parameters.
620
621 It's time to give this project a new name that describes it better: **kernel-hardening-checker**.
622
623 #### <img src="https://avatars.githubusercontent.com/u/65553080?u=1e9e0de760ac0083c86dab588f627a0468cd714e&v=4" width="50">[codecov-commenter](https://github.com/codecov-commenter) commented at [2023-09-10 12:19](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/85#issuecomment-1712799348):
624
625 ## [Codecov](https://app.codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/85?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) Report
626 > Merging [#85](https://app.codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/85?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (032f67f) into [master](https://app.codecov.io/gh/a13xp0p0v/kconfig-hardened-check/commit/f8e47e12ddf6b5c7b7562af6b85b8f65481e4b07?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (f8e47e1) will **decrease** coverage by `0.04%`.
627 > The diff coverage is `n/a`.
628
629 :exclamation: Your organization needs to install the [Codecov GitHub app](https://github.com/apps/codecov/installations/select_target) to enable full functionality.
630
631 ```diff
632 @@            Coverage Diff             @@
633 ##           master      #85      +/-   ##
634 ==========================================
635 - Coverage   99.81%   99.77%   -0.04%     
636 ==========================================
637   Files           6        2       -4     
638   Lines        1087      451     -636     
639   Branches      174        0     -174     
640 ==========================================
641 - Hits         1085      450     -635     
642   Misses          1        1              
643 + Partials        1        0       -1     
644 ```
645
646 | [Flag](https://app.codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/85/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) | Coverage Δ | |
647 |---|---|---|
648 | [engine_unit-test](https://app.codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/85/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) | `99.77% <ø> (ø)` | |
649 | [functional_test](https://app.codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/85/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) | `?` | |
650
651 Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov#carryforward-flags-in-the-pull-request-comment) to find out more.
652
653 | [Files Changed](https://app.codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/85?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) | Coverage Δ | |
654 |---|---|---|
655 | [kernel\_hardening\_checker/engine.py](https://app.codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/85?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov#diff-a2VybmVsX2hhcmRlbmluZ19jaGVja2VyL2VuZ2luZS5weQ==) | `99.50% <ø> (ø)` | |
656 | [kernel\_hardening\_checker/test\_engine.py](https://app.codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/85?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov#diff-a2VybmVsX2hhcmRlbmluZ19jaGVja2VyL3Rlc3RfZW5naW5lLnB5) | `100.00% <ø> (ø)` | |
657
658 ... and [4 files with indirect coverage changes](https://app.codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/85/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov)
659
660 :mega: We’re building smart automated test selection to slash your CI/CD build times. [Learn more](https://about.codecov.io/iterative-testing/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov)
661
662
663 -------------------------------------------------------------------------------
664
665 # [\#84 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/84) `open`: Add RDK Linux Hardening specification flags
666 **Labels**: `question`
667
668
669 #### <img src="https://avatars.githubusercontent.com/u/5826484?u=2cc3ddef5824379423495733759ef362d0600078&v=4" width="50">[frakman1](https://github.com/frakman1) opened issue at [2023-09-01 12:48](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/84):
670
671 The [RDK Linux Hardening specification](https://developer.rdkcentral.com/documentation/documentation/licensee_specific_subsystems/rdk_security_concepts/rdk_software_security_specifications/rdk_linux_hardening_specification/) lists many flags that are not checked in this tool. The first five I looked for were not there: `CONFIG_DEBUG_KERNEL` `CONFIG_MARKERS` `CONFIG_DEBUG_MEMLEAK` and `CONFIG_ELF_CORE`
672
673 Perhaps these can be added as part of a new 'RDK security policy' check for the 'decision' column
674
675 #### <img src="https://avatars.githubusercontent.com/u/5826484?u=2cc3ddef5824379423495733759ef362d0600078&v=4" width="50">[frakman1](https://github.com/frakman1) commented at [2023-09-05 14:23](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/84#issuecomment-1706723756):
676
677 Link no longer appears to be up. I saved a cache for reference:
678
679 ----
680
681 RDK Linux Hardening specification 
682 Created on June 21, 2022 
683 1.      Ensure no hard-coded credentials are present in the clear
684 2.      Ensure compliance with Comcast specifications for crypto and TLS 
685 o       All STB connections to servers must be secured using TLS 1.2 or above, and verified to be correctly performing server certificate chain validation
686 3.      Build with stack-smashing (at least for modules implementing security) 
687 o       Enable CONFIG_CC_STACKPROTECTOR, -fstack-protector-all, -Wstack-protector
688 o       Libc function buffer overrun checks: _FORTIFY_SOURCE=2
689 o       Initial requirement would be to enable this for all security sensitive modules with follow up to enable for the entire build.
690 4.      Scan all non-OSS sources with static analyzer
691 5.      Network port blocking 
692 o       All ports not specifically used must be blocked by ipTables rules 
693 6.      Disable all unused devices (USB, Bluetooth, etc)
694 7.      Implement multiuser/sandbox strategy (Restrict Linux process privileges) 
695 o       No applications/utilities within a sandbox should run as root or have any means to achieve root privileges.  Sandbox shall not contains hard links to outside files.  Every sandbox connected to external network shall contain its own firewall and shall be configured using a whitelist.
696 o       Configure processes to the minimum capabilities and resources required for their operation.  Have unique user and group own service components/applications that need to be isolated.  Users have permissions to access the required device files only.  Shared files are access controlled using group permissions. Default permissions for newly created files include read/write/exec permissions for the owner only.  Always use setresuid() and setresgid() functions to change the current user and group. Always confirm the change with getresuid() and getresgid() function.  Users and groups must have unique ID’s
697 o       In progress, containerization via LXC is being implemented for subset of RDK processes.  OEM may choose to use a technology other than LXC to sandbox their processes.
698 8.      Vet all open source 
699 o       Currently being done using Whitesource tool
700 9.      Disable kernel module load 
701 o       Making modules statically linked to the kernel would be a significant effort.
702 o       Disable module load after boot using /proc/sys/kernel/module_disabled 
703 10.     Disable kernel module unload 
704 o       Set CONFIG_MODULE_UNLOAD
705 11.     Kernel module parameters must be R/O or trusted 
706 o       Audit boot scripts to ensure loadable kernel module parameters are hard coded and don’t rely on data from persistent storage or other writable source
707 12.     Remove kernel debugging and profiling options 
708 o       CONFIG_DEBUG_KERNEL CONFIG_MARKERS CONFIG_DEBUG_MEMLEAK CONFIG_KPROBES
709 o       CONFIG_SLUB_DEBUG CONFIG_PROFILING CONFIG_DEBUG_FS CONFIG_KPTRACE
710 o       CONFIG_KALLSYMS CONFIG_LTT CONFIG_UNUSED_SYMBOLS CONFIG_TRACE_IRQFLAGS_SUPPORT
711 o       CONFIG_RELAY CONFIG_MAGIC_SYSRQ CONFIG_VM_EVENT_COUNTERS CONFIGU_UNWIND_INFO
712 o       CONFIG_BPA2_ALLOC_TRACE CONFIG_PRINTK
713 o       CONFIG_CRASH_DUMP CONFIG_BUG CONFIG_SCSI_LOGGING CONFIG_ELF_CORE CONFIG_FULL_PANIC
714 o       CONFIG_TASKSTATUS CONFIG_AUDIT CONFIG_BSD_PROCESS_ACCT CONFIG_KEXEC
715 o       CONFIG_EARLY_PRINTK CONFIG_IKCONFIG CONFIG_NETFILTER_DEBUG
716 o       CONFIG_MTD_UBI_DEBUG CONFIG_B43_DEBUG CONFIG_SSB_DEBUG CONFIG_FB_INTEL_DEBUG
717 o       CONFIG_TRACING CONFIG_PERF_EVENTS 
718 13.     Disable unused file system and block device support
719 14.     Enable heap protection and pointer obfuscation features. 
720 o       Enabled by default in glibc.  Protects heap from buffer overflows.  Available in glibc 2.3.4 or above, Enabled using environment variable malloc_check_
721 15.     Restrict /dev/mem to minimal regions of memory required
722 16.     Remove support for /dev/kmem
723 17.     Remove support for /dev/kcore 
724 o       Kernel core dumping should be disabled in production
725 18.     Enable format, buffer, and object size checks
726 19.     Restrict /proc to process owners (except for IDS)
727 20.     Disable kernel configfs 
728 o       Allows modification of kernel objects
729 21.     Remove ldconfig from target filesystem and [ld.so](http://ld.so/).conf and [ld.so](http://ld.so/).cache should be empty 
730 o       Removes caching of symbolic links.  Will cause a performance hit.
731 o       Impact: glibc changes. Would allow loading libraries from a non-standard library path even if we don’t use LD_LIBRARY_PATH.
732 22.     Security critical software are compiled as PIE (Position Independent Executable), if supported
733 23.     Kernel boots with “ro” in command line  
734 o       Mount filesystem as readonly. 
735 24.     Mount filesystems with minimal privileges. For example, filesystem containing no executable code shall have “noexec” option specified. 
736 25.     Mount temporary storage (/tmp) shall in dedicated filesystem (eg. tmpfs) and its contents does not survive reboots
737 26.     Flush cache after accessing sensitive data
738 27.     No overlay of writable mounts on read-only data 
739 28.     system directories such as /proc or /dev shall not be writable within a sandbox
740 29.     Applications and utilities shall not have the setgid or setuid bit set
741 30.     Configure default shell to /dev/null
742 31.     Remove all unused executables and libraries
743 32.     Disable PTRACE, General restriction on PTRACE should be applied at kernel level with Yama LSM  
744 o       http://linux-audit.com/protect-ptrace-processes-kernel-yama-ptrace_scope/ 
745 o       PTRACE is used by GDB.  Disable only for production builds.  Both compile time and runtime changes required (can restrict PTRACE to root if required)
746 33.     Don’t use LD_LIBRARY_PATH (loads libraries from default locations only)
747 34.     Full runtime path for non-standard libraries included in code image 
748 o       Use -rpath and -rpath-link
749 35.     Mount filesystems with ro option and change permission temporarily when needed
750 36.     Kernel init parameters / command line must be R/O and trusted
751 37.     Restrict kernel syslog (dmesg) to root user only
752 38.     Disable kernel debugfs 
753 o       Part of sysfs used to enable kernel debug messaging.  If printk is disabled this becomes irrelevant
754 39.     Use ELF format only 
755 o       May break scripts like Python
756 40.     Dynamic linker configuration changes 
757 o       Remove LD_DEBUG support from dynamic linker 
758 o       Remove LD_PRELOAD support from dynamic linker 
759 o       Remove LD_PROFILE support from the dynamic linker 
760 o       Remove LD_AUDIT support from the dynamic linker 
761 o       Remove LD_SHOW_AUXV support from the dynamic linker
762 o       Remove LD_TRACE_LOADED_OBJECTS support from the dynamic linker 
763 o       Link dynamic programs with -z now and -z relro options 
764 41.     Hide restricted kernel pointers 
765 o       Restricted pointers replaced with 0’s.
766 o       Relates to printk handling of printing pointer values.  This is a runtime setting, enable/disable via /proc/sys/kernel/kptr_restrict
767 42.     Review use of SYSFS, disable it if possible
768 43.     Mark unchanging files in writable partition with “immutable”
769 44.     Use all compiler security features 
770 o       Compile -wall, -Werror and fail on warnings (and possibly -Wextra)
771 45.     Replace strcpy with strncpy 
772 o       All code should use safer, bounds checking versions of string library functions (such as strncpy instead of strcpy) to avoid potential buffer overruns.
773 46.     Prevent file races, open temp files with O_CREAT | O_EXCL 
774 o       Makes check for file existence and creation atomic.  Prevents multiple threads creating same file. 
775 47.     Set sticky bit for temporary directories to prevent acc
776 idental deletion
777 o       Only owner and root can delete directory
778 48.     Restrict kernel network settings to be the most restrictive possible
779 49.     Limit temporary storage (tmpfs) memory size 
780 50.     Enable kernel ABI Version Check
781 51.     Disable kernel symbol resolution 
782 o       Disable CONFIG_KALLSYMS
783 o       Limits our ability to debug kernel crash dumps
784 52.     Disable kernel crashdump 
785 o       Disable CONFIG_CRASH_DUMP 
786 53.     Minimum MMAPable address set to 4K min. 
787 o       This prevents mapping NULL address
788
789 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-11-22 10:16](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/84#issuecomment-1822479661):
790
791 Need to compare these recommendations with the current `kernel-hardening-checker` rules.
792
793 Gonna do that after preparing the next release of the tool.
794
795
796 -------------------------------------------------------------------------------
797
798 # [\#83 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/83) `closed`: Enhancement add kmalloc hardening
799 **Labels**: `enhancement`
800
801
802 #### <img src="https://avatars.githubusercontent.com/u/77795961?v=4" width="50">[osevan](https://github.com/osevan) opened issue at [2023-08-29 23:53](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/83):
803
804 https://www.phoronix.com/news/Linux-Randomize-Kmalloc-Cache
805
806 Thanks and
807 Best regards
808
809 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-09-03 15:45](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/83#issuecomment-1704338755):
810
811 @osevan, thanks!
812 I'll consider it during preparing the next release of the tool.
813
814 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-12-16 23:42](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/83#issuecomment-1858987573):
815
816 Done! Thanks @osevan.
817
818
819 -------------------------------------------------------------------------------
820
821 # [\#82 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/82) `closed`: Consider removing/not recommending CONFIG_ZERO_CALL_USED_REGS
822 **Labels**: `question`
823
824
825 #### <img src="https://avatars.githubusercontent.com/u/325724?u=4446b76c0f4ebcbecb2678759f8d13817a67f85d&v=4" width="50">[jvoisin](https://github.com/jvoisin) opened issue at [2023-05-08 12:38](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/82):
826
827 CONFIG_ZERO_CALL_USED_REGS is [useless at best](https://dustri.org/b/paper-notes-clean-the-scratch-registers-a-way-to-mitigate-return-oriented-programming-attacks.html), with a **significant** performance impact.
828
829 This is a security theatre knob, and the performance budget would be better spent elsewhere.
830
831 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-09-03 15:52](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/82#issuecomment-1704340181):
832
833 @jvoisin, thanks for the article!
834 It looks reasonable, we'll discuss it.
835
836
837 -------------------------------------------------------------------------------
838
839 # [\#81 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/81) `closed`: Color indicators for "check result" column
840 **Labels**: `enhancement`
841
842
843 #### <img src="https://avatars.githubusercontent.com/u/4941656?v=4" width="50">[harisphnx](https://github.com/harisphnx) opened issue at [2023-04-27 13:16](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/81):
844
845 Would the maintainers be open to adding colors to the output of the "check result" column? For example, the output would be red for FAIL, and green for OK?
846
847 #### <img src="https://avatars.githubusercontent.com/u/4941656?v=4" width="50">[harisphnx](https://github.com/harisphnx) commented at [2023-04-27 13:17](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/81#issuecomment-1525681451):
848
849 If so, I can make the change and create a PR
850
851 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-05-07 16:41](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/81#issuecomment-1537488610):
852
853 Yes, it would be nice.
854 Looking forward to your PR.
855
856 #### <img src="https://avatars.githubusercontent.com/u/5826484?u=2cc3ddef5824379423495733759ef362d0600078&v=4" width="50">[frakman1](https://github.com/frakman1) commented at [2023-09-01 17:04](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/81#issuecomment-1703069739):
857
858 Has anyone done this yet?
859 I made a hacky attempt of this last year before the `sysctl` support was added. I added different colors for the two sections too:
860
861 <img width="1282" alt="image" src="https://github.com/a13xp0p0v/kconfig-hardened-check/assets/5826484/e880006a-5f1d-4580-b3e2-dcc0b104b089">
862
863 I just tried to overlay it onto the latest code but it's too different now. My changes were in `kconfig_hardened_check/__init__.py` but everything has moved since then. Unfortunately, not an easy merge.
864
865 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-09-03 15:40](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/81#issuecomment-1704337689):
866
867 @frakman1 thanks, it looks nice.
868 Could you give a link to your commit? I'll help to rebase it.
869
870 #### <img src="https://avatars.githubusercontent.com/u/5826484?u=2cc3ddef5824379423495733759ef362d0600078&v=4" width="50">[frakman1](https://github.com/frakman1) commented at [2023-09-03 16:16](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/81#issuecomment-1704345063):
871
872 Thank you @a13xp0p0v. 
873 I just checked and my changes were based on [this](https://github.com/a13xp0p0v/kconfig-hardened-check/blob/899752c13f4d1260d1a33985672b72b3a9cb60ec/kconfig_hardened_check/__init__.py) commit:
874 ```
875 * 899752c - (Sun Oct 2 21:45:13 2022 +0300) Also check 'nospectre_v2' with 'spectre_v2' - <Alexander Popov> (HEAD -> master, origin/master, origin/HEAD)
876 ```
877 Unfortunately, I never commited it and just stashed it before doing a `git pull`
878
879 Original File (rename to .py):
880 [__init__.txt](https://github.com/a13xp0p0v/kconfig-hardened-check/files/12506520/__init__.txt)
881
882
883 Colored File (rename to .py):
884 [__init__.color.txt](https://github.com/a13xp0p0v/kconfig-hardened-check/files/12506521/__init__.color.txt)
885
886 I created a patch file using:
887 ```
888 git diff --no-index --patch --output=color.diff __init__.py __init__.color.py
889 ```
890
891 patch file (optionally rename to .diff):
892 [color.txt](https://github.com/a13xp0p0v/kconfig-hardened-check/files/12506530/color.txt)
893
894 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-09-03 19:51](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/81#issuecomment-1704387355):
895
896 Thanks, I see the approach.
897
898 Let's print OK results in green and FAIL results in red.
899
900 We need to modify the `table_print()` method of classes in [engine.py](https://github.com/a13xp0p0v/kconfig-hardened-check/blob/master/kconfig_hardened_check/engine.py).
901
902 I would recommend something like that:
903
904 1) defining ANSI escape sequences at the beginning of the file:
905 ```
906 GREEN_COLOR = '\x1b[32m'
907 RED_COLOR = '\x1b[31m'
908 COLOR_END = '\x1b[0m'
909 ```
910
911 2) modify printing methods this way:
912 ```
913 if with_results:
914     if self.result.startswith('OK'):
915         color = GREEN_COLOR
916     elif self.result.startswith('FAIL:'):
917         color = RED_COLOR
918     else:
919         assert(False), f'unexpected result "{self.result}"'
920     colored_result = f'{color}{self.result}{COLOR_END}'
921     print(f'| {colored_result}', end='')
922 ```
923
924 What do you think?
925 Would you like to prepare a pull request?
926
927 Thanks!
928
929 #### <img src="https://avatars.githubusercontent.com/u/141440559?u=a2256f43745996b332a33cc986eb796c084caed2&v=4" width="50">[trclst](https://github.com/trclst) commented at [2023-09-03 23:34](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/81#issuecomment-1704435599):
930
931 I would only going to color `OK `and `FAIL` not full line.
932 Besides, I don't know if there aren't more important things a `| grep FAIL` can do.
933 Maybe it is better to keep the code small, the information is still there whether in color or not.
934 Anyway hope it looks fancy.
935
936 #### <img src="https://avatars.githubusercontent.com/u/5826484?u=2cc3ddef5824379423495733759ef362d0600078&v=4" width="50">[frakman1](https://github.com/frakman1) commented at [2023-09-04 05:16](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/81#issuecomment-1704624719):
937
938 If you only want to see the failures, you can use the `-m show_fail` option
939
940 #### <img src="https://avatars.githubusercontent.com/u/5826484?u=2cc3ddef5824379423495733759ef362d0600078&v=4" width="50">[frakman1](https://github.com/frakman1) commented at [2023-09-04 18:33](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/81#issuecomment-1705607069):
941
942 > What do you think? Would you like to prepare a pull request?
943
944 I like it. Thank you for the guidance. I just attempted it and it seems I have to repeat that logic in three places before I could get all the prints.
945
946 sample output:
947
948 <img width="1047" alt="image" src="https://github.com/a13xp0p0v/kconfig-hardened-check/assets/5826484/d098d14f-2e1a-4569-af22-54ef2bc0eecb">
949
950 Diffs located in my fork ~~[here](https://github.com/frakman1/kconfig-hardened-check/compare/108eb7374967b0f66e70b68cca60a0548f12844c...71c8e35842b805e8e6b819bf599b07fdd0d48479)~~
951
952 @a13xp0p0v Let me know if that looks good. If so, I will issue a pull request.
953
954 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-09-09 16:56](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/81#issuecomment-1712554168):
955
956 Thanks @frakman1 !
957
958 I would propose creating a function `colorize_result()` and call several times to avoid copying the code.
959
960 #### <img src="https://avatars.githubusercontent.com/u/5826484?u=2cc3ddef5824379423495733759ef362d0600078&v=4" width="50">[frakman1](https://github.com/frakman1) commented at [2023-09-09 18:20](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/81#issuecomment-1712570988):
961
962 I've updated the code with your recommendations. See changes [here](https://github.com/frakman1/kconfig-hardened-check/commit/fb9aeb5392762c6ea3aa67096a18e163e63ec6ea)
963
964 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-09-09 19:17](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/81#issuecomment-1712582213):
965
966 I've left some comments. The main point: it's better to leave printing inside of the `table_print()` method. The `colorize_result()` function should only return the colored string.
967
968 #### <img src="https://avatars.githubusercontent.com/u/5826484?u=2cc3ddef5824379423495733759ef362d0600078&v=4" width="50">[frakman1](https://github.com/frakman1) commented at [2023-09-09 21:12](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/81#issuecomment-1712623127):
969
970 Changes applied [here](https://github.com/frakman1/kconfig-hardened-check/compare/108eb7374967b0f66e70b68cca60a0548f12844c..b317b9f)
971
972 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-09-10 11:04](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/81#issuecomment-1712783879):
973
974 Good!
975
976 Please remove the unneeded whitespaces and send the pull request.
977
978 Looking forward to it.
979
980 #### <img src="https://avatars.githubusercontent.com/u/5826484?u=2cc3ddef5824379423495733759ef362d0600078&v=4" width="50">[frakman1](https://github.com/frakman1) commented at [2023-09-10 17:49](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/81#issuecomment-1712896232):
981
982 Done.
983 https://github.com/a13xp0p0v/kconfig-hardened-check/pull/86
984
985
986 -------------------------------------------------------------------------------
987
988 # [\#80 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/80) `merged`: Added support for gzipped config (eg. /proc/config.gz)
989
990 #### <img src="https://avatars.githubusercontent.com/u/3389586?u=71aa9a963297407bb515b073245e398e8049d582&v=4" width="50">[nE0sIghT](https://github.com/nE0sIghT) opened issue at [2023-03-25 09:41](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/80):
991
992
993
994 #### <img src="https://avatars.githubusercontent.com/u/65553080?u=1e9e0de760ac0083c86dab588f627a0468cd714e&v=4" width="50">[codecov-commenter](https://github.com/codecov-commenter) commented at [2023-03-26 15:02](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/80#issuecomment-1484123415):
995
996 ## [Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/80?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) Report
997 > Merging [#80](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/80?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (8def541) into [master](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/commit/b65af76d6e84b4cd80f4fb4c72799bdd49237024?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (b65af76) will **decrease** coverage by `0.24%`.
998 > The diff coverage is `80.00%`.
999
1000 :mega: This organization is not using Codecov’s [GitHub App Integration](https://github.com/apps/codecov). We recommend you install it so Codecov can continue to function properly for your repositories. [Learn more](https://about.codecov.io/blog/codecov-is-updating-its-github-integration/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov)
1001
1002 ```diff
1003 @@            Coverage Diff             @@
1004 ##           master      #80      +/-   ##
1005 ==========================================
1006 - Coverage   98.39%   98.16%   -0.24%     
1007 ==========================================
1008   Files           6        6              
1009   Lines         812      818       +6     
1010   Branches      160      161       +1     
1011 ==========================================
1012 + Hits          799      803       +4     
1013 - Misses          7        8       +1     
1014 - Partials        6        7       +1     
1015 ```
1016
1017 | Flag | Coverage Δ | |
1018 |---|---|---|
1019 | engine_unit-test | `76.80% <ø> (ø)` | |
1020 | functional_test | `97.97% <80.00%> (-0.26%)` | :arrow_down: |
1021
1022 Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov#carryforward-flags-in-the-pull-request-comment) to find out more.
1023
1024 | [Impacted Files](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/80?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) | Coverage Δ | |
1025 |---|---|---|
1026 | [kconfig\_hardened\_check/\_\_init\_\_.py](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/80?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov#diff-a2NvbmZpZ19oYXJkZW5lZF9jaGVjay9fX2luaXRfXy5weQ==) | `99.10% <80.00%> (-0.90%)` | :arrow_down: |
1027
1028 :mega: We’re building smart automated test selection to slash your CI/CD build times. [Learn more](https://about.codecov.io/iterative-testing/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov)
1029
1030 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-03-26 16:01](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/80#issuecomment-1484141857):
1031
1032 Hello @nE0sIghT,
1033
1034 I've merged your pull request and added:
1035  - informing about supporting *.gz kconfig files,
1036  - functional testing of this feature.
1037
1038 Thanks!
1039 Alexander
1040
1041
1042 -------------------------------------------------------------------------------
1043
1044 # [\#79 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/79) `closed`: Create unit-tests for the engine checking the correctness
1045 **Labels**: `enhancement`
1046
1047
1048 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) opened issue at [2023-03-06 08:03](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/79):
1049
1050 That would prevent the bug in cb779a71bf57d95b. See the fix d006bfa48e87.
1051
1052 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-04-02 12:51](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/79#issuecomment-1493323795):
1053
1054 Good. This task is completed.
1055
1056 Unit-tests for the `kconfig-hardened-check` engine are created:
1057 [kconfig_hardened_check/test_engine.py](https://github.com/a13xp0p0v/kconfig-hardened-check/blob/master/kconfig_hardened_check/test_engine.py)
1058
1059 CI performs unit-testing on each repository push:
1060 https://github.com/a13xp0p0v/kconfig-hardened-check/actions/workflows/engine_unit-test.yml
1061
1062 These unit-tests check the correctness of the engine results and cover 100% of the engine code.
1063
1064 Reverting the aforementioned fix https://github.com/a13xp0p0v/kconfig-hardened-check/commit/d006bfa48e87600e70aae1a696ede3182f6c1cbd is detected by these unit-tests:
1065 ```
1066 ======================================================================
1067 FAIL: test_simple_kconfig (kconfig_hardened_check.test_engine.TestEngine)
1068 ----------------------------------------------------------------------
1069 Traceback (most recent call last):
1070   File "/home/a13x/land/Develop/Linux_Kernel/kconfig-hardened-check/kconfig_hardened_check/test_engine.py", line 130, in test_simple_kconfig
1071     self.assertEqual(
1072 AssertionError: Lists differ: [['CO[701 chars]8', 'OK: is not off, "off"'], ['CONFIG_NAME_9'[169 chars]nd']] != [['CO[701 chars]8', 'FAIL: is off'], ['CONFIG_NAME_9', 'kconfi[160 chars]nd']]
1073
1074 First differing element 7:
1075 ['CON[25 chars]is not off', 'decision_8', 'reason_8', 'OK: is not off, "off"']
1076 ['CON[25 chars]is not off', 'decision_8', 'reason_8', 'FAIL: is off']
1077 ```
1078
1079
1080 -------------------------------------------------------------------------------
1081
1082 # [\#78 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/78) `closed`: Fix nixos integration
1083
1084 #### <img src="https://avatars.githubusercontent.com/u/96200?u=9ed15c85825694d00e996d605d728179b830c4fa&v=4" width="50">[Mic92](https://github.com/Mic92) opened issue at [2022-12-29 10:00](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/78):
1085
1086
1087
1088 #### <img src="https://avatars.githubusercontent.com/u/65553080?u=1e9e0de760ac0083c86dab588f627a0468cd714e&v=4" width="50">[codecov-commenter](https://github.com/codecov-commenter) commented at [2022-12-29 10:02](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/78#issuecomment-1367203889):
1089
1090 # [Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/78?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) Report
1091 > Merging [#78](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/78?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (6fde9d6) into [master](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/commit/6211b6852b6b35f6f5d18ec2f0e713d2afea5a87?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (6211b68) will **increase** coverage by `0.40%`.
1092 > The diff coverage is `n/a`.
1093
1094 ```diff
1095 @@            Coverage Diff             @@
1096 ##           master      #78      +/-   ##
1097 ==========================================
1098 + Coverage   92.79%   93.20%   +0.40%     
1099 ==========================================
1100   Files           3        3              
1101   Lines         736      736              
1102   Branches      171      171              
1103 ==========================================
1104 + Hits          683      686       +3     
1105 + Misses         26       24       -2     
1106 + Partials       27       26       -1     
1107 ```
1108
1109 | Flag | Coverage Δ | |
1110 |---|---|---|
1111 | functional_test | `93.20% <ø> (+0.40%)` | :arrow_up: |
1112
1113 Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov#carryforward-flags-in-the-pull-request-comment) to find out more.
1114
1115 | [Impacted Files](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/78?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) | Coverage Δ | |
1116 |---|---|---|
1117 | [kconfig\_hardened\_check/\_\_init\_\_.py](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/78/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov#diff-a2NvbmZpZ19oYXJkZW5lZF9jaGVjay9fX2luaXRfXy5weQ==) | `93.25% <0.00%> (+0.41%)` | :arrow_up: |
1118
1119 :mega: We’re building smart automated test selection to slash your CI/CD build times. [Learn more](https://about.codecov.io/iterative-testing/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov)
1120
1121 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-01-19 19:58](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/78#issuecomment-1397525515):
1122
1123 Hello @Mic92,
1124
1125 Closing, this issue has been fixed in https://github.com/a13xp0p0v/kconfig-hardened-check/pull/77.
1126
1127 Thanks!
1128
1129
1130 -------------------------------------------------------------------------------
1131
1132 # [\#77 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/77) `merged`: add get-nixos-kconfig nix script
1133
1134 #### <img src="https://avatars.githubusercontent.com/u/106462796?v=4" width="50">[o8opi](https://github.com/o8opi) opened issue at [2022-12-29 09:15](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/77):
1135
1136 Hello,
1137
1138 This nix script, when run with `nix-build get-nixos-kconfig.nix` will output 3 kernel configuration files (linux_latest, linux_hardened, and the linux_lts)  for NixOS
1139
1140 Has been tested on Ubuntu 20.04
1141
1142 #63  relevant
1143
1144 #### <img src="https://avatars.githubusercontent.com/u/65553080?u=1e9e0de760ac0083c86dab588f627a0468cd714e&v=4" width="50">[codecov-commenter](https://github.com/codecov-commenter) commented at [2023-01-19 15:00](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/77#issuecomment-1397110519):
1145
1146 # [Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/77?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) Report
1147 > Merging [#77](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/77?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (6149a3e) into [master](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/commit/6211b6852b6b35f6f5d18ec2f0e713d2afea5a87?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (6211b68) will **not change** coverage.
1148 > The diff coverage is `n/a`.
1149
1150 ```diff
1151 @@           Coverage Diff           @@
1152 ##           master      #77   +/-   ##
1153 =======================================
1154   Coverage   92.79%   92.79%           
1155 =======================================
1156   Files           3        3           
1157   Lines         736      736           
1158   Branches      171      171           
1159 =======================================
1160   Hits          683      683           
1161   Misses         26       26           
1162   Partials       27       27           
1163 ```
1164
1165 | Flag | Coverage Δ | |
1166 |---|---|---|
1167 | functional_test | `92.79% <ø> (ø)` | |
1168
1169 Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov#carryforward-flags-in-the-pull-request-comment) to find out more.
1170
1171
1172 :mega: We’re building smart automated test selection to slash your CI/CD build times. [Learn more](https://about.codecov.io/iterative-testing/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov)
1173
1174 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-01-19 16:06](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/77#issuecomment-1397219216):
1175
1176 Thanks a lot, @o8opi!
1177
1178 It's merged.
1179
1180 I also generated the NixOS kernel configs using `nix-build get-nixos-kconfig.nix`: https://github.com/a13xp0p0v/kconfig-hardened-check/commit/0267c39d10364e2afb0779f2ce271539eff6f4e1
1181
1182
1183 -------------------------------------------------------------------------------
1184
1185 # [\#76 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/76) `closed`: iommu=force
1186
1187 #### <img src="https://avatars.githubusercontent.com/u/74207682?u=fc82f6c725c4a6a1e0e8786b3ecee80b18118c92&v=4" width="50">[d4rklynk](https://github.com/d4rklynk) opened issue at [2022-12-13 17:58](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/76):
1188
1189 It seems it helps indirectly from DMA attacks (from what I understand). It is recommended by ANSSI.
1190
1191 From this [PDF](https://www.ssi.gouv.fr/uploads/2019/02/fr_np_linux_configuration-v2.0.pdf) (in french) at the chapter "**5.2.1 Configuration de la mémoire**"
1192
1193 Or from this [older version](https://www.ssi.gouv.fr/uploads/2019/03/linux_configuration-en-v1.2.pdf) of the same PDF but in english : chapter "**4.3 IOMMU Service (input/output virtualization)**"
1194
1195 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-01-21 22:03](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/76#issuecomment-1399341218):
1196
1197 Added this check in https://github.com/a13xp0p0v/kconfig-hardened-check/commit/4e0065c8baf8d40c733f7f4c5c920c07b93c55b6
1198
1199 Thanks, @d4rklynk!
1200
1201
1202 -------------------------------------------------------------------------------
1203
1204 # [\#75 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/75) `closed`: Integrity Measurement Architecture 
1205 **Labels**: `question`
1206
1207
1208 #### <img src="https://avatars.githubusercontent.com/u/97197406?u=3fc2e7c1b9d9f1b9b1c8e7268aaa11204944694e&v=4" width="50">[JohnVengert](https://github.com/JohnVengert) opened issue at [2022-11-14 04:40](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/75):
1209
1210 The Integrity Measurement Architecture is a subsystem that is responsible
1211  for calculating file hashes. this allows greater security . This option would be ideal
1212  to be integrated, 
1213
1214 Kernel Config -
1215
1216 ```
1217 CONFIG_IMA=y
1218 CONFIG_IMA_MEASURE_PCR_IDX=10
1219 CONFIG_IMA_LSM_RULES=y
1220 CONFIG_IMA_NG_TEMPLATE=y
1221 # CONFIG_IMA_SIG_TEMPLATE is not set
1222 CONFIG_IMA_DEFAULT_TEMPLATE="ima-ng"
1223 # CONFIG_IMA_DEFAULT_HASH_SHA1 is not set
1224 # CONFIG_IMA_DEFAULT_HASH_SHA256 is not set
1225 CONFIG_IMA_DEFAULT_HASH_SHA512=y
1226 CONFIG_IMA_DEFAULT_HASH="sha512"
1227 CONFIG_IMA_WRITE_POLICY=y
1228 CONFIG_IMA_READ_POLICY=y
1229 CONFIG_IMA_APPRAISE=y
1230 CONFIG_IMA_ARCH_POLICY=y
1231 CONFIG_IMA_APPRAISE_BUILD_POLICY=y
1232 CONFIG_IMA_APPRAISE_REQUIRE_FIRMWARE_SIGS=y
1233 CONFIG_IMA_APPRAISE_REQUIRE_KEXEC_SIGS=y
1234 CONFIG_IMA_APPRAISE_REQUIRE_MODULE_SIGS=y
1235 CONFIG_IMA_APPRAISE_REQUIRE_POLICY_SIGS=y
1236 CONFIG_IMA_APPRAISE_BOOTPARAM=y
1237 CONFIG_IMA_APPRAISE_MODSIG=y
1238 CONFIG_IMA_TRUSTED_KEYRING=y
1239 CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY=y
1240 CONFIG_IMA_BLACKLIST_KEYRING=y
1241 CONFIG_IMA_LOAD_X509=y
1242 CONFIG_IMA_X509_PATH="/etc/keys/x509_ima.der"
1243 CONFIG_IMA_APPRAISE_SIGNED_INIT is not set (This option breaks memory, do not select)
1244 CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS=y
1245 CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS=y
1246 CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT=y
1247 CONFIG_IMA_DISABLE_HTABLE=y
1248 CONFIG_EVM=y
1249 CONFIG_EVM_ATTR_FSUUID=y
1250 CONFIG_EVM_EXTRA_SMACK_XATTRS=y
1251 CONFIG_EVM_ADD_XATTRS=y
1252 CONFIG_EVM_LOAD_X509=y
1253 CONFIG_EVM_X509_PATH="/etc/keys/x509_evm.der"
1254
1255 ```
1256 My system integrates this security 
1257 https://sourceforge.net/projects/anti-ransomware/
1258
1259 Thank you very much
1260
1261
1262
1263 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-12-08 13:29](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/75#issuecomment-1342739444):
1264
1265 Hello @JohnVengert,
1266
1267 1. As I understand, IMA doesn't have direct influence on Linux **kernel** security.
1268 It's important for the userspace security, isn't it?
1269
1270 2. Does this functionality require any userspace support or actions to work?
1271
1272 3. You've provided a large list of options. Could you create a shortlist with the most important of them?
1273
1274 Thanks!
1275
1276
1277 -------------------------------------------------------------------------------
1278
1279 # [\#74 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/74) `closed`: Add disabling compatibility mode.
1280
1281 #### <img src="https://avatars.githubusercontent.com/u/7232674?u=dba600128b18073a4e3c33b76f5c601591d8f613&v=4" width="50">[Manouchehri](https://github.com/Manouchehri) opened issue at [2022-10-20 22:00](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/74):
1282
1283 I'm not a kernel maintainer, so I added myself a new category. I don't think I'm wrong about this one though, here's a few public examples I found within a minute of searching:
1284
1285 https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html
1286 https://bugs.chromium.org/p/project-zero/issues/detail?id=1574
1287 https://outflux.net/blog/archives/2010/10/19/cve-2010-2963-v4l-compat-exploit/
1288 http://inertiawar.com/compat1/
1289 http://inertiawar.com/compat2/
1290
1291 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-10-22 18:57](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/74#issuecomment-1287883856):
1292
1293 Hello @Manouchehri,
1294
1295 Thanks for your pull request and the idea.
1296
1297 I looked up. That's how `CONFIG_COMPAT` is currently implemented:
1298 ```
1299 config COMPAT
1300         def_bool y
1301         depends on IA32_EMULATION || X86_X32_ABI
1302 ```
1303 So we can't enable/disable it in the menuconfig directly.
1304
1305 The KSPP project already recommends disabling `IA32_EMULATION` and `X86_X32`:
1306 ```
1307 CONFIG_IA32_EMULATION    |kconfig| is not set |   kspp   |cut_attack_surface
1308 CONFIG_X86_X32           |kconfig| is not set |   kspp   |cut_attack_surface
1309 ```
1310
1311 So maybe adding a separate check for `COMPAT` is not needed.
1312
1313 But wait, `COMPAT` depends on `X86_X32_ABI` and not `X86_X32`.
1314
1315 There is a Linux kernel commit `83a44a4f47ad20997aebb311fc678a13cde391d7` (Mar 14 2022)
1316 that renamed this config option. I will ask to update it at the KSPP wiki.
1317 Then I will add a new check for `X86_X32_ABI`.
1318
1319 Thank you very much!
1320
1321 This case shows that from time to time we need to look up all config options that should be disabled.
1322 Maybe some of them have been renamed in the Linux kernel.
1323
1324 #### <img src="https://avatars.githubusercontent.com/u/7232674?u=dba600128b18073a4e3c33b76f5c601591d8f613&v=4" width="50">[Manouchehri](https://github.com/Manouchehri) commented at [2022-10-22 19:02](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/74#issuecomment-1287884800):
1325
1326 CONFIG_COMPAT depends on the arch too. For example, neither `X86_X32_ABI` or `X86_X32` will cover arm64 systems.
1327
1328 ```
1329 menuconfig COMPAT
1330         bool "Kernel support for 32-bit EL0"
1331         depends on ARM64_4K_PAGES || EXPERT
1332 ```
1333
1334 https://github.com/torvalds/linux/blob/master/arch/arm64/Kconfig#L1526-L1542
1335
1336 I don't see the harm in a separate check for `COMPAT`. That flag has been around for years and not changed across architectures IIRC.
1337
1338 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-10-22 19:06](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/74#issuecomment-1287885578):
1339
1340 That's a good point!
1341 I'll return with the results.
1342
1343 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-01-14 18:01](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/74#issuecomment-1382873066):
1344
1345 Hello @Manouchehri,
1346
1347 I contacted KSPP. Now their recommendations [contain](https://kernsec.org/wiki/index.php?title=Kernel_Self_Protection_Project%2FRecommended_Settings&action=historysubmit&type=revision&diff=4064&oldid=4060) disabling `CONFIG_COMPAT` and `CONFIG_X86_X32_ABI`.
1348
1349 Please see the commit https://github.com/a13xp0p0v/kconfig-hardened-check/commit/f3ba594b3acbc154eeade43d87a76b90352ab1d1, where I added these KSPP recommendations.
1350
1351 Thank you for the idea!
1352 Closing the PR.
1353
1354
1355 -------------------------------------------------------------------------------
1356
1357 # [\#73 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/73) `closed`: ERORR?
1358
1359 #### <img src="https://avatars.githubusercontent.com/u/77776927?v=4" width="50">[alpahca](https://github.com/alpahca) opened issue at [2022-09-24 15:03](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/73):
1360
1361 i was try to some book(Billimoria, Kaiwan N. Linux Kernel Debugging: Leverage proven tools and advanced techniques to effectively debug Linux kernels and kernel modules (p. 61). Packt Publishing. Kindle Edition. ).
1362
1363 but.
1364
1365 $ bin/kconfig-hardened-check -p X86_64 -c ~/lkd_kernels/kconfig.prod01/.config
1366 [!] ERROR: --config and --print can't be used together
1367
1368 what should i do?
1369
1370 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-09-24 21:18](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/73#issuecomment-1257066908):
1371
1372 Hi @alpahca,
1373
1374 Quoting `kconfig-hardened-check --help`:
1375 ```
1376   -p {X86_64,X86_32,ARM64,ARM}, --print {X86_64,X86_32,ARM64,ARM}
1377                         print security hardening preferences for the selected architecture
1378   -c CONFIG, --config CONFIG
1379                         check the kernel kconfig file against these preferences
1380 ```
1381
1382 So for checking your kernel config simply do this:
1383 ```
1384 $ bin/kconfig-hardened-check -c ~/lkd_kernels/kconfig.prod01/.config
1385 ```
1386
1387 #### <img src="https://avatars.githubusercontent.com/u/77776927?v=4" width="50">[alpahca](https://github.com/alpahca) commented at [2022-10-11 07:42](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/73#issuecomment-1274233073):
1388
1389 Oh thx.
1390 But... 
1391 VirtualBox:~/lkd_kernels/kconfig_prod01$ '/home/ked/kconfig-hardened-check/bin/kconfig-hardened-check' -c '/home/ked/lkd_kernels/kconfig_prod01'
1392 [+] Kconfig file to check: /home/ked/lkd_kernels/kconfig_prod01
1393 Traceback (most recent call last):
1394 File "/home/ked/kconfig-hardened-check/bin/kconfig-hardened-check", line 16, in
1395 kconfig_hardened_check.main()
1396 File "/home/ked/kconfig-hardened-check/kconfig_hardened_check/init.py", line 976, in main
1397 arch, msg = detect_arch(args.config, supported_archs)
1398 File "/home/ked/kconfig-hardened-check/kconfig_hardened_check/init.py", line 275, in detect_arch
1399 with open(fname, 'r') as f:
1400 IsADirectoryError: [Errno 21] Is a directory: '/home/ked/lkd_kernels/kconfig_prod01'
1401
1402 Uhm... that should be my problem?
1403
1404 -----Original Message-----
1405 From: "Alexander ***@***.***>
1406 To: ***@***.***>;
1407 Cc: ***@***.***>; ***@***.***>;
1408 Sent: 2022-09-25 (일) 06:18:44 (GMT+09:00)
1409 Subject: Re: [a13xp0p0v/kconfig-hardened-check] ERORR? (Issue #73)
1410
1411 Hi @alpahca,
1412 Quoting kconfig-hardened-check --help:
1413 -p {X86_64,X86_32,ARM64,ARM}, --print {X86_64,X86_32,ARM64,ARM} print security hardening preferences for the selected architecture -c CONFIG, --config CONFIG check the kernel kconfig file against these preferences
1414 So for checking your kernel config simply do this:
1415 $ bin/kconfig-hardened-check -c ~/lkd_kernels/kconfig.prod01/.config
1416
1417 Reply to this email directly, view it on GitHub, or unsubscribe.
1418 You are receiving this because you were mentioned.Message ID: ***@***.***>
1419
1420
1421 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-10-22 19:27](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/73#issuecomment-1287890539):
1422
1423 Hi @alpahca,
1424
1425 Please try to use `-c` with the path to the kconfig file, not a directory.
1426
1427 Best regards,
1428 Alexander
1429
1430
1431 -------------------------------------------------------------------------------
1432
1433 # [\#71 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/71) `closed`: Config change in 5.19.X
1434
1435 #### <img src="https://avatars.githubusercontent.com/u/11868071?u=d7a5841263276e1f323827fc21b04345df594a60&v=4" width="50">[Churam](https://github.com/Churam) opened issue at [2022-08-31 08:18](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/71):
1436
1437 Hello,
1438
1439 The X86_SMAP option is no longer present in 5.19.X kernels. It is now enforced.
1440 ( [commit](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v5.19.5&id=c5a3d3c01e90e74166f95eec9db6fcc3ba72a9d6) )
1441
1442 Since it has been removed, the script mark the entry as failed.
1443 ```
1444 [+] Special report mode: show_fail
1445 [+] Kconfig file to check: /opt/KERNEL/linux-5.19.5/.config
1446 [+] Detected architecture: X86_64
1447 [+] Detected kernel version: 5.19
1448 =========================================================================================================================
1449               option name               | type  |desired val | decision |      reason      | check result
1450 =========================================================================================================================
1451 CONFIG_X86_SMAP                         |kconfig|     y      |defconfig | self_protection  | FAIL: not found
1452 ```
1453
1454
1455
1456 The GCC_PLUGIN_RANDSTRUCT and GCC_PLUGIN_RANDSTRUCT_PERFORMANCE have changed now that CLANG has the feature. ( [commit](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.19.y&id=595b893e2087de306d0781795fb8ec47873596a6) ). They are now nammed RANDSTRUCT_FULL and RANDSTRUCT_PERFORMANCE respectively. 
1457
1458 At the moment they don't fail but the new entries should be added in the script I think. 
1459 ```
1460  grep RANDSTRUCT ./.config
1461 # CONFIG_RANDSTRUCT_NONE is not set
1462 CONFIG_RANDSTRUCT_FULL=y
1463 # CONFIG_RANDSTRUCT_PERFORMANCE is not set
1464 CONFIG_RANDSTRUCT=y
1465 CONFIG_GCC_PLUGIN_RANDSTRUCT=y
1466 ```
1467
1468
1469
1470 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-09-02 11:42](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/71#issuecomment-1235396338):
1471
1472 Hi @Churam,
1473
1474 Thanks for your report!
1475
1476 I've improved the checks, please have a look.
1477
1478 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2022-09-06 19:29](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/71#issuecomment-1238566204):
1479
1480 maybe it would make sense to tag a new release after :cat:
1481
1482 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-09-09 08:23](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/71#issuecomment-1241663085):
1483
1484 Hi @anthraxx,
1485
1486 I have a complex and time-consuming procedure for preparing the kconfig-hardened-check releases.
1487
1488 I’m planning to do this work for the next Linux kernel release.
1489
1490
1491 -------------------------------------------------------------------------------
1492
1493 # [\#70 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/70) `closed`: COPR repo with built kernel with suggested recommendations
1494
1495 #### <img src="https://avatars.githubusercontent.com/u/75043245?u=6d29ec5975073ebb1af663a8bf866715b525d50e&v=4" width="50">[krishjainx](https://github.com/krishjainx) opened issue at [2022-07-21 15:19](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/70):
1496
1497 Hi. This repository has been incredibly useful to me as of late. I’m trying to do the following: create a COPR repository for example such that it takes the kernel configuration from Fedora’s latest kernel build for say 36 and then applies the recommended options here, handles setting everything on/off etc for everything that depends on that option and everything setting that option depends on while blacklisting certain recommendations such that it doesn’t break certain apps etc. Post doing this it would grab the source code for that kernel versions and build it with those configs and then one would just install the kernel normally.
1498
1499 How would one go about implementing this? Thank you!
1500
1501 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-07-21 19:48](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/70#issuecomment-1191870587):
1502
1503 Hi Krish,
1504
1505 This approach can be called "creating a kernel flavour". Some distros do that.
1506
1507 For example, see:
1508  - Ubuntu kernel flavours: https://wiki.ubuntu.com/Kernel/Dev/Flavours
1509  - Suse kernel flavours: https://www.suse.com/support/kb/doc/?id=000017133
1510  - The discussion about NixOS hardened kernel: https://github.com/NixOS/nixpkgs/issues/76850
1511
1512 #### <img src="https://avatars.githubusercontent.com/u/75043245?u=6d29ec5975073ebb1af663a8bf866715b525d50e&v=4" width="50">[krishjainx](https://github.com/krishjainx) commented at [2022-07-21 22:18](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/70#issuecomment-1191988714):
1513
1514 Yes, thank you I understand that but how would I have your script/tool change the .config to be more hardened and then have that grab new kernel sources and automatically build like if I was to hold a COPR?
1515
1516 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-07-22 21:00](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/70#issuecomment-1192931275):
1517
1518 Thanks Krish, now I see what you mean.
1519
1520 There is an enhancement #67. Maybe it would help to solve your task.
1521 ```
1522 Create a tool that changes kconfig options according the recommendations
1523 ```
1524 It should use the JSON output of `kconfig-hardened-check` and work with kconfig with [kconfiglib](https://pypi.org/project/kconfiglib/).
1525
1526 What do you think?
1527
1528 #### <img src="https://avatars.githubusercontent.com/u/75043245?u=6d29ec5975073ebb1af663a8bf866715b525d50e&v=4" width="50">[krishjainx](https://github.com/krishjainx) commented at [2022-07-23 03:10](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/70#issuecomment-1193047106):
1529
1530 For sure, this project is perhaps one of the best and most usable for kernel hardening and I would definitely be able to help if you can get started or others with implementing this. Thank you!
1531
1532 #### <img src="https://avatars.githubusercontent.com/u/75043245?u=6d29ec5975073ebb1af663a8bf866715b525d50e&v=4" width="50">[krishjainx](https://github.com/krishjainx) commented at [2022-07-23 03:12](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/70#issuecomment-1193047378):
1533
1534 It would be incredibly useful to instead of being developing sideways independent projects like linux-hardened or grsecurity to be working more close with upstream like you are - getting all the performance improvements, bug fixes and applying all available "vanilla" security fixes and pushing this to distributions using that tool. Then people can work off it. Even if it's not "revolutionary" I definitely believe in the long term it would help make Linux even better!
1535
1536 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-07-24 15:44](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/70#issuecomment-1193343924):
1537
1538 I can't comment about `grsecurity`. This topic is complex... Anyway, they are pioneers in kernel security hardening.
1539
1540 The goal of `KSPP` is to develop kernel self-protection features for the mainline kernel. I hope my `kconfig-hardened-check` project also promotes these security features among Linux distros.
1541
1542
1543 -------------------------------------------------------------------------------
1544
1545 # [\#69 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/69) `open`: Create documentation describing Linux kernel security options
1546 **Labels**: `enhancement`
1547
1548
1549 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) opened issue at [2022-07-04 10:43](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/69):
1550
1551
1552
1553 #### <img src="https://avatars.githubusercontent.com/u/106462796?v=4" width="50">[o8opi](https://github.com/o8opi) commented at [2023-04-09 20:27](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/69#issuecomment-1501206810):
1554
1555 Would love to see this, even if it's just a list of links and pointers to other resources :)
1556
1557
1558 -------------------------------------------------------------------------------
1559
1560 # [\#68 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/68) `closed`: Create a tool reporting mainline kernel versions that support a recommended option
1561 **Labels**: `enhancement`
1562
1563
1564 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) opened issue at [2022-07-04 00:34](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/68):
1565
1566
1567
1568 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-07-17 15:25](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/68#issuecomment-1186547339):
1569
1570 The LKDDb project solves this task. Added info to the README.
1571
1572 Good. Closing the issue.
1573
1574
1575 -------------------------------------------------------------------------------
1576
1577 # [\#67 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/67) `closed`: Create a tool that changes kconfig options according to the recommendations
1578 **Labels**: `enhancement`
1579
1580
1581 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) opened issue at [2022-07-04 00:25](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/67):
1582
1583 It should use the JSON output of kconfig-hardened-check.
1584
1585 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-07-17 13:43](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/67#issuecomment-1186522515):
1586
1587 See https://pypi.org/project/kconfiglib/
1588
1589 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-02-17 16:06](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/67#issuecomment-1434854140):
1590
1591 That tool would also help to filter out the kconfig options that can't be enabled for the given kernel version.
1592
1593 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-06-12 15:32](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/67#issuecomment-1587577476):
1594
1595 This feature is implemented as a part of the `kconfig-hardened-check` tool.
1596
1597 With the `-g` argument, the tool generates a Kconfig fragment with the security hardening options for the selected microarchitecture.
1598
1599 This Kconfig fragment can be merged with the existing Linux kernel config:
1600
1601 ```
1602 $ ./bin/kconfig-hardened-check -g X86_64 > /tmp/fragment
1603 $ cd ~/linux-src/
1604 $ ./scripts/kconfig/merge_config.sh .config /tmp/fragment
1605 Using .config as base
1606 Merging /tmp/fragment
1607 Value of CONFIG_BUG_ON_DATA_CORRUPTION is redefined by fragment /tmp/fragment:
1608 Previous value: # CONFIG_BUG_ON_DATA_CORRUPTION is not set
1609 New value: CONFIG_BUG_ON_DATA_CORRUPTION=y
1610  ...
1611 ```
1612
1613
1614 -------------------------------------------------------------------------------
1615
1616 # [\#66 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/66) `open`: Evaluate performance penalty of the recommended kernel options
1617 **Labels**: `enhancement`
1618
1619
1620 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) opened issue at [2022-07-03 09:57](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/66):
1621
1622 As the first step, @BlackIkeEagle made some performance tests and described the results in [this article](https://blog.herecura.eu/blog/2020-05-30-kconfig-hardening-tests/).
1623
1624 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-12-08 14:46](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/66#issuecomment-1342846087):
1625
1626 Create a solution for automating this process:
1627  1. Take defconfig as a basic kernel configuration.
1628  2. Build the Linux kernel.
1629  3. Start test system with this kernel (a hardware machine may give more consistent results than a virtual machine). If the system doesn't boot, go to step 6.
1630  4. Run the chosen performance tests (hackbench, kernel compilation, network throughput evaluation, etc).
1631  5. Save the test results.
1632  6. Set another kernel option from the kconfig-hardened-check json output and go to step 2 (see #67). If all recommendations are already tested, then proceed to step 7.
1633  7. Analyze the results of the performance testing.
1634
1635 That approach would save us from plenty of boring manual routine.
1636
1637 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-12-08 18:58](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/66#issuecomment-1343190811):
1638
1639 Similar performance testing of a group of  security hardening options may give interesting results as well.
1640
1641
1642 -------------------------------------------------------------------------------
1643
1644 # [\#65 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/65) `closed`: Support checking sysctl security options
1645 **Labels**: `enhancement`
1646
1647
1648 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) opened issue at [2022-07-03 09:50](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/65):
1649
1650 The `OptCheck` class inheritance now allows to implement this feature.
1651
1652 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-08-14 12:36](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/65#issuecomment-1677237521):
1653
1654 Checking sysctl parameters is supported now:
1655 ```
1656 $ ./bin/kconfig-hardened-check 
1657 usage: kconfig-hardened-check [-h] [--version] [-m {verbose,json,show_ok,show_fail}]
1658                               [-c CONFIG] [-l CMDLINE] [-s SYSCTL]
1659                               [-p {X86_64,X86_32,ARM64,ARM}]
1660                               [-g {X86_64,X86_32,ARM64,ARM}]
1661
1662 A tool for checking the security hardening options of the Linux kernel
1663
1664 options:
1665   -h, --help            show this help message and exit
1666   --version             show program's version number and exit
1667   -m {verbose,json,show_ok,show_fail}, --mode {verbose,json,show_ok,show_fail}
1668                         choose the report mode
1669   -c CONFIG, --config CONFIG
1670                         check the security hardening options in the kernel Kconfig file
1671                         (also supports *.gz files)
1672   -l CMDLINE, --cmdline CMDLINE
1673                         check the security hardening options in the kernel cmdline file
1674                         (contents of /proc/cmdline)
1675   -s SYSCTL, --sysctl SYSCTL
1676                         check the security hardening options in the sysctl output file
1677                         (`sudo sysctl -a > file`)
1678   -p {X86_64,X86_32,ARM64,ARM}, --print {X86_64,X86_32,ARM64,ARM}
1679                         print the security hardening recommendations for the selected
1680                         microarchitecture
1681   -g {X86_64,X86_32,ARM64,ARM}, --generate {X86_64,X86_32,ARM64,ARM}
1682                         generate a Kconfig fragment with the security hardening options
1683                         for the selected microarchitecture
1684 ```
1685
1686
1687 -------------------------------------------------------------------------------
1688
1689 # [\#64 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/64) `closed`: script fetch configs from different kernel images for current architecture
1690
1691 #### <img src="https://avatars.githubusercontent.com/u/106462796?v=4" width="50">[o8opi](https://github.com/o8opi) opened issue at [2022-06-01 06:34](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/64):
1692
1693 This script now tries to fetch and/or build the different kernel images for current architecture and derive the kernel configs from them
1694
1695 #### <img src="https://avatars.githubusercontent.com/u/106462796?v=4" width="50">[o8opi](https://github.com/o8opi) commented at [2022-06-01 06:36](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/64#issuecomment-1143174866):
1696
1697 This might resolve #63
1698
1699 #### <img src="https://avatars.githubusercontent.com/u/65553080?u=1e9e0de760ac0083c86dab588f627a0468cd714e&v=4" width="50">[codecov-commenter](https://github.com/codecov-commenter) commented at [2022-06-08 15:30](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/64#issuecomment-1150072367):
1700
1701 # [Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/64?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) Report
1702 > Merging [#64](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/64?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (86b6b08) into [master](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/commit/0d5c56f297fca50a48dfc602a5b4118b8ebdbceb?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (0d5c56f) will **not change** coverage.
1703 > The diff coverage is `n/a`.
1704
1705 ```diff
1706 @@           Coverage Diff           @@
1707 ##           master      #64   +/-   ##
1708 =======================================
1709   Coverage   98.08%   98.08%           
1710 =======================================
1711   Files           3        3           
1712   Lines         625      625           
1713   Branches      139      139           
1714 =======================================
1715   Hits          613      613           
1716   Misses          5        5           
1717   Partials        7        7           
1718 ```
1719
1720 | Flag | Coverage Δ | |
1721 |---|---|---|
1722 | functional_test | `98.08% <ø> (ø)` | |
1723
1724 Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov#carryforward-flags-in-the-pull-request-comment) to find out more.
1725
1726 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-06-10 16:49](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/64#issuecomment-1152552051):
1727
1728 Hello @o8opi,
1729
1730 I tried your version of this script in a Docker container with Ubuntu 20.04.2.
1731
1732 It failed with the error:
1733 ```
1734 ...
1735 copying path '/nix/store/l920bx9bw37jd681pk98dfra0j3lanva-libarchive-3.6.1-lib' from 'https://cache.nixos.org'...
1736 copying path '/nix/store/km0c80plib16fp76prmhcdwbag9iqnvf-nix-2.9.1' from 'https://cache.nixos.org'...
1737 copying path '/nix/store/0szyscpg632p7vlj9if5gadwlvwcb91d-nix-2.9.1-dev' from 'https://cache.nixos.org'...
1738 building '/nix/store/yz1y19d71lp53jymd51h4qw9c2663x6a-builder.pl.drv'...
1739 building '/nix/store/c539pzdghlrfcik2qymswm30ycbdj3yz-python3-3.9.13-env.drv'...
1740 created 226 symlinks in user environment
1741 Traceback (most recent call last):
1742   File "/home/a13x/src/kconfig-hardened-check/contrib/./get-nix-kconfig.py", line 61, in <module>
1743     main()
1744   File "/home/a13x/src/kconfig-hardened-check/contrib/./get-nix-kconfig.py", line 16, in main
1745     data = json.loads(proc.stdout)
1746   File "/nix/store/553d7c4xcwp9j1a1gb9cb1s9ry3x1pi9-python3-3.9.13/lib/python3.9/json/__init__.py", line 346, in loads
1747     return _default_decoder.decode(s)
1748   File "/nix/store/553d7c4xcwp9j1a1gb9cb1s9ry3x1pi9-python3-3.9.13/lib/python3.9/json/decoder.py", line 337, in decode
1749     obj, end = self.raw_decode(s, idx=_w(s, 0).end())
1750   File "/nix/store/553d7c4xcwp9j1a1gb9cb1s9ry3x1pi9-python3-3.9.13/lib/python3.9/json/decoder.py", line 355, in raw_decode
1751     raise JSONDecodeError("Expecting value", s, err.value) from None
1752 json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
1753 ```
1754
1755 It looks like ` json.loads()` didn't manage to handle the output of `nix search`.
1756
1757 #### <img src="https://avatars.githubusercontent.com/u/106462796?v=4" width="50">[o8opi](https://github.com/o8opi) commented at [2022-07-16 11:53](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/64#issuecomment-1186164603):
1758
1759 this should work better now
1760
1761 #### <img src="https://avatars.githubusercontent.com/u/106462796?v=4" width="50">[o8opi](https://github.com/o8opi) commented at [2022-07-17 21:53](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/64#issuecomment-1186613685):
1762
1763 I have tested in an Ubuntu-20.04 container and it worked for me, can share Dockerfile if needed :)
1764
1765 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-07-21 19:38](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/64#issuecomment-1191862516):
1766
1767 Hello @o8opi,
1768
1769 Now it works better, but gives a bunch of other errors:
1770 ```
1771 created 223 symlinks in user environment
1772 extract-vmlinux: Cannot find vmlinux.
1773 Usage: extract-ikconfig <kernel-image>
1774 failed to extract config from legacyPackages.x86_64-linux.linuxPackages_5_10_hardened.kernel
1775 extract-vmlinux: Cannot find vmlinux.
1776 Usage: extract-ikconfig <kernel-image>
1777 failed to extract config from legacyPackages.x86_64-linux.linuxPackages_5_15_hardened.kernel
1778 extract-vmlinux: Cannot find vmlinux.
1779 Usage: extract-ikconfig <kernel-image>
1780 failed to extract config from legacyPackages.x86_64-linux.linuxPackages_5_18_hardened.kernel
1781 extract-vmlinux: Cannot find vmlinux.
1782 Usage: extract-ikconfig <kernel-image>
1783 failed to extract config from legacyPackages.x86_64-linux.linuxPackages_hardened.kernel
1784 error: Package ‘linux-4.14.180-176’ in /nix/store/xcba8ikxvdzw7ycg5ncnfq37w9491cn9-source/pkgs/os-specific/linux/kernel/linux-hardkernel-4.14.nix:4 is not supported on ‘x86_64-linux’, refusing to evaluate.
1785
1786        a) To temporarily allow packages that are unsupported for this system, you can use an environment variable
1787           for a single invocation of the nix tools.
1788
1789             $ export NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM=1
1790
1791         Note: For `nix shell`, `nix build`, `nix develop` or any other Nix 2.4+
1792         (Flake) command, `--impure` must be passed in order to read this
1793         environment variable.
1794
1795        b) For `nixos-rebuild` you can set
1796          { nixpkgs.config.allowUnsupportedSystem = true; }
1797        in configuration.nix to override this.
1798
1799        c) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
1800          { allowUnsupportedSystem = true; }
1801        to ~/.config/nixpkgs/config.nix.
1802 (use '--show-trace' to show detailed location information)
1803 failed to build legacyPackages.x86_64-linux.linuxPackages_hardkernel_latest.kernel
1804 extract-vmlinux: Cannot find vmlinux.
1805 Usage: extract-ikconfig <kernel-image>
1806 failed to extract config from legacyPackages.x86_64-linux.linuxPackages_latest.kernel
1807 extract-vmlinux: Cannot find vmlinux.
1808 Usage: extract-ikconfig <kernel-image>
1809 failed to extract config from legacyPackages.x86_64-linux.linuxPackages_latest-libre.kernel
1810 extract-vmlinux: Cannot find vmlinux.
1811 Usage: extract-ikconfig <kernel-image>
1812 failed to extract config from legacyPackages.x86_64-linux.linuxPackages_lqx.kernel
1813 error: Package ‘linux-5.18.12-bcachefs-unstable-2022-04-25’ in /nix/store/xcba8ikxvdzw7ycg5ncnfq37w9491cn9-source/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix:15 is marked as broken, refusing to evaluate.
1814
1815        a) To temporarily allow broken packages, you can use an environment variable
1816           for a single invocation of the nix tools.
1817
1818             $ export NIXPKGS_ALLOW_BROKEN=1
1819
1820         Note: For `nix shell`, `nix build`, `nix develop` or any other Nix 2.4+
1821         (Flake) command, `--impure` must be passed in order to read this
1822         environment variable.
1823
1824        b) For `nixos-rebuild` you can set
1825          { nixpkgs.config.allowBroken = true; }
1826        in configuration.nix to override this.
1827
1828        c) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
1829          { allowBroken = true; }
1830        to ~/.config/nixpkgs/config.nix.
1831 (use '--show-trace' to show detailed location information)
1832 failed to build legacyPackages.x86_64-linux.linuxPackages_testing_bcachefs.kernel
1833 extract-vmlinux: Cannot find vmlinux.
1834 Usage: extract-ikconfig <kernel-image>
1835 failed to extract config from legacyPackages.x86_64-linux.linuxPackages_xanmod.kernel
1836 extract-vmlinux: Cannot find vmlinux.
1837 Usage: extract-ikconfig <kernel-image>
1838 failed to extract config from legacyPackages.x86_64-linux.linuxPackages_xanmod_latest.kernel
1839 extract-vmlinux: Cannot find vmlinux.
1840 Usage: extract-ikconfig <kernel-image>
1841 failed to extract config from legacyPackages.x86_64-linux.linuxPackages_zen.kernel
1842 ```
1843
1844 I see at least three different kinds of errors here.
1845 Could you have a look?
1846
1847 I would also ask you to rebase your branch over `origin/master`.
1848
1849 Thanks!
1850
1851
1852 -------------------------------------------------------------------------------
1853
1854 # [\#63 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/63) `closed`: Fix getting Nix kconfig (contrib)
1855 **Labels**: `bug`
1856
1857
1858 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) opened issue at [2022-04-27 23:30](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/63):
1859
1860 Hello @Mic92, could you help with this Nix problem?
1861
1862 I tested the installation of `kconfig-hardened-check` in a Docker container with Ubuntu 20.04.4 LTS.
1863
1864 It failed with the following error:
1865
1866 ```
1867 a13x@dc92d9d74557:~/src/1/kconfig-hardened-check/contrib$ ./get-nix-kconfig.py 
1868 these 50 paths will be fetched (94.58 MiB download, 374.80 MiB unpacked):
1869   /nix/store/058drky7qcyd04rzqcmxh86xmifw96dx-glibc-2.34-115-bin
1870   /nix/store/1442kn5q9ah0bhhqm99f8nr76diczqgm-gnused-4.8
1871   /nix/store/19xbyxc31snlk60cil7cx6l4xw126ids-gcc-11.2.0
1872   /nix/store/4r26nvzfa1qfjaqgr2bpw2fz8c6qnk3s-gnutar-1.34
1873   /nix/store/58pwclg9yr437h0pfgrnbd0jis8fqasd-gcc-wrapper-11.2.0
1874   /nix/store/5h6q8cmqjd8iqpd99566hrg2a56pwdkc-acl-2.3.1
1875   /nix/store/6rbwy3mf0w8z119bwqs7dcrc2vyql9sf-expand-response-params
1876   /nix/store/7b2vmi7cq7lzw8g6kaihzg2kyilj4slm-bash-interactive-5.1-p16-dev
1877   /nix/store/87xq1difvspida4391y23vylkjdcgllf-linux-headers-5.16
1878   /nix/store/9l06npv9sp8avdraahzi4kqhcp607d8p-tzdata-2022a
1879   /nix/store/9pxskbhf92x9cxvg87nbzw2q1kmkrym6-bash-interactive-5.1-p16-info
1880   /nix/store/9wq21cbqsxpdx4dk0q6gab00fcir04d1-gzip-1.12
1881   /nix/store/a0k6rfn47h9f69p15pg415x6pfpxhsl5-gdbm-1.23
1882   /nix/store/a5xpjds3mlln26469h72v1jmd00jq6lv-xz-5.2.5
1883   /nix/store/ayrsyv7npr0lcbann4k9lxr19x813f0z-glibc-2.34-115
1884   /nix/store/b36ilvc5hhfpcp7kv1kvrkgcxxpmxfsd-zlib-1.2.12
1885   /nix/store/bavmqg7c4366hbiccpsdawbilh68dajy-xz-5.2.5-bin
1886   /nix/store/bndvc0y3v4djij152wiqbyn13zs2xivy-pcre-8.45
1887   /nix/store/bqkx3pi50phcglv0l551jhp96bq8njl0-gnugrep-3.7
1888   /nix/store/c7062r0rh84w3v77pqwdcggrsdlvy1df-findutils-4.9.0
1889   /nix/store/clkdigybx5w29rjxnwnsk76q49gb12k7-ncurses-6.3
1890   /nix/store/d60gkg5dkw4y5kc055n4m0xyvcjz65im-bash-interactive-5.1-p16
1891   /nix/store/dgic5ks4yixhh0havidjwd02rskmqlgp-binutils-wrapper-2.38
1892   /nix/store/dxj6b99zh4fh5z65rqirmcfvffxx5ig0-readline-8.1p2
1893   /nix/store/f2fnhhjanmxganm3xa5inwgvi6wj2ran-bash-interactive-5.1-p16-doc
1894   /nix/store/fcd0m68c331j7nkdxvnnpb8ggwsaiqac-bash-5.1-p16
1895   /nix/store/gm6q7jmajjmnwd29wgbq2jm3x37vsw3h-libffi-3.4.2
1896   /nix/store/hgl0ydlkgs6y6hx9h7k209shw3v7z77j-coreutils-9.0
1897   /nix/store/hym1n0ygqp9wcm7pxn4sfrql3fg7xa09-python3-3.9.12
1898   /nix/store/ik4qlj53grwmg7avzrfrn34bjf6a30ch-libunistring-1.0
1899   /nix/store/jm3nxvmxcm5nvalbv28acvygismcykvj-gnumake-4.3
1900   /nix/store/k3wp5kdxwa4ysb6nh5y9yll5n30cja5m-patch-2.7.6
1901   /nix/store/m2vh2ny7bqpwij1gpmvl5gxj7y4dgr4f-binutils-2.38
1902   /nix/store/n239ln3v669s5fkir2fd8niqawyg6qrv-attr-2.5.1
1903   /nix/store/pmyiksh5sgqzakbr84qsfxqy8fgirmic-stdenv-linux
1904   /nix/store/psijdi9190zgbp053y6dj3ax4y2l70gk-gcc-11.2.0-lib
1905   /nix/store/pvn23vycg674bj6nypjcfyhqbr85rqxa-glibc-2.34-115-dev
1906   /nix/store/qd3g8rk5hx5zkb70idjh6fa12sh6bipg-mailcap-2.1.53
1907   /nix/store/qvs678k05yrv566dmqdnxfbzi4s6ir1n-sqlite-3.38.2
1908   /nix/store/rf3j3p8cvn0dr5wdl65ns9f8wnlca8h6-readline-6.3p08
1909   /nix/store/sj2plsn7wz94dkwvg1wlb11pjch6r70v-diffutils-3.8
1910   /nix/store/v8vpzh3slc5hm4d9id5bim4dsb4d2ndh-openssl-1.1.1n
1911   /nix/store/v990x4cib4dssspn4778rlz46jmm3a9k-expat-2.4.7
1912   /nix/store/vz05jxs509mgp5i5jbrgvgvg4a2p3a3m-ed-1.18
1913   /nix/store/w3zngkrag7vnm7v1q8vnqb71q6a1w8gn-libidn2-2.3.2
1914   /nix/store/wcj03nlvxsjrc1cmpl2nhpn80l5wvf8j-gawk-5.1.1
1915   /nix/store/x6jr3j9hxs8ld8cy69gy9aykrm3iz8rv-patchelf-0.14.5
1916   /nix/store/yjndwl7872iqhw7m97gv7kwgwd5d66s5-bzip2-1.0.6.0.2-bin
1917   /nix/store/zf03nlnk9h724gz7qzzbrzyqif8gbwhq-bzip2-1.0.6.0.2
1918   /nix/store/zghsxxqb2gyz460q4r7jfdc2lpg3rgjw-bash-interactive-5.1-p16-man
1919 copying path '/nix/store/f2fnhhjanmxganm3xa5inwgvi6wj2ran-bash-interactive-5.1-p16-doc' from 'https://cache.nixos.org'...
1920 copying path '/nix/store/9pxskbhf92x9cxvg87nbzw2q1kmkrym6-bash-interactive-5.1-p16-info' from 'https://cache.nixos.org'...
1921 copying path '/nix/store/zghsxxqb2gyz460q4r7jfdc2lpg3rgjw-bash-interactive-5.1-p16-man' from 'https://cache.nixos.org'...
1922 copying path '/nix/store/ik4qlj53grwmg7avzrfrn34bjf6a30ch-libunistring-1.0' from 'https://cache.nixos.org'...
1923 copying path '/nix/store/87xq1difvspida4391y23vylkjdcgllf-linux-headers-5.16' from 'https://cache.nixos.org'...
1924 copying path '/nix/store/w3zngkrag7vnm7v1q8vnqb71q6a1w8gn-libidn2-2.3.2' from 'https://cache.nixos.org'...
1925 copying path '/nix/store/qd3g8rk5hx5zkb70idjh6fa12sh6bipg-mailcap-2.1.53' from 'https://cache.nixos.org'...
1926 copying path '/nix/store/ayrsyv7npr0lcbann4k9lxr19x813f0z-glibc-2.34-115' from 'https://cache.nixos.org'...
1927 copying path '/nix/store/9l06npv9sp8avdraahzi4kqhcp607d8p-tzdata-2022a' from 'https://cache.nixos.org'...
1928 copying path '/nix/store/n239ln3v669s5fkir2fd8niqawyg6qrv-attr-2.5.1' from 'https://cache.nixos.org'...
1929 copying path '/nix/store/fcd0m68c331j7nkdxvnnpb8ggwsaiqac-bash-5.1-p16' from 'https://cache.nixos.org'...
1930 copying path '/nix/store/5h6q8cmqjd8iqpd99566hrg2a56pwdkc-acl-2.3.1' from 'https://cache.nixos.org'...
1931 copying path '/nix/store/zf03nlnk9h724gz7qzzbrzyqif8gbwhq-bzip2-1.0.6.0.2' from 'https://cache.nixos.org'...
1932 copying path '/nix/store/hgl0ydlkgs6y6hx9h7k209shw3v7z77j-coreutils-9.0' from 'https://cache.nixos.org'...
1933 copying path '/nix/store/yjndwl7872iqhw7m97gv7kwgwd5d66s5-bzip2-1.0.6.0.2-bin' from 'https://cache.nixos.org'...
1934 copying path '/nix/store/sj2plsn7wz94dkwvg1wlb11pjch6r70v-diffutils-3.8' from 'https://cache.nixos.org'...
1935 copying path '/nix/store/vz05jxs509mgp5i5jbrgvgvg4a2p3a3m-ed-1.18' from 'https://cache.nixos.org'...
1936 copying path '/nix/store/6rbwy3mf0w8z119bwqs7dcrc2vyql9sf-expand-response-params' from 'https://cache.nixos.org'...
1937 copying path '/nix/store/v990x4cib4dssspn4778rlz46jmm3a9k-expat-2.4.7' from 'https://cache.nixos.org'...
1938 copying path '/nix/store/c7062r0rh84w3v77pqwdcggrsdlvy1df-findutils-4.9.0' from 'https://cache.nixos.org'...
1939 copying path '/nix/store/wcj03nlvxsjrc1cmpl2nhpn80l5wvf8j-gawk-5.1.1' from 'https://cache.nixos.org'...
1940 copying path '/nix/store/psijdi9190zgbp053y6dj3ax4y2l70gk-gcc-11.2.0-lib' from 'https://cache.nixos.org'...
1941 copying path '/nix/store/a0k6rfn47h9f69p15pg415x6pfpxhsl5-gdbm-1.23' from 'https://cache.nixos.org'...
1942 copying path '/nix/store/058drky7qcyd04rzqcmxh86xmifw96dx-glibc-2.34-115-bin' from 'https://cache.nixos.org'...
1943 copying path '/nix/store/jm3nxvmxcm5nvalbv28acvygismcykvj-gnumake-4.3' from 'https://cache.nixos.org'...
1944 copying path '/nix/store/pvn23vycg674bj6nypjcfyhqbr85rqxa-glibc-2.34-115-dev' from 'https://cache.nixos.org'...
1945 copying path '/nix/store/1442kn5q9ah0bhhqm99f8nr76diczqgm-gnused-4.8' from 'https://cache.nixos.org'...
1946 copying path '/nix/store/4r26nvzfa1qfjaqgr2bpw2fz8c6qnk3s-gnutar-1.34' from 'https://cache.nixos.org'...
1947 copying path '/nix/store/9wq21cbqsxpdx4dk0q6gab00fcir04d1-gzip-1.12' from 'https://cache.nixos.org'...
1948 copying path '/nix/store/gm6q7jmajjmnwd29wgbq2jm3x37vsw3h-libffi-3.4.2' from 'https://cache.nixos.org'...
1949 copying path '/nix/store/clkdigybx5w29rjxnwnsk76q49gb12k7-ncurses-6.3' from 'https://cache.nixos.org'...
1950 copying path '/nix/store/v8vpzh3slc5hm4d9id5bim4dsb4d2ndh-openssl-1.1.1n' from 'https://cache.nixos.org'...
1951 copying path '/nix/store/k3wp5kdxwa4ysb6nh5y9yll5n30cja5m-patch-2.7.6' from 'https://cache.nixos.org'...
1952 copying path '/nix/store/x6jr3j9hxs8ld8cy69gy9aykrm3iz8rv-patchelf-0.14.5' from 'https://cache.nixos.org'...
1953 copying path '/nix/store/bndvc0y3v4djij152wiqbyn13zs2xivy-pcre-8.45' from 'https://cache.nixos.org'...
1954 copying path '/nix/store/rf3j3p8cvn0dr5wdl65ns9f8wnlca8h6-readline-6.3p08' from 'https://cache.nixos.org'...
1955 copying path '/nix/store/bqkx3pi50phcglv0l551jhp96bq8njl0-gnugrep-3.7' from 'https://cache.nixos.org'...
1956 copying path '/nix/store/dxj6b99zh4fh5z65rqirmcfvffxx5ig0-readline-8.1p2' from 'https://cache.nixos.org'...
1957 copying path '/nix/store/a5xpjds3mlln26469h72v1jmd00jq6lv-xz-5.2.5' from 'https://cache.nixos.org'...
1958 copying path '/nix/store/d60gkg5dkw4y5kc055n4m0xyvcjz65im-bash-interactive-5.1-p16' from 'https://cache.nixos.org'...
1959 copying path '/nix/store/bavmqg7c4366hbiccpsdawbilh68dajy-xz-5.2.5-bin' from 'https://cache.nixos.org'...
1960 copying path '/nix/store/7b2vmi7cq7lzw8g6kaihzg2kyilj4slm-bash-interactive-5.1-p16-dev' from 'https://cache.nixos.org'...
1961 copying path '/nix/store/b36ilvc5hhfpcp7kv1kvrkgcxxpmxfsd-zlib-1.2.12' from 'https://cache.nixos.org'...
1962 copying path '/nix/store/m2vh2ny7bqpwij1gpmvl5gxj7y4dgr4f-binutils-2.38' from 'https://cache.nixos.org'...
1963 copying path '/nix/store/19xbyxc31snlk60cil7cx6l4xw126ids-gcc-11.2.0' from 'https://cache.nixos.org'...
1964 copying path '/nix/store/dgic5ks4yixhh0havidjwd02rskmqlgp-binutils-wrapper-2.38' from 'https://cache.nixos.org'...
1965 copying path '/nix/store/qvs678k05yrv566dmqdnxfbzi4s6ir1n-sqlite-3.38.2' from 'https://cache.nixos.org'...
1966 copying path '/nix/store/58pwclg9yr437h0pfgrnbd0jis8fqasd-gcc-wrapper-11.2.0' from 'https://cache.nixos.org'...
1967 copying path '/nix/store/hym1n0ygqp9wcm7pxn4sfrql3fg7xa09-python3-3.9.12' from 'https://cache.nixos.org'...
1968
1969 copying path '/nix/store/pmyiksh5sgqzakbr84qsfxqy8fgirmic-stdenv-linux' from 'https://cache.nixos.org'...
1970 Traceback (most recent call last):
1971   File "/home/a13x/src/1/kconfig-hardened-check/contrib/./get-nix-kconfig.py", line 30, in <module>
1972     main()
1973   File "/home/a13x/src/1/kconfig-hardened-check/contrib/./get-nix-kconfig.py", line 16, in main
1974     data = json.loads(proc.stdout)
1975   File "/nix/store/hym1n0ygqp9wcm7pxn4sfrql3fg7xa09-python3-3.9.12/lib/python3.9/json/__init__.py", line 346, in loads
1976     return _default_decoder.decode(s)
1977   File "/nix/store/hym1n0ygqp9wcm7pxn4sfrql3fg7xa09-python3-3.9.12/lib/python3.9/json/decoder.py", line 337, in decode
1978     obj, end = self.raw_decode(s, idx=_w(s, 0).end())
1979   File "/nix/store/hym1n0ygqp9wcm7pxn4sfrql3fg7xa09-python3-3.9.12/lib/python3.9/json/decoder.py", line 355, in raw_decode
1980     raise JSONDecodeError("Expecting value", s, err.value) from None
1981 json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
1982 ```
1983
1984 Hoping for your help with Nix, @Mic92!
1985
1986 #### <img src="https://avatars.githubusercontent.com/u/106462796?v=4" width="50">[o8opi](https://github.com/o8opi) commented at [2022-12-28 21:16](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/63#issuecomment-1366920764):
1987
1988 Hello, is this still relevant ?
1989
1990 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-12-28 22:11](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/63#issuecomment-1366954405):
1991
1992 Hello @o8opi,
1993
1994 It would be nice to fix this script or remove it.
1995
1996 Is it possible to get a Nix kernel config somewhere without building the Linux kernel for NixOS?
1997
1998 Thank you!
1999
2000 #### <img src="https://avatars.githubusercontent.com/u/96200?u=9ed15c85825694d00e996d605d728179b830c4fa&v=4" width="50">[Mic92](https://github.com/Mic92) commented at [2022-12-29 10:00](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/63#issuecomment-1367202486):
2001
2002 The script was fixed in https://github.com/a13xp0p0v/kconfig-hardened-check/pull/78
2003
2004 #### <img src="https://avatars.githubusercontent.com/u/96200?u=9ed15c85825694d00e996d605d728179b830c4fa&v=4" width="50">[Mic92](https://github.com/Mic92) commented at [2022-12-29 10:01](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/63#issuecomment-1367203173):
2005
2006 I don't think the kernel config can be easily get otherwise. It is generated by nix code depending on enabled features and kernel versions.
2007
2008 #### <img src="https://avatars.githubusercontent.com/u/96200?u=9ed15c85825694d00e996d605d728179b830c4fa&v=4" width="50">[Mic92](https://github.com/Mic92) commented at [2022-12-29 10:02](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/63#issuecomment-1367204327):
2009
2010 However there is https://github.com/cachix/install-nix-action combined https://github.com/marketplace/actions/create-pull-request could automatically keep this up-to-date.
2011
2012 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-01-19 16:15](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/63#issuecomment-1397233625):
2013
2014 Hello @Mic92,
2015
2016 Closing, this issue has been fixed in https://github.com/a13xp0p0v/kconfig-hardened-check/pull/77.
2017
2018 Thanks!
2019
2020
2021 -------------------------------------------------------------------------------
2022
2023 # [\#62 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/62) `merged`: Add BLK_DEV_FD_RAWCMD
2024 **Labels**: `kernel_maintainer_feedback`
2025
2026
2027 #### <img src="https://avatars.githubusercontent.com/u/150761?u=f98bb82be5009ecefd6ee9bc3d60fcf082f8cf49&v=4" width="50">[evdenis](https://github.com/evdenis) opened issue at [2022-04-27 18:15](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/62):
2028
2029 See commit torvalds/linux@233087ca0636 ("floppy: disable FDRAWCMD by default")
2030
2031 Signed-off-by: Denis Efremov <efremov@linux.com>
2032
2033 #### <img src="https://avatars.githubusercontent.com/u/65553080?u=1e9e0de760ac0083c86dab588f627a0468cd714e&v=4" width="50">[codecov-commenter](https://github.com/codecov-commenter) commented at [2022-04-27 18:16](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/62#issuecomment-1111331853):
2034
2035 # [Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/62?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) Report
2036 > Merging [#62](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/62?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (bbe60e7) into [master](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/commit/61bfef8931bcefc1abb6d3d46e169c8372ce729b?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (61bfef8) will **increase** coverage by `0.01%`.
2037 > The diff coverage is `100.00%`.
2038
2039 ```diff
2040 @@            Coverage Diff             @@
2041 ##           master      #62      +/-   ##
2042 ==========================================
2043 + Coverage   90.32%   90.33%   +0.01%     
2044 ==========================================
2045   Files           3        3              
2046   Lines         589      590       +1     
2047   Branches      137      137              
2048 ==========================================
2049 + Hits          532      533       +1     
2050   Misses         29       29              
2051   Partials       28       28              
2052 ```
2053
2054 | Flag | Coverage Δ | |
2055 |---|---|---|
2056 | functional_test | `90.33% <100.00%> (+0.01%)` | :arrow_up: |
2057
2058 Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov#carryforward-flags-in-the-pull-request-comment) to find out more.
2059
2060 | [Impacted Files](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/62?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) | Coverage Δ | |
2061 |---|---|---|
2062 | [kconfig\_hardened\_check/\_\_init\_\_.py](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/62/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov#diff-a2NvbmZpZ19oYXJkZW5lZF9jaGVjay9fX2luaXRfXy5weQ==) | `90.34% <100.00%> (+0.01%)` | :arrow_up: |
2063
2064 ------
2065
2066 [Continue to review full report at Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/62?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov).
2067 > **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov)
2068 > `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
2069 > Powered by [Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/62?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov). Last update [61bfef8...bbe60e7](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/62?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov).
2070
2071 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-04-28 11:41](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/62#issuecomment-1112102364):
2072
2073 Thanks @evdenis!
2074 👍
2075
2076
2077 -------------------------------------------------------------------------------
2078
2079 # [\#61 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/61) `closed`: Let user select configs without absolute path
2080
2081 #### <img src="https://avatars.githubusercontent.com/u/29118926?v=4" width="50">[dmknght](https://github.com/dmknght) opened issue at [2022-03-26 15:15](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/61):
2082
2083 ## System info:
2084 Parrot OS 5.0, python 3
2085 kconfig-hardened-check version 5.14
2086 I've tried all options in help menu and I didn't find anything similar to my idea
2087
2088 ## Idea
2089 1. Create an option to list all config. Maybe it supports search as well.
2090 2. Let user select module without absolute path. For example, when I do Debian packaging for this tool, the configs are at `/usr/lib/python3/dist-packages/kconfig_hardened_check/config_files/` and users don't know where to search configs / modules.
2091 Solution:
2092 1. Add a `__init__.py` file into `config_files`. By this, folder `configs` is a module of the whole project.
2093 2. You can do `from kconfig-hardnerned-check.<any path> import config_files`. Absolute path of the module will be `config_files.__path__[0]`
2094 3. All modules are listed by `walk_dir(config_files.__path__[0])`. By this, you can have an option in argv to list all configs
2095 4. When user provide `-c` flag, like `-c distros/debian.config`, absolute path is merged with `config_files.__path__[0]` so there's no need to know absolute path.
2096
2097 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-04-08 18:06](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/61#issuecomment-1093149751):
2098
2099 Hello @dmknght,
2100
2101 Thanks for writing!
2102
2103 Actually, the config files in `kconfig_hardened_check/config_files/` are provided as examples that are used for developing and testing of this tool. These configs are updated not that often, they don't cover all major distros.
2104
2105 The main use case for users is to check their own kernel config. The example from Fedora:
2106 ```
2107 ./bin/kconfig-hardened-check -c /boot/config-5.16.11-100.fc34.x86_64
2108 ```
2109 So I don't think users care about the location of these example config files. How do you think?
2110
2111 #### <img src="https://avatars.githubusercontent.com/u/29118926?v=4" width="50">[dmknght](https://github.com/dmknght) commented at [2022-05-06 05:37](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/61#issuecomment-1119275930):
2112
2113 > Hello @dmknght,
2114
2115 > Thanks for writing!
2116
2117 > Actually, the config files in `kconfig_hardened_check/config_files/` are provided as examples that are used for developing and testing of this tool. These configs are updated not that often, they don't cover all major distros.
2118
2119 > The main use case for users is to check their own kernel config. The example from Fedora:
2120
2121 > ```
2122 > ./bin/kconfig-hardened-check -c /boot/config-5.16.11-100.fc34.x86_64
2123 > ```
2124
2125 > So I don't think users care about the location of these example config files. How do you think?
2126
2127 Hello! Sorry for very late reply. I had issue with my mail notification LuL. Anyway, I think that's a very interesting point that i didn't know. In this case, I think `kconfig-hardened-check` can have a flag like `auto check` to do the command automatically. The workflow is like:
2128 1. Check if there is `config file` that matches `kernel version` at `/boot/`
2129 2. If exists, run the system check automatically
2130 3. If doesn't exists, tells user to try some examples. In this case, i think absolute path of examples is needed.
2131
2132 What do you think about this? To me I think it's easier to user to just do `run and read` the result without thinking about wrong profiles.
2133
2134 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2022-05-07 12:00](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/61#issuecomment-1120197457):
2135
2136 Some distros don't expose kernel config at /boot and I don't see why average user would be interested in checking example config which is probably totally unrelated to their system.
2137
2138 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-05-08 13:33](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/61#issuecomment-1120420075):
2139
2140 I agree with @Bernhard40.
2141
2142 @dmknght, I would avoid adding the code for searching the kernel config on a local machine.
2143
2144 Moreover, Linux kernel developers often use the `kconfig-hardened-check` tool for the configs of the kernels that they develop (not the config of the local machine).
2145
2146 Thanks!
2147
2148 #### <img src="https://avatars.githubusercontent.com/u/29118926?v=4" width="50">[dmknght](https://github.com/dmknght) commented at [2022-05-09 08:49](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/61#issuecomment-1120822656):
2149
2150 > @dmknght, I would avoid adding the code for searching the kernel config on a local machine.
2151
2152 Well it's not that hard. From what i checked, you just need to get kernel version, and map the path `/boot/config-<kernel version>`
2153
2154 > Moreover, Linux kernel developers often use the kconfig-hardened-check tool for the configs of the kernels that they develop (not the config of the local machine).
2155 Well i see. So i guess I can close the issue now because the scope is different.
2156
2157
2158 -------------------------------------------------------------------------------
2159
2160 # [\#60 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/60) `merged`: UBSAN_SANITIZE_ALL not available on ARM
2161
2162 #### <img src="https://avatars.githubusercontent.com/u/7194705?u=be917f131efce086bc9785f2b606107afe2d2fc3&v=4" width="50">[cyanidium](https://github.com/cyanidium) opened issue at [2022-03-26 14:29](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/60):
2163
2164 ARCH_HAS_UBSAN_SANITIZE_ALL is not selected for arm arch, which prevents selection of CONFIG_UBSAN_SANITIZE_ALL
2165
2166 https://github.com/torvalds/linux/blob/master/arch/arm/Kconfig
2167 https://github.com/torvalds/linux/blob/master/lib/Kconfig.ubsan
2168
2169 #### <img src="https://avatars.githubusercontent.com/u/65553080?u=1e9e0de760ac0083c86dab588f627a0468cd714e&v=4" width="50">[codecov-commenter](https://github.com/codecov-commenter) commented at [2022-03-26 14:30](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/60#issuecomment-1079705754):
2170
2171 # [Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/60?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) Report
2172 > Merging [#60](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/60?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (b9c72b3) into [master](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/commit/b0b91b58adc962da01c7fc45cef662ae1b462828?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (b0b91b5) will **increase** coverage by `0.01%`.
2173 > The diff coverage is `100.00%`.
2174
2175 ```diff
2176 @@            Coverage Diff             @@
2177 ##           master      #60      +/-   ##
2178 ==========================================
2179 + Coverage   91.46%   91.48%   +0.01%     
2180 ==========================================
2181   Files           3        3              
2182   Lines         586      587       +1     
2183   Branches      133      134       +1     
2184 ==========================================
2185 + Hits          536      537       +1     
2186   Misses         25       25              
2187   Partials       25       25              
2188 ```
2189
2190 | Flag | Coverage Δ | |
2191 |---|---|---|
2192 | functional_test | `91.48% <100.00%> (+0.01%)` | :arrow_up: |
2193
2194 Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov#carryforward-flags-in-the-pull-request-comment) to find out more.
2195
2196 | [Impacted Files](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/60?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) | Coverage Δ | |
2197 |---|---|---|
2198 | [kconfig\_hardened\_check/\_\_init\_\_.py](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/60/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov#diff-a2NvbmZpZ19oYXJkZW5lZF9jaGVjay9fX2luaXRfXy5weQ==) | `91.50% <100.00%> (+0.01%)` | :arrow_up: |
2199
2200 ------
2201
2202 [Continue to review full report at Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/60?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov).
2203 > **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov)
2204 > `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
2205 > Powered by [Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/60?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov). Last update [b0b91b5...b9c72b3](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/60?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov).
2206
2207 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-04-08 16:43](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/60#issuecomment-1093077908):
2208
2209 Hello @cyanidium, 
2210
2211 Thanks for your PR.
2212
2213 You are right, UBSAN_SANITIZE_ALL is not available for arm for now.
2214 See the discussion for more info https://github.com/KSPP/linux/issues/25#issuecomment-928154612
2215
2216 I'm going to merge your branch.
2217 Thanks!
2218
2219
2220 -------------------------------------------------------------------------------
2221
2222 # [\#59 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/59) `merged`: EFI mitigations can't be enabled if EFI is not set
2223
2224 #### <img src="https://avatars.githubusercontent.com/u/7194705?u=be917f131efce086bc9785f2b606107afe2d2fc3&v=4" width="50">[cyanidium](https://github.com/cyanidium) opened issue at [2022-03-15 12:38](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/59):
2225
2226 Both EFI_DISABLE_PCI_DMA and RESET_ATTACK_MITIGATION depend on EFI, but if EFI is not set, neither config is required.
2227
2228 Useful on embedded devices that use u-boot or similar instead of EFI.
2229
2230
2231
2232
2233 -------------------------------------------------------------------------------
2234
2235 # [\#58 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/58) `closed`: CONFIG_TRIM_UNUSED_KSYMS and CONFIG_MODULES not in sync
2236
2237 #### <img src="https://avatars.githubusercontent.com/u/11868071?u=d7a5841263276e1f323827fc21b04345df594a60&v=4" width="50">[Churam](https://github.com/Churam) opened issue at [2022-01-17 17:17](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/58):
2238
2239 It seems there is a problem with the current stable kernel (5.15.14 at the date of this issue). 
2240
2241 The kernel option TRIM_UNUSED_KSYMS is defined in my config as: 
2242 ```
2243 Symbol: TRIM_UNUSED_KSYMS [=n]
2244 Type  : bool
2245 Defined at init/Kconfig:2301
2246 Prompt: Trim unused exported kernel symbols
2247 Depends on: MODULES [=n] && !COMPILE_TEST [=n]
2248 Visible if: MODULES [=n] && !COMPILE_TEST [=n] && EXPERT [=y]
2249 Location: 
2250 (1) -> Enable loadable module support (MODULES [=n])
2251
2252 ```
2253 Or the script (with the setup above) outputs me: 
2254 CONFIG_TRIM_UNUSED_KSYMS                     |      y      |    my    | cut_attack_surface |   FAIL: not found
2255
2256 But as the hardening requires to have MODULES = n (is not set) it is impossible to set TRIM_UNUSED_KSYMS through menuconfig.
2257
2258
2259
2260 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-01-21 15:53](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/58#issuecomment-1018632628):
2261
2262 @Churam thanks for your report!
2263
2264 Fixed.
2265
2266 The output for your case now:
2267 ```
2268 CONFIG_TRIM_UNUSED_KSYMS   |   y   |   my   | cut_attack_surface |  OK: CONFIG_MODULES "is not set"
2269 ```
2270
2271 #### <img src="https://avatars.githubusercontent.com/u/11868071?u=d7a5841263276e1f323827fc21b04345df594a60&v=4" width="50">[Churam](https://github.com/Churam) commented at [2022-01-24 11:04](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/58#issuecomment-1019976819):
2272
2273 Fix OK
2274 Output is now as expected, closing issue
2275
2276
2277 -------------------------------------------------------------------------------
2278
2279 # [\#57 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/57) `open`: CONFIG_AMD_IOMMU_V2 = m appears also to be correct
2280 **Labels**: `question`
2281
2282
2283 #### <img src="https://avatars.githubusercontent.com/u/15869?u=31910a5ba7214eaf12efd39cbdf71b69af1b7db0&v=4" width="50">[brandonweeks](https://github.com/brandonweeks) opened issue at [2022-01-10 09:40](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/57):
2284
2285 ```
2286 CONFIG_AMD_IOMMU = y
2287 CONFIG_AMD_IOMMU_V2 = m
2288 ```
2289 appears to correctly setup the AMD v2 IOMMU on supported hardware (tested on NixOS) and is the config option used by [Fedora/RHEL](https://gitlab.com/cki-project/kernel-ark/-/blob/os-build/redhat/configs/common/generic/x86/x86_64/CONFIG_AMD_IOMMU_V2).
2290
2291 If you agree with this assessment, any pointers on how to add an OR to the existing AND conditional for `CONFIG_AMD_IOMMU`?
2292
2293 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-01-21 15:29](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/57#issuecomment-1018612527):
2294
2295 Hello @brandonweeks 
2296
2297 Could you give any details on tests you mentioned?
2298
2299 Thanks!
2300
2301
2302 -------------------------------------------------------------------------------
2303
2304 # [\#56 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/56) `open`: Add RISC-V support
2305 **Labels**: `enhancement`
2306
2307
2308 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) opened issue at [2021-11-21 12:07](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/56):
2309
2310 It would be nice to have `kconfig-hardened-check` adapted for `RISC-V` kernel configs.  
2311
2312 #### <img src="https://avatars.githubusercontent.com/u/125879?v=4" width="50">[cybernet](https://github.com/cybernet) commented at [2021-12-24 13:35](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/56#issuecomment-1000842582):
2313
2314 👍
2315
2316
2317 -------------------------------------------------------------------------------
2318
2319 # [\#55 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/55) `closed`: Should slub_debug be considered a hardening cmd line parameter?
2320 **Labels**: `question`
2321
2322
2323 #### <img src="https://avatars.githubusercontent.com/u/3797768?v=4" width="50">[morfikov](https://github.com/morfikov) opened issue at [2021-10-28 21:16](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/55):
2324
2325 [According to this](https://github.com/a13xp0p0v/kconfig-hardened-check/blob/2b5bf3548b6a7edbf7cd74278d570b658f9ab34a/kconfig_hardened_check/__init__.py#L13-L21), the `slub_debug` is a hardening cmd line parameter. But when you use this option, you will see the following in the syslog on newer kernels:
2326
2327 ```
2328 kernel: **********************************************************
2329 kernel: **   NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE   **
2330 kernel: **                                                      **
2331 kernel: ** This system shows unhashed kernel memory addresses   **
2332 kernel: ** via the console, logs, and other interfaces. This    **
2333 kernel: ** might reduce the security of your system.            **
2334 kernel: **                                                      **
2335 kernel: ** If you see this message and you are not debugging    **
2336 kernel: ** the kernel, report this immediately to your system   **
2337 kernel: ** administrator!                                       **
2338 kernel: **                                                      **
2339 kernel: **   NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE   **
2340 kernel: **********************************************************
2341 ```
2342 More [here](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=792702911f581f7793962fbeb99d5c3a1b28f4c3) and [here](https://patchwork.kernel.org/project/linux-mm/patch/20210214161348.369023-4-timur@kernel.org/).
2343
2344 So, should users use slub_debug=FZP or slub_debug=ZP?
2345
2346 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2021-11-09 19:26](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/55#issuecomment-964465176):
2347
2348 Hello @morfikov!
2349
2350 My code comment in `__init__.py` is a note for future development within https://github.com/a13xp0p0v/kconfig-hardened-check/issues/46. It's not a final decision.
2351
2352 Currently I consider `slub_debug=F` and `slub_debug=Z` as debugging features, as you can see at the [Linux Kernel Defence Map](https://github.com/a13xp0p0v/linux-kernel-defence-map).
2353
2354 And I will have to learn more about `init_on_free` and `slub_debug=P` to choose between them.
2355
2356 Thanks!
2357
2358
2359 -------------------------------------------------------------------------------
2360
2361 # [\#54 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/54) `merged`: Add BLK_DEV_FD
2362 **Labels**: `kernel_maintainer_feedback`
2363
2364
2365 #### <img src="https://avatars.githubusercontent.com/u/150761?u=f98bb82be5009ecefd6ee9bc3d60fcf082f8cf49&v=4" width="50">[evdenis](https://github.com/evdenis) opened issue at [2021-09-10 15:41](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/54):
2366
2367 Floppy driver was written many years ago. It was designed to
2368 work in a single-threaded environment (many global variables)
2369 and to work on real hardware which has significant delays
2370 (floppy drives are slow). Nowadays, when we use virtual
2371 devices (which are fast) and multi-core cpus, floppy driver
2372 shows its problems including deadlocking/livelocking and
2373 other security-related issues. However, we can't just
2374 rewrite it because lack of real hardware and compatibility
2375 with existing userspace tools, many of which rely on
2376 undocumented driver behavior.
2377
2378 Here are some CVEs related to floppy driver:
2379  - CVE-2014-1737 privileges escalation in FDRAWCMD ioctl
2380  - CVE-2014-1738 info leak from kernel heap in FDRAWCMD ioctl
2381  - CVE-2018-7755 kernel pointer lead in FDGETPRM ioctl
2382  - CVE-2019-14283 integer overflow and out-of-bounds read in set_geometry
2383  - CVE-2019-14284 denial of service in setup_format_params
2384  - CVE-2020-9383 out-of-bounds read in set_fdc
2385  - CVE-2021-20261 race condition in floppy_revalidate,
2386    floppy_check_events
2387
2388 As pointed by Linus [1]:
2389 > The only users are virtualization, and even they are going away
2390 > because floppies are so small, and other things have become more
2391 > standard anyway (ie USB disk) or easier to emulate (NVMe or whatever).
2392 > So I suspect the only reason floppy is used even in that area is just
2393 > legacy "we haven't bothered updating to anything better and we have
2394 > old scripts and images that work".
2395
2396 CONFIG_BLK_DEV_FD is not enabled in defconfig on x86_64.
2397 Many distros already require root access for /dev/fd0.
2398 However, qemu (5.2.0) still enables floppy device by default.
2399
2400 [1] https://lore.kernel.org/all/CAHk-=whFAAV_TOLFNnj=wu4mD2L9OvgB6n2sKDdmd8buMKFv8A@mail.gmail.com/
2401
2402 #### <img src="https://avatars.githubusercontent.com/u/65553080?u=1e9e0de760ac0083c86dab588f627a0468cd714e&v=4" width="50">[codecov-commenter](https://github.com/codecov-commenter) commented at [2021-09-10 21:23](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/54#issuecomment-917220941):
2403
2404 # [Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/54?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) Report
2405 > Merging [#54](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/54?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (17d70c5) into [master](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/commit/b54dca6a96b7a07d3d1aec56b5a1df6386bb7d61?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (b54dca6) will **increase** coverage by `0.01%`.
2406 > The diff coverage is `100.00%`.
2407
2408 [![Impacted file tree graph](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/54/graphs/tree.svg?width=650&height=150&src=pr&token=GOOVXMV5Kb&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov)](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/54?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov)
2409
2410 ```diff
2411 @@            Coverage Diff             @@
2412 ##           master      #54      +/-   ##
2413 ==========================================
2414 + Coverage   92.95%   92.96%   +0.01%     
2415 ==========================================
2416   Files           3        3              
2417   Lines         511      512       +1     
2418   Branches      116      116              
2419 ==========================================
2420 + Hits          475      476       +1     
2421   Misses         18       18              
2422   Partials       18       18              
2423 ```
2424
2425 | Flag | Coverage Δ | |
2426 |---|---|---|
2427 | functional_test | `92.96% <100.00%> (+0.01%)` | :arrow_up: |
2428
2429 Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov#carryforward-flags-in-the-pull-request-comment) to find out more.
2430
2431 | [Impacted Files](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/54?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) | Coverage Δ | |
2432 |---|---|---|
2433 | [kconfig\_hardened\_check/\_\_init\_\_.py](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/54/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov#diff-a2NvbmZpZ19oYXJkZW5lZF9jaGVjay9fX2luaXRfXy5weQ==) | `93.02% <100.00%> (+0.01%)` | :arrow_up: |
2434
2435 ------
2436
2437 [Continue to review full report at Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/54?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov).
2438 > **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov)
2439 > `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
2440 > Powered by [Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/54?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov). Last update [b54dca6...17d70c5](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/54?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov).
2441
2442 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2021-09-10 21:28](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/54#issuecomment-917223378):
2443
2444 Thanks a lot @evdenis :)
2445 The pull request is merged.
2446
2447
2448 -------------------------------------------------------------------------------
2449
2450 # [\#53 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/53) `closed`: Justification of UBSAN-related choices?
2451 **Labels**: `kernel_maintainer_feedback`
2452
2453
2454 #### <img src="https://avatars.githubusercontent.com/u/601177?v=4" width="50">[equaeghe](https://github.com/equaeghe) opened issue at [2021-09-04 21:22](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/53):
2455
2456 Currently, `UBSAN`-related choices are as follows:
2457
2458 https://github.com/a13xp0p0v/kconfig-hardened-check/blob/4dc94be8a5e0c3a0889679f7079aa93c7f44464d/kconfig_hardened_check/__init__.py#L421-L423
2459
2460 It is unclear to me why the last two are chosen. `UBSAN_MISC=y` seems like a good thing, as it enables more checks. `UBSAN_TRAP=y` seems like a bad thing, as it enables denial of service attacks. Furthermore, if I understand things correctly, `UBSAN_SANITIZE_ALL=y` would be needed to practically activate `UBSAN`.
2461
2462 Is my understanding correct, or a misunderstanding (which is perfectly possible). In the latter case, I would be grateful for a pointer to an appropriate resource.
2463
2464 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2021-09-10 13:40](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/53#issuecomment-916912883):
2465
2466 Hello @equaeghe 
2467
2468 Thanks for your question.
2469
2470 Please have a look, @kees wrote about that in his article about security-related things in the Linux kernel 5.7:
2471 https://outflux.net/blog/archives/2020/09/21/security-things-in-linux-v5-7/
2472
2473 Quote:
2474 ```
2475 For runtime checking, the Undefined Behavior Sanitizer has an option for adding runtime array bounds checking
2476 for catching things like this where the compiler cannot perform a static analysis of the index values.
2477
2478 ...
2479
2480 It was, however, not separate (via kernel Kconfig) until Elena Petrova and I split it out into
2481 CONFIG_UBSAN_BOUNDS, which is fast enough for production kernel use. 
2482
2483 ...
2484
2485 Since UBSAN (and the other Sanitizers) only WARN() by default, system owners need to
2486 set panic_on_warn=1 too if they want to defend against attacks targeting these kinds of flaws.
2487 Because of this, and to avoid bloating the kernel image with all the warning messages, I introduced
2488 CONFIG_UBSAN_TRAP which effectively turns these conditions into a BUG() without needing
2489 additional sysctl settings.
2490 ```
2491
2492 Does that provide answers to your questions?
2493
2494 #### <img src="https://avatars.githubusercontent.com/u/601177?v=4" width="50">[equaeghe](https://github.com/equaeghe) commented at [2021-09-10 14:04](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/53#issuecomment-916929875):
2495
2496 Thanks, that explains why `UBSAN_TRAP=y`. I am still unclear why `UBSAN_MISC is not set` and why nothing is said about `UBSAN_SANITIZE_ALL`.
2497
2498 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2021-09-10 14:56](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/53#issuecomment-916967782):
2499
2500 It looks like other UBSAN modes are for kernel debugging, not for hardening:
2501 ```
2502 [*]   Perform checking for bit-shift overflows
2503 [*]   Perform checking for integer divide-by-zero
2504 [*]   Perform checking for non-boolean values used as boolean
2505 [*]   Perform checking for out of bounds enum values
2506 [*]   Perform checking for misaligned pointer usage
2507 ```
2508 Previously they were collected under UBSAN_MISC, but now I see that they are separate since the kernel commit  c637693b20da8706b7f48d96882c9c80ae935151. I will have a closer look at them.
2509
2510 I will also test UBSAN_SANITIZE_ALL behavior.
2511
2512 Thanks @equaeghe !
2513
2514 #### <img src="https://avatars.githubusercontent.com/u/1110841?u=e5e99e1ac8260e791433baa2423f7d173eea4c1c&v=4" width="50">[kees](https://github.com/kees) commented at [2021-09-10 18:50](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/53#issuecomment-917133371):
2515
2516 `UBSAN_SANITIZE_ALL` is needed to gain coverage over the kernel as a whole. Otherwise, only opted-in things will have the UBSAN features applied.
2517
2518 I.e. for production workloads, I recommend:
2519
2520 ```
2521 CONFIG_UBSAN=y
2522 CONFIG_UBSAN_BOUNDS=y
2523 CONFIG_UBSAN_SANITIZE_ALL=y
2524 ```
2525
2526 and depending on one's crash tolerances, either use `panic_on_warn=1` or `CONFIG_UBSAN_TRAP=y`.
2527
2528 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2021-09-10 21:20](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/53#issuecomment-917219349):
2529
2530 Thank you very much @kees !
2531
2532
2533 -------------------------------------------------------------------------------
2534
2535 # [\#52 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/52) `closed`: Add RANDOMIZE_KSTACK_OFFSET_DEFAULT
2536
2537 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) opened issue at [2021-08-25 19:44](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/52):
2538
2539 Randomize kernel stack offset on syscall entry
2540
2541 The kernel stack offset can be randomized (after pt_regs) by
2542 roughly 5 bits of entropy, frustrating memory corruption
2543 attacks that depend on stack address determinism or
2544 cross-syscall address exposures. This feature is controlled
2545 by kernel boot param "randomize_kstack_offset=on/off", and this
2546 config chooses the default boot state.
2547
2548 #### <img src="https://avatars.githubusercontent.com/u/65553080?u=1e9e0de760ac0083c86dab588f627a0468cd714e&v=4" width="50">[codecov-commenter](https://github.com/codecov-commenter) commented at [2021-08-25 19:46](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/52#issuecomment-905823752):
2549
2550 # [Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/52?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) Report
2551 > Merging [#52](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/52?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (5d12e64) into [master](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/commit/57379d8c851656116e2b149e3f1d4003c17d22d9?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (57379d8) will **increase** coverage by `0.01%`.
2552 > The diff coverage is `100.00%`.
2553
2554 [![Impacted file tree graph](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/52/graphs/tree.svg?width=650&height=150&src=pr&token=GOOVXMV5Kb&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov)](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/52?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov)
2555
2556 ```diff
2557 @@            Coverage Diff             @@
2558 ##           master      #52      +/-   ##
2559 ==========================================
2560 + Coverage   92.87%   92.88%   +0.01%     
2561 ==========================================
2562   Files           3        3              
2563   Lines         505      506       +1     
2564   Branches      115      115              
2565 ==========================================
2566 + Hits          469      470       +1     
2567   Misses         18       18              
2568   Partials       18       18              
2569 ```
2570
2571 | Flag | Coverage Δ | |
2572 |---|---|---|
2573 | functional_test | `92.88% <100.00%> (+0.01%)` | :arrow_up: |
2574
2575 Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov#carryforward-flags-in-the-pull-request-comment) to find out more.
2576
2577 | [Impacted Files](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/52?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) | Coverage Δ | |
2578 |---|---|---|
2579 | [kconfig\_hardened\_check/\_\_init\_\_.py](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/52/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov#diff-a2NvbmZpZ19oYXJkZW5lZF9jaGVjay9fX2luaXRfXy5weQ==) | `92.94% <100.00%> (+0.01%)` | :arrow_up: |
2580
2581 ------
2582
2583 [Continue to review full report at Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/52?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov).
2584 > **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov)
2585 > `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
2586 > Powered by [Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/52?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov). Last update [57379d8...5d12e64](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/52?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov).
2587
2588 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2021-09-10 12:14](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/52#issuecomment-916859414):
2589
2590 Hi @anthraxx 
2591
2592 You might be busy, so I've made the fixes myself in the commit b54dca6a96b7a07d3d1aec56b5a1df6386bb7d61.
2593 Hope you wouldn't mind.
2594
2595 Thanks!
2596 Alexander
2597
2598 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2021-09-10 12:15](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/52#issuecomment-916860190):
2599
2600 @a13xp0p0v nah, i was just about to make it KSPP official hence the delay. should have communicated it. Will create a followup PR marking it as kspp soon :cat:
2601
2602 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2021-09-10 13:45](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/52#issuecomment-916916530):
2603
2604 @anthraxx , ah, OK!
2605
2606 Sure, looking forward to your new pull request!
2607
2608
2609 -------------------------------------------------------------------------------
2610
2611 # [\#51 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/51) `merged`: Added cbl-mariner kernel configuration file.
2612
2613 #### <img src="https://avatars.githubusercontent.com/u/25109036?u=507c0397c0e27f6fc1a1b3115f293c66b8056199&v=4" width="50">[Hacks4Snacks](https://github.com/Hacks4Snacks) opened issue at [2021-08-19 20:49](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/51):
2614
2615 Hello,
2616
2617 I have added the CBL-Mariner 1.0 distribution kernel configuration file.
2618
2619 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2021-08-20 17:22](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/51#issuecomment-902842367):
2620
2621 Hello @Hacks4Snacks,
2622 Could you please add the corresponding info to `kconfig_hardened_check/config_files/links.txt` and update your pull request?
2623 Thank you!
2624
2625 #### <img src="https://avatars.githubusercontent.com/u/25109036?u=507c0397c0e27f6fc1a1b3115f293c66b8056199&v=4" width="50">[Hacks4Snacks](https://github.com/Hacks4Snacks) commented at [2021-08-20 17:42](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/51#issuecomment-902853201):
2626
2627 Sure thing! A link to the publicly available configuration has been added. @a13xp0p0v
2628
2629 #### <img src="https://avatars.githubusercontent.com/u/65553080?u=1e9e0de760ac0083c86dab588f627a0468cd714e&v=4" width="50">[codecov-commenter](https://github.com/codecov-commenter) commented at [2021-08-20 18:11](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/51#issuecomment-902869062):
2630
2631 # [Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/51?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) Report
2632 > Merging [#51](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/51?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (a5686b1) into [master](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/commit/38bde65d9df70a6b1ec772b93b07e98778cb7e34?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov) (38bde65) will **not change** coverage.
2633 > The diff coverage is `n/a`.
2634
2635 [![Impacted file tree graph](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/51/graphs/tree.svg?width=650&height=150&src=pr&token=GOOVXMV5Kb&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov)](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/51?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov)
2636
2637 ```diff
2638 @@           Coverage Diff           @@
2639 ##           master      #51   +/-   ##
2640 =======================================
2641   Coverage   92.87%   92.87%           
2642 =======================================
2643   Files           3        3           
2644   Lines         505      505           
2645   Branches      115      115           
2646 =======================================
2647   Hits          469      469           
2648   Misses         18       18           
2649   Partials       18       18           
2650 ```
2651
2652 | Flag | Coverage Δ | |
2653 |---|---|---|
2654 | functional_test | `92.87% <ø> (ø)` | |
2655
2656 Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov#carryforward-flags-in-the-pull-request-comment) to find out more.
2657
2658
2659 ------
2660
2661 [Continue to review full report at Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/51?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov).
2662 > **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov)
2663 > `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
2664 > Powered by [Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/51?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov). Last update [38bde65...a5686b1](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/51?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Alexander+Popov).
2665
2666 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2021-08-20 18:22](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/51#issuecomment-902874845):
2667
2668 Merged. Thanks @Hacks4Snacks!
2669
2670
2671 -------------------------------------------------------------------------------
2672
2673 # [\#50 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/50) `open`: Allow redefining rules and expanding rule sets
2674 **Labels**: `enhancement`
2675
2676
2677 #### <img src="https://avatars.githubusercontent.com/u/65050545?u=3d095cc7726e6bbf544ea4857c4223033ea90921&v=4" width="50">[petervanvugt](https://github.com/petervanvugt) opened issue at [2021-02-20 01:10](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/50):
2678
2679 I have found this tool quite helpful for quickly auditing embedded kernel configs. However, I've been finding that on embedded systems, I often have unique, application-specific security requirements:
2680
2681 - Embedded SoC vendors often have drivers that haven't made it into mainline that need to be checked (e.g. special HW RNG drivers, TZ drivers, PMIC drivers)
2682 - The application may want to even further prioritize the correct operation of the system over performance or reliability (i.e. be willing to sacrifice battery life, CPU bandwidth, or resistance to DoS attacks to increase hardness)
2683 - Since the required kernel functionality is fully defined (e.g. we know we'll _never_ need FAT filesystem support, don't want UART or kernel console driver, don't want USB gadget drivers, etc.), specify that unused drivers must be removed, lest they be leveraged by an attacker
2684
2685 I propose moving the config tests currently hard-coded in `__init__` into a set of yaml configs that can be included by a top-level config, like this:
2686 ```
2687 # Includes are optional. Recursively walk through them, each test/error will be tagged with the source yaml
2688 # Last included definition for a CONFIG_ is used
2689 includes:
2690   - kspp.yaml
2691   - clipos.yaml
2692   - my.yaml
2693   - soc_a.yaml
2694 # Tests
2695 tests: !!seq [
2696   # Description of test
2697   RANDOMIZE_BASE: {
2698     # Test passes if CONFIG=value
2699     require: value,
2700     # Test passes if config not found, or "is not set"
2701     # require: is not set,
2702     # Optional: only test if other config is set to something
2703     if_config: MODULES,
2704     # Optional: only test specific kernel versions
2705     if_kernel_ver_gt_eq: 5.9,
2706     if_kernel_ver_lt: 5.8,
2707     # Optional: only test specific architectures
2708     if_arch: [X86_64, ARM64, X86_32],
2709   },
2710   # Example: require CONFIG_BUG=y
2711   BUG: {
2712     require: y,
2713   },
2714 ]
2715 ```
2716 This would enable the config requirements to be layered, similar to the way kernel `defconfigs` can be layered (i.e. arch | Android | SoC vendor | device). I have some free time next week to implement this if you're open to it.
2717
2718 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2021-02-21 22:15](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/50#issuecomment-782937216):
2719
2720 Hello @petervanvugt,
2721
2722 Thanks for your initiative!
2723
2724 May I ask you to describe your use-case in details?
2725 Which new requirements to `kconfig-hardened-check` behavior does it have?
2726
2727 Maybe a layered yaml that you propose is not a single solution for your use-case.
2728
2729 Moreover, I see that your use-case relates to this discussion: https://github.com/a13xp0p0v/kconfig-hardened-check/pull/9#issuecomment-453810119
2730 I think we can define some common solution.
2731
2732 Now about the syntax of check definitions.
2733 - Currently all checks are grouped together in `kconfig_hardened_check/__init__.py`.
2734 - The check definitions are very short.
2735
2736 So I can observe them altogether. That helps me to understand and maintain these checks, which is not an easy task.
2737 That is my main rationale.
2738
2739 Here you propose a completely different syntax.
2740 I think we should discuss it before we start coding.
2741 My thoughts:
2742 1. Can we separate changing check definition syntax from changing `kconfig-hardened-check` behavior?
2743 2. The given syntax example doesn't cover all check types that we have. Could you please write *all* current checks in your new syntax? I think we need that for making the decision.
2744
2745 (I'm travelling till the beginning of March, excuse me for delayed replies)
2746
2747 Best regards,
2748 Alexander
2749
2750 #### <img src="https://avatars.githubusercontent.com/u/65050545?u=3d095cc7726e6bbf544ea4857c4223033ea90921&v=4" width="50">[petervanvugt](https://github.com/petervanvugt) commented at [2021-02-23 02:26](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/50#issuecomment-783833502):
2751
2752 Hi @a13xp0p0v ,
2753
2754 My use essentially falls into three cases:
2755
2756 1. My system has kconfigs **not in mainline that must always be set**.
2757  
2758 _For example_, I might want to verify `PANIC_ON_DATA_CORRUPTION` [from Android](https://android.googlesource.com/kernel/msm/+/7b49b86d3aa3d0c6400454a346bad1bbdf0cc78f%5E%21/) is enabled, as a defensive measure, because I'd rather the system immediately reboot at the first sign things are going off the rails, rather than risk being exploited by an attacker.
2759
2760 2. My system has kconfigs that **are in mainline, which are only in play for my hardware**.
2761
2762 _For example_, I may want to verify that my chip's `CONFIG_<HWVENDOR>_HWRANDOM` is enabled, because I'm using it as a cryptographically secure source of enropy.
2763
2764 3. My system has kconfigs that **are in mainline, which many/most users want enabled, but I want disabled**, because they add no benefit, and some nonzero risk.
2765
2766 _For example_, if I'm building an embedded system that uses NXP's i.MX line, I may want to verify `CONFIG_SERIAL_IMX` and `CONFIG_SERIAL_IMX_CONSOLE` are not enabled, because I want to be absolutely certain that the serial drivers and associated kernel console drivers haven't been included. Or, in a similar vein to **(1)**, I may want to enable `CONFIG_PANIC_ON_OOPS` because I prioritize the correctness of my system over its availability.
2767
2768 [EDIT] Another, potentially stronger example I have run into recently is `PROC_PAGE_MONITOR`. The grsecurity patch set removes it for good reason, because access to `/proc/<pid>/smaps` can leak memory mapping information defeating ASLR. While there are mitigations all recent versions of the kernel to prevent insufficiently privileged processes from reading the map of a more privileged process, there have been a few race conditions and side channels that have been shown to circumvent this. So, it is reasonable that many users will want to disable this altogether. However, Android's *libmeminfo* needs to read this entry to compute process memory utilization, which is pretty hard to live without in some applications.
2769
2770 Can we serve all these use cases?
2771
2772 Clearly, there a few paths that could be taken here. We could add these requirements to the very compact representation in `kconfig_hardened_check/__init__.py`. And for **(1)** and **(2)**, we could likely produce some combination of AND/OR kconfig checks (albeit sometimes non-trivial) that keeps the check from generating unnecessarily noisy output/false positives when run on configs for non-applicable hardware, or for kernels that don't fully track mainline. But this wouldn't solve for **(3)**, unless we require the tool be specially patched for such cases, or we add runtime args that turn on each of these checks.
2773
2774 If we want to be able to specify additional requirements at runtime and/or override requirements at runtime, we need a way to specify alternate requirements. This is why I am proposing representing the requirements as runtime configuration, rather than code. As to how we would represent some of the more complex requirements, I am proposing we break them down into requirements that each only check one config each, optionally only checked for some combination of specific architectures/kernel versions/`CONFIG_`s.
2775
2776 We could take configs whose names changed, such as this:
2777 ```
2778 282     l += [OR(OptCheck('self_protection', 'defconfig', 'STACKPROTECTOR_STRONG', 'y'),
2779 283              OptCheck('self_protection', 'defconfig', 'CC_STACKPROTECTOR_STRONG', 'y'))]
2780 ```
2781 and split them into two separate requirements, the first one for kernels >= 4.18, and the second one for kernels >= 3.14 and < 4.18.
2782
2783 The most complex requirement I see is this one:
2784 ```
2785 307     if arch == 'ARM64':
2786 ...
2787 310         l += [OR(OptCheck('self_protection', 'defconfig', 'HARDEN_EL2_VECTORS', 'y'),
2788 311                  AND(OptCheck('self_protection', 'defconfig', 'RANDOMIZE_BASE', 'y'),
2789 312                      VerCheck((5, 9))))] # HARDEN_EL2_VECTORS was included in RANDOMIZE_BASE in v5.9
2790 ```
2791 which could be split into two requirements: one for `RANDOMIZE_BASE` on kernels >= 5.9 for ARM64, and a second check for `HARDEN_EL2_VECTORS` on older kernels >= 4.17 and < 5.9, also for ARM64. This would keep the requirements more readable in the long run.
2792
2793 What do you think?
2794
2795 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2021-03-05 19:16](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/50#issuecomment-791625966):
2796
2797 @petervanvugt thanks a lot for describing your use-cases.
2798 I think they match with [this one](https://github.com/a13xp0p0v/kconfig-hardened-check/pull/9#issuecomment-453810119).
2799 I want to make them possible.
2800
2801 I think `kconfig-hardened-check` should allow to override the default checks and append custom checks.
2802 As a first step, we need some simple solution without changing the check description syntax.
2803 Then we can ponder over the check description syntax.
2804
2805 I will experiment with that.
2806 If you create any prototype, please share!
2807
2808 #### <img src="https://avatars.githubusercontent.com/u/10352354?u=97ab0d446ea4204b959ae74734f8436c78de18e7&v=4" width="50">[egberts](https://github.com/egberts) commented at [2021-08-31 13:08](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/50#issuecomment-909221366):
2809
2810 other use case is prevent leakage of kernel pointers to log file, /proc directory files, or terminal output.  
2811
2812 Which is just a bunch of debugs and dmesg turned off. 
2813
2814
2815 another one is the one provided by Whonix.org (a KSPP variant) which is more rigorous form of kernel security. 
2816
2817 Another one is for Spectre, et. al., mitigation and that has a bunch of config s as well.
2818
2819 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2023-04-23 07:33](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/50#issuecomment-1518980838):
2820
2821 I implemented a part of this feature in `override_expected_value()`.
2822
2823 1. Implementation: https://github.com/a13xp0p0v/kconfig-hardened-check/commit/c1090722157b531261a7cf0257f2dccb744bd93d
2824
2825 2. Unit-test: https://github.com/a13xp0p0v/kconfig-hardened-check/commit/7194de8dfe8b6232166eded1516eb7fdd21c14ed
2826
2827 3.  Refinement of the CONFIG_ARCH_MMAP_RND_BITS check using this feature: https://github.com/a13xp0p0v/kconfig-hardened-check/commit/9bbea5b5bad45aac84aadf83536e31f9bd5e395e
2828
2829
2830 -------------------------------------------------------------------------------
2831
2832 # [\#49 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/49) `closed`: Some checks seem to be at odds with what the recommended settings are
2833
2834 #### <img src="https://avatars.githubusercontent.com/u/14325582?v=4" width="50">[wdormann](https://github.com/wdormann) opened issue at [2021-02-11 14:34](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/49):
2835
2836 I did not go through them all, but these in particular stuck out to me:
2837
2838 ```
2839 CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE     | is not set  |  clipos  |  self_protection   |   FAIL: CONFIG_GCC_PLUGIN_RANDSTRUCT not "y"
2840 CONFIG_STACKLEAK_METRICS                     | is not set  |  clipos  |  self_protection   |   FAIL: CONFIG_GCC_PLUGIN_STACKLEAK not "y"
2841 CONFIG_STACKLEAK_RUNTIME_DISABLE             | is not set  |  clipos  |  self_protection   |   FAIL: CONFIG_GCC_PLUGIN_STACKLEAK not "y"
2842 ```
2843
2844 If I'm reading this properly, the recommended setting for these is ```not set```
2845 However, the specific tests show as ```FAIL``` because they are ```not "y"```
2846
2847 Perhaps I'm just interpreting the report incorrectly, but at first glance it would appear that the check for the desired result is wrong.
2848
2849
2850 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2021-02-11 15:06](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/49#issuecomment-777552022):
2851
2852 Hi @wdormann,
2853
2854 Thanks for your question.
2855 The output is correct, let me explain.
2856
2857 ```
2858 CONFIG_GCC_PLUGIN_RANDSTRUCT                 |      y      |   kspp   |  self_protection   |   FAIL: not found
2859 ...
2860 CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE     | is not set  |  clipos  |  self_protection   |   FAIL: CONFIG_GCC_PLUGIN_RANDSTRUCT not "y"
2861 ```
2862 `RANDSTRUCT` is disabled and the first check fails.
2863 The `RANDSTRUCT_PERFORMANCE` feature is dependent on `RANDSTRUCT`.
2864 That's why the second check fails too with the explanation: `CONFIG_GCC_PLUGIN_RANDSTRUCT not "y"`.
2865
2866 The situation with `STACKLEAK_METRICS` and `STACKLEAK_RUNTIME_DISABLE` is similar.
2867 These checks fail because they depend on `STACKLEAK` which is not `"y"`.
2868
2869 #### <img src="https://avatars.githubusercontent.com/u/14325582?v=4" width="50">[wdormann](https://github.com/wdormann) commented at [2021-02-11 15:19](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/49#issuecomment-777570144):
2870
2871 Reading comprehension is apparently important!
2872 Thanks for the clarification.
2873
2874
2875 -------------------------------------------------------------------------------
2876
2877 # [\#48 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/48) `merged`: Do not check CONFIG_HARDEN_EL2_VECTORS for v5.9+
2878
2879 #### <img src="https://avatars.githubusercontent.com/u/20878259?v=4" width="50">[pgils](https://github.com/pgils) opened issue at [2020-10-19 13:45](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/48):
2880
2881 The CONFIG_HARDEN_EL2_VECTORS Kconfig was removed in Linux 5.9: torvalds/linux@a59a2ed.
2882
2883 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-10-21 15:06](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/48#issuecomment-713644849):
2884
2885 Hi @pgils, thanks for your pull request!
2886
2887 In fact HARDEN_EL2_VECTORS is now included in RANDOMIZE_BASE.
2888 So simple check of the kernel version is not enough.
2889
2890 I think of making nested ComplexOptCheck possible to write such a rule.
2891
2892 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-10-22 16:12](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/48#issuecomment-714601175):
2893
2894 Hi @pgils,
2895 I added nested `ComplexOptChecks` support, merged and improved your rule.
2896 Thanks!
2897
2898 #### <img src="https://avatars.githubusercontent.com/u/20878259?v=4" width="50">[pgils](https://github.com/pgils) commented at [2020-10-24 14:14](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/48#issuecomment-715921069):
2899
2900 thanks @a13xp0p0v, that's a nice feature!
2901
2902 Do you think it would be worthwhile using this for complex dependencies such as this one for `ARM64_PTR_AUTH` which currently `'FAIL'`s for my ARMv8-A config but is not selectable in `menuconfig`?:
2903 ```
2904 (CC_HAS_SIGN_RETURN_ADDRESS [=n] || CC_HAS_BRANCH_PROT_PAC_RET [=n]) \
2905     && AS_HAS_PAC [=n] \
2906     && (LD_IS_LLD [=n] \
2907         || LD_VERSION [=235000000]>=233010000 
2908         || CC_IS_GCC [=y] && GCC_VERSION [=100200]<90100) \
2909     && (!CC_IS_CLANG [=n] || AS_HAS_CFI_NEGATE_RA_STATE [=y]) \
2910     && (!FUNCTION_GRAPH_TRACER [=n] || DYNAMIC_FTRACE_WITH_REGS [=n])
2911 ```
2912
2913 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-10-30 18:16](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/48#issuecomment-719717934):
2914
2915 @pgils, I guess you can't enable `ARM64_PTR_AUTH` because your current toolchain doesn't fit the requirements.
2916 I would recommend improving the toolchain to get this nice feature.
2917
2918 See the output about my toolchain (in Fedora 32):
2919 ```
2920 Depends on: (CC_HAS_SIGN_RETURN_ADDRESS [=y] || CC_HAS_BRANCH_PROT_PAC_RET [=y]) && AS_HAS_PAC [=y] && (LD_IS_LLD [=n] || LD_VERSION [=234000000]>=233010000 || CC_IS_GCC [=y] && GCC_VERSION [=90201]<90100) && (!CC_IS_CLANG [=n] || AS_HAS_CFI_NEGATE_RA_STATE [=y]) && (!FUNCTION_GRAPH_TRACER [=n] || DYNAMIC_FTRACE_WITH_REGS [=n])
2921 ```
2922
2923
2924 -------------------------------------------------------------------------------
2925
2926 # [\#47 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/47) `closed`: Please support /proc/config.gz
2927
2928 #### <img src="https://avatars.githubusercontent.com/u/3797768?v=4" width="50">[morfikov](https://github.com/morfikov) opened issue at [2020-10-13 14:58](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/47):
2929
2930 Currently only uncompressed `config-*` files in /boot/ are supported, but the current kernel config can also be accessed via `/proc/config.gz` . There's no way to use this file. Please support this path as well. 
2931
2932 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-10-14 12:25](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/47#issuecomment-708366463):
2933
2934 No problem, I would recommend this:
2935 ```
2936   # zcat /proc/config.gz > my.config
2937   # ./bin/kconfig-hardened-check -c my.config
2938 ```
2939
2940 #### <img src="https://avatars.githubusercontent.com/u/3797768?v=4" width="50">[morfikov](https://github.com/morfikov) commented at [2020-10-14 13:43](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/47#issuecomment-708410948):
2941
2942 Yes, I know, but this is the same as just using `-c /boot/config-*` . I thought of using `/proc/config.gz` because in such case a user would just use one file no matter what kernel version he's using. When you decompress the file first, it's an extra step which could be eliminated to simplify the whole process and make it easier.
2943
2944 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-10-21 14:44](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/47#issuecomment-713629103):
2945
2946 Not all kernels provide the kernel config via `/proc/config.gz`.
2947 For example, RHEL, Fedora, Ubuntu, Debian don't do that.
2948
2949 I think we can use `zcat` separately, if we need.
2950
2951
2952 -------------------------------------------------------------------------------
2953
2954 # [\#46 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/46) `closed`: CPU specific options and the kernel cmd line 
2955 **Labels**: `enhancement`
2956
2957
2958 #### <img src="https://avatars.githubusercontent.com/u/3797768?v=4" width="50">[morfikov](https://github.com/morfikov) opened issue at [2020-10-04 15:39](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/46):
2959
2960 I have an Intel CPU, and when I run `kconfig-hardened-check` I get the following FAILs:
2961
2962 ```
2963 CONFIG_AMD_IOMMU                             |      y      |defconfig |  self_protection   |   FAIL: "is not set"
2964 CONFIG_AMD_IOMMU_V2                          |      y      |    my    |  self_protection   |   FAIL: not found
2965 ```
2966
2967 It would be nice to have such CPU specific options hidden in the results. 
2968
2969 The behavior of some options can be controlled via the kernel cmd line, for instance:
2970
2971 ```
2972 CONFIG_SLUB_DEBUG_ON                         |      y      |    my    |  self_protection   |   FAIL: "is not set"
2973 CONFIG_X86_VSYSCALL_EMULATION                | is not set  |  clipos  | cut_attack_surface |   FAIL: "y"
2974 ```
2975
2976 If a user set `slub_debug=FZP` and `vsyscall=none` in the kernel cmd line, I think he would achieve the same behavior. So, `kconfig-hardened-check` could check such kernel cmd line options before giving a FAIL. 
2977
2978 What do you think about such improvements? 
2979
2980 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-10-05 10:09](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/46#issuecomment-703535817):
2981
2982 Hi @morfikov, thanks for your ideas.
2983
2984 1. I think we can group AMD_IOMMU recommendations with the corresponding ones for Intel using `OR`.
2985 That would allow to avoid incorrect FAIL reports.
2986
2987 2. Parsing the kernel command line is a nice feature, it's on my TODO list. Moreover, we can get it from `/proc/cmdline` without additional privileges, which is nice.
2988
2989 I'm going to work on `kconfig-hardened-check` in the coming days.
2990 If you want to participate, come on, your pull requests will be welcome!
2991
2992 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2020-10-05 11:03](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/46#issuecomment-703560552):
2993
2994 I always seen this project scope as simple kernel config checker not running system audit tool and I believe in old  unix mantra _Do One Thing and Do It Well_ so I'm skeptical about this additions. Taking  `/proc/cmdline` into account would mean same config would yield different result across systems. Having OR between amd and intel features make it less useful for distros which would want them all.
2995
2996 I think end users are capable of ignoring amd warnings when they have intel cpu and the opposite and also be aware o what they added to their cmdline.
2997
2998 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-10-05 11:55](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/46#issuecomment-703583549):
2999
3000 Hi @Bernhard40 
3001
3002 > Having OR between amd and intel features make it less useful for distros which would want them all.
3003
3004 Hm, you are right. I would agree on that point.
3005
3006 > Taking /proc/cmdline into account would mean same config would yield different result across systems
3007
3008 I would propose a compromise: add a separate flag for checking `/proc/cmdline` (disabled by default).
3009 Is it OK for you?
3010
3011 In fact, I see checking cmdline parameters as a very big improvement.
3012 There are several important cases when checking kernel config is not enough for a correct conclusion about the kernel security.
3013 Examples: `mitigations`, `page_poison`, `init_on_alloc/init_on_free` and some others.
3014
3015 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2020-10-05 20:35](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/46#issuecomment-703873764):
3016
3017 > I would propose a compromise: add a separate flag for checking /proc/cmdline (disabled by default).
3018 > Is it OK for you?
3019
3020 I don't mind if you are ready to maintain it.
3021
3022 > In fact, I see checking cmdline parameters as a very big improvement.
3023 > There are several important cases when checking kernel config is not enough for a correct conclusion about the kernel security.
3024
3025 Yes but for now checking kernel config is the only thing this project ever promised (see readme). Conclusions about kernel security needs expanding the project scope which may be a rabbit hole as if you add cmdlne support then sysctl support should be next etc.
3026
3027 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-10-05 21:01](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/46#issuecomment-703886769):
3028
3029 @Bernhard40, I'll do my best.
3030
3031 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2022-05-28 19:19](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/46#issuecomment-1140317020):
3032
3033 Now kconfig-hardened-check supports checking kernel cmdline parameters.
3034
3035 Cool!
3036
3037 ```
3038 usage: kconfig-hardened-check [-h] [--version] [-p {X86_64,X86_32,ARM64,ARM}]
3039                               [-c CONFIG]
3040                               [-l CMDLINE]
3041                               [-m {verbose,json,show_ok,show_fail}]
3042
3043 A tool for checking the security hardening options of the Linux kernel
3044
3045 optional arguments:
3046   -h, --help            show this help message and exit
3047   --version             show program's version number and exit
3048   -p {X86_64,X86_32,ARM64,ARM}, --print {X86_64,X86_32,ARM64,ARM}
3049                         print security hardening preferences for the selected architecture
3050   -c CONFIG, --config CONFIG
3051                         check the kernel kconfig file against these preferences
3052   -l CMDLINE, --cmdline CMDLINE
3053                         check the kernel cmdline file against these preferences
3054   -m {verbose,json,show_ok,show_fail}, --mode {verbose,json,show_ok,show_fail}
3055                         choose the report mode
3056 ```
3057
3058
3059 -------------------------------------------------------------------------------
3060
3061 # [\#45 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/45) `closed`: Request for command line options to display only OK/FAIL items
3062
3063 #### <img src="https://avatars.githubusercontent.com/u/14027079?u=379b0b0fcecea8820dea0f220dc09e3342cc4519&v=4" width="50">[fonic](https://github.com/fonic) opened issue at [2020-07-13 10:07](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/45):
3064
3065 I'd like to request command line options to reduce output to OK/FAIL items only, e.g.
3066 ```
3067 -o, --ok      only list items checked as OK
3068 -f, --fail    only list items checked as FAIL
3069 ```
3070
3071 This would make it much easier to work through the list of settings when hardening kernel configurations, especially if one only applies few at a time to test their impact.
3072
3073 This tool is great, many thanks!
3074
3075 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-07-15 11:55](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/45#issuecomment-658724615):
3076
3077 Hello @fonic,
3078
3079 Please see `show_ok` and `show_fail` modes:
3080 ```
3081 usage: kconfig-hardened-check [-h] [--version] [-p {X86_64,X86_32,ARM64,ARM}]
3082                               [-c CONFIG]
3083                               [-m {verbose,json,show_ok,show_fail}]
3084
3085 Checks the hardening options in the Linux kernel config
3086
3087 optional arguments:
3088   -h, --help            show this help message and exit
3089   --version             show program's version number and exit
3090   -p {X86_64,X86_32,ARM64,ARM}, --print {X86_64,X86_32,ARM64,ARM}
3091                         print hardening preferences for selected architecture
3092   -c CONFIG, --config CONFIG
3093                         check the kernel config file against these preferences
3094   -m {verbose,json,show_ok,show_fail}, --mode {verbose,json,show_ok,show_fail}
3095                         choose the report mode
3096 ```
3097
3098 Output example:
3099 ```
3100 $ ./bin/kconfig-hardened-check -c kconfig_hardened_check/config_files/distros/ubuntu-focal.config -m show_ok
3101 [+] Special report mode: show_ok
3102 [+] Config file to check: kconfig_hardened_check/config_files/distros/ubuntu-focal.config
3103 [+] Detected architecture: X86_64
3104 [+] Detected kernel version: 5.4
3105 =========================================================================================================================
3106                  option name                 | desired val | decision |       reason       |   check result
3107 =========================================================================================================================
3108 CONFIG_BUG                                   |      y      |defconfig |  self_protection   |   OK
3109 CONFIG_SLUB_DEBUG                            |      y      |defconfig |  self_protection   |   OK
3110 CONFIG_STACKPROTECTOR_STRONG                 |      y      |defconfig |  self_protection   |   OK
3111 CONFIG_STRICT_KERNEL_RWX                     |      y      |defconfig |  self_protection   |   OK
3112 CONFIG_STRICT_MODULE_RWX                     |      y      |defconfig |  self_protection   |   OK
3113 CONFIG_IOMMU_SUPPORT                         |      y      |defconfig |  self_protection   |   OK
3114 CONFIG_MICROCODE                             |      y      |defconfig |  self_protection   |   OK
3115 CONFIG_RETPOLINE                             |      y      |defconfig |  self_protection   |   OK
3116 CONFIG_X86_SMAP                              |      y      |defconfig |  self_protection   |   OK
3117 CONFIG_SYN_COOKIES                           |      y      |defconfig |  self_protection   |   OK
3118 CONFIG_X86_UMIP                              |      y      |defconfig |  self_protection   |   OK: CONFIG_X86_INTEL_UMIP "y"
3119 CONFIG_PAGE_TABLE_ISOLATION                  |      y      |defconfig |  self_protection   |   OK
3120 CONFIG_RANDOMIZE_MEMORY                      |      y      |defconfig |  self_protection   |   OK
3121 CONFIG_INTEL_IOMMU                           |      y      |defconfig |  self_protection   |   OK
3122 CONFIG_AMD_IOMMU                             |      y      |defconfig |  self_protection   |   OK
3123 CONFIG_VMAP_STACK                            |      y      |defconfig |  self_protection   |   OK
3124 CONFIG_RANDOMIZE_BASE                        |      y      |defconfig |  self_protection   |   OK
3125 CONFIG_THREAD_INFO_IN_TASK                   |      y      |defconfig |  self_protection   |   OK
3126 CONFIG_DEBUG_WX                              |      y      |   kspp   |  self_protection   |   OK
3127 CONFIG_SCHED_STACK_END_CHECK                 |      y      |   kspp   |  self_protection   |   OK
3128 CONFIG_SLAB_FREELIST_HARDENED                |      y      |   kspp   |  self_protection   |   OK
3129 CONFIG_SLAB_FREELIST_RANDOM                  |      y      |   kspp   |  self_protection   |   OK
3130 CONFIG_SHUFFLE_PAGE_ALLOCATOR                |      y      |   kspp   |  self_protection   |   OK
3131 CONFIG_FORTIFY_SOURCE                        |      y      |   kspp   |  self_protection   |   OK
3132 CONFIG_INIT_ON_ALLOC_DEFAULT_ON              |      y      |   kspp   |  self_protection   |   OK
3133 CONFIG_HARDENED_USERCOPY                     |      y      |   kspp   |  self_protection   |   OK
3134 CONFIG_MODULE_SIG                            |      y      |   kspp   |  self_protection   |   OK
3135 CONFIG_MODULE_SIG_ALL                        |      y      |   kspp   |  self_protection   |   OK
3136 CONFIG_MODULE_SIG_SHA512                     |      y      |   kspp   |  self_protection   |   OK
3137 CONFIG_INIT_ON_FREE_DEFAULT_ON               |      y      |   kspp   |  self_protection   |   OK: CONFIG_PAGE_POISONING "y"
3138 CONFIG_DEFAULT_MMAP_MIN_ADDR                 |    65536    |   kspp   |  self_protection   |   OK
3139 CONFIG_INTEL_IOMMU_SVM                       |      y      |  clipos  |  self_protection   |   OK
3140 CONFIG_RESET_ATTACK_MITIGATION               |      y      |    my    |  self_protection   |   OK
3141 CONFIG_SECURITY                              |      y      |defconfig |  security_policy   |   OK
3142 CONFIG_SECURITY_YAMA                         |      y      |   kspp   |  security_policy   |   OK
3143 CONFIG_SECURITY_WRITABLE_HOOKS               | is not set  |    my    |  security_policy   |   OK: not found
3144 CONFIG_SECURITY_LOCKDOWN_LSM                 |      y      |  clipos  |  security_policy   |   OK
3145 CONFIG_SECURITY_LOCKDOWN_LSM_EARLY           |      y      |  clipos  |  security_policy   |   OK
3146 CONFIG_SECURITY_SAFESETID                    |      y      |    my    |  security_policy   |   OK
3147 CONFIG_SECCOMP                               |      y      |defconfig | cut_attack_surface |   OK
3148 CONFIG_SECCOMP_FILTER                        |      y      |defconfig | cut_attack_surface |   OK
3149 CONFIG_STRICT_DEVMEM                         |      y      |defconfig | cut_attack_surface |   OK
3150 CONFIG_ACPI_CUSTOM_METHOD                    | is not set  |   kspp   | cut_attack_surface |   OK
3151 CONFIG_COMPAT_BRK                            | is not set  |   kspp   | cut_attack_surface |   OK
3152 CONFIG_DEVKMEM                               | is not set  |   kspp   | cut_attack_surface |   OK
3153 CONFIG_COMPAT_VDSO                           | is not set  |   kspp   | cut_attack_surface |   OK
3154 CONFIG_OABI_COMPAT                           | is not set  |   kspp   | cut_attack_surface |   OK: not found
3155 CONFIG_X86_PTDUMP                            | is not set  |grsecurity| cut_attack_surface |   OK
3156 CONFIG_ZSMALLOC_STAT                         | is not set  |grsecurity| cut_attack_surface |   OK
3157 CONFIG_PAGE_OWNER                            | is not set  |grsecurity| cut_attack_surface |   OK
3158 CONFIG_DEBUG_KMEMLEAK                        | is not set  |grsecurity| cut_attack_surface |   OK
3159 CONFIG_BINFMT_AOUT                           | is not set  |grsecurity| cut_attack_surface |   OK: not found
3160 CONFIG_DRM_LEGACY                            | is not set  |maintainer| cut_attack_surface |   OK
3161 CONFIG_X86_IOPL_IOPERM                       | is not set  | lockdown | cut_attack_surface |   OK: not found
3162 CONFIG_MMIOTRACE_TEST                        | is not set  | lockdown | cut_attack_surface |   OK
3163 CONFIG_X86_INTEL_TSX_MODE_OFF                |      y      |  clipos  | cut_attack_surface |   OK
3164 CONFIG_INTEGRITY                             |      y      |defconfig |userspace_hardening |   OK
3165
3166 [+] Config check is finished: 'OK' - 57 / 'FAIL' - 79 (suppressed in output)
3167 ```
3168
3169 #### <img src="https://avatars.githubusercontent.com/u/14027079?u=379b0b0fcecea8820dea0f220dc09e3342cc4519&v=4" width="50">[fonic](https://github.com/fonic) commented at [2020-07-15 15:14](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/45#issuecomment-658827875):
3170
3171 Awesome, just tested it. That makes an already great tool even better. Many thanks!
3172
3173
3174 -------------------------------------------------------------------------------
3175
3176 # [\#44 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/44) `closed`: KSPP future in defconf linux distribution.
3177
3178 #### <img src="https://avatars.githubusercontent.com/u/3471772?v=4" width="50">[bryn1u](https://github.com/bryn1u) opened issue at [2020-05-10 18:01](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/44):
3179
3180 Hello,
3181
3182 Im just curious what is the status of implementing KSPP to default kernel of linux GNU distribution ? Why linux distributions dont impelment for example most of kspp solutions for example steackleak or gcc hardeneing ? I use most of kspp feature based on your script Alexander and kernel works like a charm. Someone can explain to me ?
3183
3184 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2020-05-11 11:40](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/44#issuecomment-626650276):
3185
3186 Some settings may affect performance, debugability, support for older userspace software, etc.
3187
3188 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-05-18 09:58](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/44#issuecomment-630078520):
3189
3190 > Some settings may affect performance, debugability, support for older userspace software, etc.
3191
3192 I agree. 
3193 Moreover, kernel self-protection features often give different performance penalty for different kinds of workload. It's difficult to find one kernel configuration that makes everyone happy.
3194
3195 I think Linux distributions could provide several kernel flavours for different purposes (e.g. generic, hardened, low-latency), to improve the situation.
3196
3197 I'm sure @kees has more insights about this.
3198
3199 #### <img src="https://avatars.githubusercontent.com/u/1110841?u=e5e99e1ac8260e791433baa2423f7d173eea4c1c&v=4" width="50">[kees](https://github.com/kees) commented at [2020-05-18 15:16](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/44#issuecomment-630251690):
3200
3201 Yup! There is an open bug with KSPP to provide a defconfig fragment selection interface to the upstream kernel. You can see more details here:
3202 https://github.com/KSPP/linux/issues/14
3203
3204 #### <img src="https://avatars.githubusercontent.com/u/3471772?v=4" width="50">[bryn1u](https://github.com/bryn1u) commented at [2020-05-20 21:06](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/44#issuecomment-631726899):
3205
3206 Okey. Thanks guys for your work and explanation.
3207
3208
3209 -------------------------------------------------------------------------------
3210
3211 # [\#43 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/43) `merged`: Upgrading to Ubuntu 20.04 kernel config
3212
3213 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) opened issue at [2020-05-05 09:12](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/43):
3214
3215 Hi @a13xp0p0v, 
3216
3217 Here is the Ubuntu kernel configuration update.
3218
3219 Best regards.
3220
3221 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-05-06 21:41](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/43#issuecomment-624906056):
3222
3223 Thanks @HacKurx!
3224
3225
3226 -------------------------------------------------------------------------------
3227
3228 # [\#42 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/42) `closed`: add tests
3229
3230 #### <img src="https://avatars.githubusercontent.com/u/3125993?v=4" width="50">[shamilbi](https://github.com/shamilbi) opened issue at [2020-04-14 12:10](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/42):
3231
3232
3233
3234 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-04-24 23:29](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/42#issuecomment-619279461):
3235
3236 Hello @shamilbi !
3237 Could you please describe the purpose of this PR?
3238 By the way, tests for `kconfig-hardened-check` already exist as GitHub Actions (kind of continuous integration).
3239
3240 #### <img src="https://avatars.githubusercontent.com/u/3125993?v=4" width="50">[shamilbi](https://github.com/shamilbi) commented at [2020-04-25 07:33](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/42#issuecomment-619335943):
3241
3242 > Hello @shamilbi !
3243 > Could you please describe the purpose of this PR?
3244 > By the way, tests for `kconfig-hardened-check` already exist as GitHub Actions (kind of continuous integration).
3245
3246 If files `tests/results/**/*.check` are proper results of kconfig-hardened-check applied to `kconfig_hardened_check/config_files/**/*.config` then this PR just compares output of a current kconfig_hardened_check (a current commit) with those proper results.
3247 This gives you an exact diff in output from a last commit
3248
3249 #### <img src="https://avatars.githubusercontent.com/u/3125993?v=4" width="50">[shamilbi](https://github.com/shamilbi) commented at [2020-04-25 07:43](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/42#issuecomment-619337059):
3250
3251 [My workflows file](https://github.com/shamilbi/kconfig-hardened-check/blob/master/.github/workflows/test-master.yml)
3252
3253 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-05-06 21:19](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/42#issuecomment-624897025):
3254
3255 Yes, sometimes I use ouput diff during the `kconfig-hardened-check` development.
3256 However I don't think we need to commit the output results to the repository.
3257 Thank you anyway.
3258
3259
3260 -------------------------------------------------------------------------------
3261
3262 # [\#41 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/41) `merged`: Add CONFIG_INPUT_EVBUG
3263
3264 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) opened issue at [2020-04-09 11:38](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/41):
3265
3266 Hi @a13xp0p0v,
3267
3268 The "evbug" module records key events and mouse movements in the system log.
3269 Useful for debugging, this is a security threat, its use can be hijacked as a keylogger.
3270
3271 An attacker will be able to retrieve your passwords using this module.
3272
3273 Thank you.
3274
3275 Best regards,
3276
3277 #### <img src="https://avatars.githubusercontent.com/u/8655789?u=4694f03b321aa2287d9fe05155adcddb23272e81&v=4" width="50">[codecov-io](https://github.com/codecov-io) commented at [2020-04-09 11:39](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/41#issuecomment-611482374):
3278
3279 # [Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/41?src=pr&el=h1) Report
3280 > Merging [#41](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/41?src=pr&el=desc) into [master](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/commit/100a39e2b01dadd2d27ed805cbe2b4ead7fc8b05&el=desc) will **increase** coverage by `0.01%`.
3281 > The diff coverage is `100.00%`.
3282
3283 [![Impacted file tree graph](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/41/graphs/tree.svg?width=650&height=150&src=pr&token=GOOVXMV5Kb)](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/41?src=pr&el=tree)
3284
3285 ```diff
3286 @@            Coverage Diff             @@
3287 ##           master      #41      +/-   ##
3288 ==========================================
3289 + Coverage   93.19%   93.20%   +0.01%     
3290 ==========================================
3291   Files           3        3              
3292   Lines         470      471       +1     
3293   Branches      100      100              
3294 ==========================================
3295 + Hits          438      439       +1     
3296   Misses         17       17              
3297   Partials       15       15              
3298 ```
3299
3300 | Flag | Coverage Δ | |
3301 |---|---|---|
3302 | #functional_test | `93.20% <100.00%> (+0.01%)` | :arrow_up: |
3303
3304 | [Impacted Files](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/41?src=pr&el=tree) | Coverage Δ | |
3305 |---|---|---|
3306 | [kconfig\_hardened\_check/\_\_init\_\_.py](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/41/diff?src=pr&el=tree#diff-a2NvbmZpZ19oYXJkZW5lZF9jaGVjay9fX2luaXRfXy5weQ==) | `93.27% <100.00%> (+0.01%)` | :arrow_up: |
3307
3308 ------
3309
3310 [Continue to review full report at Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/41?src=pr&el=continue).
3311 > **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
3312 > `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
3313 > Powered by [Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/41?src=pr&el=footer). Last update [100a39e...a7e1677](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/41?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).
3314
3315
3316 -------------------------------------------------------------------------------
3317
3318 # [\#40 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/40) `merged`: pylint some code
3319
3320 #### <img src="https://avatars.githubusercontent.com/u/3125993?v=4" width="50">[shamilbi](https://github.com/shamilbi) opened issue at [2020-04-08 07:01](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/40):
3321
3322
3323
3324 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-04-09 15:35](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/40#issuecomment-611595095):
3325
3326 Thanks @shamilbi.
3327 Merged.
3328
3329
3330 -------------------------------------------------------------------------------
3331
3332 # [\#39 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/39) `closed`: VerCheck: work with 3-digit kernel versions
3333
3334 #### <img src="https://avatars.githubusercontent.com/u/3125993?v=4" width="50">[shamilbi](https://github.com/shamilbi) opened issue at [2020-04-03 15:54](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/39):
3335
3336
3337
3338 #### <img src="https://avatars.githubusercontent.com/u/8655789?u=4694f03b321aa2287d9fe05155adcddb23272e81&v=4" width="50">[codecov-io](https://github.com/codecov-io) commented at [2020-04-03 16:25](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/39#issuecomment-608535796):
3339
3340 # [Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/39?src=pr&el=h1) Report
3341 > Merging [#39](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/39?src=pr&el=desc) into [master](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/commit/bdac2c22b96b3a682801674efed92fddc8a347b0&el=desc) will **increase** coverage by `0.60%`.
3342 > The diff coverage is `76.92%`.
3343
3344 [![Impacted file tree graph](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/39/graphs/tree.svg?width=650&height=150&src=pr&token=GOOVXMV5Kb)](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/39?src=pr&el=tree)
3345
3346 ```diff
3347 @@            Coverage Diff             @@
3348 ##           master      #39      +/-   ##
3349 ==========================================
3350 + Coverage   93.10%   93.70%   +0.60%     
3351 ==========================================
3352   Files           2        2              
3353   Lines         464      461       -3     
3354   Branches      100      101       +1     
3355 ==========================================
3356   Hits          432      432              
3357 + Misses         17       15       -2     
3358 + Partials       15       14       -1     
3359 ```
3360
3361 | Flag | Coverage Δ | |
3362 |---|---|---|
3363 | #functional_test | `93.70% <76.92%> (+0.60%)` | :arrow_up: |
3364
3365 | [Impacted Files](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/39?src=pr&el=tree) | Coverage Δ | |
3366 |---|---|---|
3367 | [kconfig\_hardened\_check/\_\_init\_\_.py](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/39/diff?src=pr&el=tree#diff-a2NvbmZpZ19oYXJkZW5lZF9jaGVjay9fX2luaXRfXy5weQ==) | `93.80% <76.92%> (+0.61%)` | :arrow_up: |
3368
3369 ------
3370
3371 [Continue to review full report at Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/39?src=pr&el=continue).
3372 > **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
3373 > `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
3374 > Powered by [Codecov](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/39?src=pr&el=footer). Last update [bdac2c2...97b9f90](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check/pull/39?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).
3375
3376 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-04-06 13:32](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/39#issuecomment-609796546):
3377
3378 Hello @shamilbi,
3379 Thanks for your work!
3380
3381 Yes, the kernel version consists of 3 numbers (not digits). 
3382 Example from the main kernel Makefile:
3383 ```
3384 VERSION = 5
3385 PATCHLEVEL = 6
3386 SUBLEVEL = 0
3387 ```
3388
3389 New features come during the merge window of a new release of the mainline kernel.
3390 It is defined by 2 numbers - `version` and `patchlevel`.
3391 More info: https://www.kernel.org/doc/html/latest/process/2.Process.html
3392 That's why currently only two numbers are checked and IMO that's enough.
3393
3394 Thanks!
3395 Alexander
3396
3397 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-04-07 15:47](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/39#issuecomment-610465555):
3398
3399 @shamilbi, could you please move pylint fixes to a separate pull request?
3400 I would like to merge it. Thanks!
3401
3402 #### <img src="https://avatars.githubusercontent.com/u/3125993?v=4" width="50">[shamilbi](https://github.com/shamilbi) commented at [2020-04-08 08:35](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/39#issuecomment-610828778):
3403
3404 > @shamilbi, could you please move pylint fixes to a separate pull request?
3405 > I would like to merge it. Thanks!
3406 OK, done
3407
3408
3409 -------------------------------------------------------------------------------
3410
3411 # [\#38 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/38) `closed`: graphics related options
3412 **Labels**: `kernel_maintainer_feedback`
3413
3414
3415 #### <img src="https://avatars.githubusercontent.com/u/5088003?v=4" width="50">[danvet](https://github.com/danvet) opened issue at [2020-04-03 08:52](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/38):
3416
3417 Discussion with dmitry yukov on twitter:
3418
3419 CONFIG_DRM_LEGACY: Really old drivers from the 90s, with unfixable by design security holes. Unfortunately userspace for one modern driver (drm/nouveau) has used until just a few years ago by accident (we didn't delete all the old legacy driver setup code), so can't remove it all completely yet from kernel sources.
3420
3421 CONFIG_FB: Old display subsystem from the 90s, essentially unmaintained for over 10 years, would need serious effort to get up to speed with modern security best practices. This even includes the minimal fbdev emulation support built on top of drm gpu drivers, since the issues are in core fbdev code.
3422
3423 CONFIG_VT: Maybe the most disputed of all, but a lot of the console drivers this exposes to userspace are also from the 90s, and without CONFIG_FB this isn't really useful even for a desktop. A hardened distro definitely wants to make sure this is not set at all.
3424
3425
3426
3427 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2020-04-03 12:03](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/38#issuecomment-608395946):
3428
3429 > You need at least one virtual terminal device in order to make use of your keyboard and monitor. Therefore, only people configuring an embedded system would want to say N here in order to save some memory; the only way to log into such a system is then via a serial or network connection.
3430
3431 Is this comment from [CONFIG_VT](https://cateee.net/lkddb/web-lkddb/VT.html) wrong then?
3432
3433 #### <img src="https://avatars.githubusercontent.com/u/5088003?v=4" width="50">[danvet](https://github.com/danvet) commented at [2020-04-03 12:32](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/38#issuecomment-608407778):
3434
3435 This comment hasn't been updated since decades (I checked historical trees ...). Nowadays Xorg and wayland compositors should be able to run without a VT. And kmscon (although abandoned due to lack of interest) can provide you a userspace implementation of VTs if you don't want to run X11 or wayland, using pseudo TTYs (like a terminal emulator).
3436
3437 A paranoid desktop distro imo should really not have VT enabled, and ofc whatever compositor they opt for (wayland, X11, or something like kmscon) needs to be walled in with a container.
3438
3439 But the comment is also correct in that without a userspace compositor you indeed will only be able to log in through the network or serial lines.
3440
3441 #### <img src="https://avatars.githubusercontent.com/u/5088003?v=4" width="50">[danvet](https://github.com/danvet) commented at [2020-04-03 12:42](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/38#issuecomment-608412082):
3442
3443 Maybe an addition: If you want multi-user switching without CONFIG_VT then you need something like systemd's logind, so that the (forced) handover of input and output devices works correctly. But the VT subsystem's only role there is as an rpc between compositors, it has 0 functionality to actually force compositors to hand over devices to the next compositor (which is what logind does, using some of the new ioctl calls added specifically for this for both input and drm subsystems).
3444
3445 So if you want actual secure multi-user switching then you should be running with all that new stuff already anyway (and then CONFIG_VT really shouldn't be enabled, to prevent creating a mess).
3446
3447 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-04-03 17:03](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/38#issuecomment-608553993):
3448
3449 Thanks @danvet !
3450 Done: https://github.com/a13xp0p0v/kconfig-hardened-check/commit/75bed5d6178375a64f93ced4795ee0cf47442df1
3451
3452 #### <img src="https://avatars.githubusercontent.com/u/5088003?v=4" width="50">[danvet](https://github.com/danvet) commented at [2020-04-03 17:24](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/38#issuecomment-608563651):
3453
3454 Thanks, looks neat. Hopefully this pushes a few more people to make this happen finally.
3455
3456 #### <img src="https://avatars.githubusercontent.com/u/1095328?u=91175c42d0de0ad8ba9f70cc6b9a41bbfbe70de8&v=4" width="50">[dvyukov](https://github.com/dvyukov) commented at [2020-04-03 17:28](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/38#issuecomment-608565745):
3457
3458 @a13xp0p0v Are these enabled in any distros for which you have canned configs?
3459
3460 @danvet I just noticed on the current upstream HEAD:
3461 ```
3462 $ rm .config
3463 $ make defconfig
3464 $ egrep "CONFIG_VT=|CONFIG_FB=" .config
3465 CONFIG_VT=y
3466 CONFIG_FB=y
3467 ```
3468 So that may be the first step :)
3469
3470 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-04-03 20:18](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/38#issuecomment-608639217):
3471
3472 @dvyukov, yes, these are enabled in many distributions:
3473 ```
3474 AOSP_Pixel3A:
3475   CONFIG_DRM_LEGACY    | is not set  |maintainer| cut_attack_surface |   OK
3476   CONFIG_FB            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3477   CONFIG_VT            | is not set  |maintainer| cut_attack_surface |   OK
3478
3479 AmazonLinux2:
3480   CONFIG_DRM_LEGACY    | is not set  |maintainer| cut_attack_surface |   OK
3481   CONFIG_FB            | is not set  |maintainer| cut_attack_surface |   FAIL: "m"
3482   CONFIG_VT            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3483
3484 ubuntu-bionic-generic:
3485   CONFIG_DRM_LEGACY    | is not set  |maintainer| cut_attack_surface |   OK
3486   CONFIG_FB            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3487   CONFIG_VT            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3488
3489 oracle-uek6:
3490   CONFIG_DRM_LEGACY    | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3491   CONFIG_FB            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3492   CONFIG_VT            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3493
3494 Archlinux-hardened:
3495   CONFIG_DRM_LEGACY    | is not set  |maintainer| cut_attack_surface |   OK
3496   CONFIG_FB            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3497   CONFIG_VT            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3498
3499 clearlinux-master:
3500   CONFIG_DRM_LEGACY    | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3501   CONFIG_FB            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3502   CONFIG_VT            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3503
3504 SLE15:
3505   CONFIG_DRM_LEGACY    | is not set  |maintainer| cut_attack_surface |   OK
3506   CONFIG_FB            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3507   CONFIG_VT            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3508
3509 openSUSE-15.1:
3510   CONFIG_DRM_LEGACY    | is not set  |maintainer| cut_attack_surface |   OK
3511   CONFIG_FB            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3512   CONFIG_VT            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3513
3514 pentoo-livecd:
3515   CONFIG_DRM_LEGACY    | is not set  |maintainer| cut_attack_surface |   OK
3516   CONFIG_FB            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3517   CONFIG_VT            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3518
3519 rhel-8.0:
3520   CONFIG_DRM_LEGACY    | is not set  |maintainer| cut_attack_surface |   OK
3521   CONFIG_FB            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3522   CONFIG_VT            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3523
3524 nixpkgs-linux_hardened:
3525   CONFIG_DRM_LEGACY    | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3526   CONFIG_FB            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3527   CONFIG_VT            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3528
3529 debian-buster:
3530   CONFIG_DRM_LEGACY    | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3531   CONFIG_FB            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3532   CONFIG_VT            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3533
3534 Alpinelinux-edge:
3535   CONFIG_DRM_LEGACY    | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3536   CONFIG_FB            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3537   CONFIG_VT            | is not set  |maintainer| cut_attack_surface |   FAIL: "y"
3538 ```
3539
3540 #### <img src="https://avatars.githubusercontent.com/u/1080275?v=4" width="50">[arndb](https://github.com/arndb) commented at [2020-04-04 09:48](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/38#issuecomment-609004574):
3541
3542 The hyperv framebuffer driver came up on the mailing list recently when I noticed a patch to add support for arm64 and suggested having it converted to DRM. Other hardware-independent drivers that don't seem to have a DRM counterpart at the moment are the UEFI framebuffer that is often used in the absence of a hardware specific driver and the goldfish driver for Android device emulation.
3543
3544 It might help to also look at each distro to see which device drivers are enabled for DRM_LEGACY and FBDEV, as there may be others that are important and need to be converted.
3545
3546 #### <img src="https://avatars.githubusercontent.com/u/5088003?v=4" width="50">[danvet](https://github.com/danvet) commented at [2020-04-04 11:12](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/38#issuecomment-609012871):
3547
3548 @dvyukov the trouble is you'll break pretty much any general purpose distro with this stuff disabled. Iirc most compositors keel over if they can't open a vt (but they should all have options to survive without one). Plus since neither kmscon nor system-consoled ever happened for real no kernel console without these, so all the whitebeards will be screaming with their pitchforks. Really not something you can do in a defconfig unfortunately.
3549
3550 @arndb yeah there was simpledrm also back around kmscon to make this happen, but it didn't. For everything else we seem to have a small community of people now pushing out drm drivers for all these things, but more is always welcome. A drm driver in less that 1kloc is fairly standard nowadays, trouble only happens if you have a strange new constraint.
3551
3552 Wrt DRM_LEGACY and FBDEV drivers in general, I get the impression that distros which enable them just enable everything, because. E.g. debian still enables DRM_LEGACY, but they long ago stopped shipping the corresponding userspace drivers. So just plain nonsense in their defconfig (and a CVE when you load drm/nouveau.ko because backwards compat)
3553
3554
3555 -------------------------------------------------------------------------------
3556
3557 # [\#37 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/37) `closed`: conflict with the latest grsecurity
3558
3559 #### <img src="https://avatars.githubusercontent.com/u/50359848?v=4" width="50">[pythonmandev](https://github.com/pythonmandev) opened issue at [2020-03-30 14:20](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/37):
3560
3561 CONFIG_REFCOUNT_FULL conflict with PAX_REFCOUNT
3562 PAGE_TABLE_ISOLATION conflict with PAX_MEMORY_UDEREF
3563 VMAP_STACK conflict with GRKERNSEC_KSTACKOVERFLOW
3564 SECURITY_YAMA conflict with GRKERNSEC
3565 RANDOMIZE_BASE also can not enable.
3566
3567 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-03-31 11:29](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/37#issuecomment-606569944):
3568
3569 Hello @pythonmandev!
3570 What do you mean saying "latest grsecurity"?
3571
3572 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2020-03-31 11:38](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/37#issuecomment-606574067):
3573
3574 its not an openly available patchset anymore hence i suggest to not take it into account. I would think differently if it would be open source, but sadly its not.
3575
3576
3577 -------------------------------------------------------------------------------
3578
3579 # [\#36 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/36) `closed`: null
3580
3581 #### <img src="(unknown)" width="50">[(unknown)]((unknown)) opened issue at [2020-03-30 14:13](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/36):
3582
3583 null
3584
3585
3586
3587
3588 -------------------------------------------------------------------------------
3589
3590 # [\#35 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/35) `closed`: can't add version check for constraints in a logical product
3591
3592 #### <img src="https://avatars.githubusercontent.com/u/785111?u=8feaa758657096dbcadcd190fbea88e371aab7be&v=4" width="50">[tych0](https://github.com/tych0) opened issue at [2020-03-26 17:44](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/35):
3593
3594 If I try to do:
3595
3596 ```
3597 diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py
3598 index 3fcb5e0..1c31c40 100755
3599 --- a/kconfig_hardened_check/__init__.py
3600 +++ b/kconfig_hardened_check/__init__.py
3601 @@ -251,8 +251,8 @@ def construct_checklist(checklist, arch):
3602          checklist.append(OptCheck('MICROCODE',                   'y', 'defconfig', 'self_protection')) # is needed for mitigating CPU bugs
3603          checklist.append(OptCheck('RETPOLINE',                   'y', 'defconfig', 'self_protection'))
3604          checklist.append(OptCheck('X86_SMAP',                    'y', 'defconfig', 'self_protection'))
3605 -        checklist.append(OR(OptCheck('X86_UMIP',                 'y', 'defconfig', 'self_protection'), \
3606 -                            OptCheck('X86_INTEL_UMIP',           'y', 'defconfig', 'self_protection')))
3607 +        checklist.append(OR(AND(OptCheck('X86_UMIP',                 'y', 'defconfig', 'self_protection'), VerCheck((5, 5))), \
3608 +                            AND(OptCheck('X86_INTEL_UMIP',           'y', 'defconfig', 'self_protection'), VerCheck((4, 14)))))
3609          checklist.append(OptCheck('SYN_COOKIES',                 'y', 'defconfig', 'self_protection')) # another reason?
3610      if arch == 'X86_64':
3611          checklist.append(OptCheck('PAGE_TABLE_ISOLATION',        'y', 'defconfig', 'self_protection'))
3612 ```
3613
3614 I get:
3615
3616 ```
3617 Traceback (most recent call last):
3618   File "/home/tycho/.local/bin/kconfig-hardened-check", line 10, in <module>
3619     sys.exit(main())
3620   File "/home/tycho/.local/lib/python3.7/site-packages/kconfig_hardened_check/__init__.py", line 611, in main
3621     check_config_file(config_checklist, args.config, arch)
3622   File "/home/tycho/.local/lib/python3.7/site-packages/kconfig_hardened_check/__init__.py", line 554, in check_config_file
3623     perform_checks(checklist, parsed_options)
3624   File "/home/tycho/.local/lib/python3.7/site-packages/kconfig_hardened_check/__init__.py", line 519, in perform_checks
3625     o.state = parsed_options.get(o.name, None)
3626 AttributeError: can't set attribute
3627 ```
3628
3629 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-03-28 20:54](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/35#issuecomment-605518372):
3630
3631 Hello @tych0!
3632 I'm glad that you had a look at this project!
3633 How are you doing? :)
3634
3635 Yes, currently the combination of `ComplexOptCheck` objects is not supported (there have been no cases that needed it).
3636
3637 The original logic behind `X86_UMIP` check:
3638  - if `X86_UMIP` or `X86_INTEL_UMIP` is set to `y`, then `OK`;
3639  - otherwise `FAIL`.
3640
3641 What is the purpose of combining `UMIP` check with version check?
3642
3643 I designed `VerCheck` for cases like that:
3644  - if `REFCOUNT_FULL` is set to `y`, then `OK`;
3645  - if kernel version >= `5.5`, then `OK` (since `REFCOUNT_FULL` is enabled by default and dropped since v5.5);
3646  - otherwise `FAIL`.
3647
3648 N.B. There is an implicit drawback with checking kernel versions.
3649 Some kernel features are backported to previous stable kernels.
3650 That's why checking the version can give false positive or false negative result.
3651 Detailed example: https://github.com/a13xp0p0v/kconfig-hardened-check/pull/32
3652
3653 Thanks!
3654
3655 #### <img src="https://avatars.githubusercontent.com/u/785111?u=8feaa758657096dbcadcd190fbea88e371aab7be&v=4" width="50">[tych0](https://github.com/tych0) commented at [2020-03-29 14:51](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/35#issuecomment-605648635):
3656
3657 On Sat, Mar 28, 2020 at 01:55:08PM -0700, Alexander Popov wrote:
3658 > Hello @tych0!
3659 > I'm glad that you had a look at this project!
3660 > How are you doing? :)
3661
3662 Good, just hacking away :)
3663
3664 > Yes, currently the combination of `ComplexOptCheck` objects is not supported (there have been no cases that needed it).
3665
3666 > The original logic behind `X86_UMIP` check:
3667 >  - if `X86_UMIP` or `X86_INTEL_UMIP` is set to `y`, then `OK`;
3668 >  - otherwise `FAIL`.
3669
3670 > What is the purpose of combining `UMIP` check with version check?
3671
3672 It's only present in 4.15 or greater; I'm running a 4.14 kernel and
3673 kconfig-hardened-check is complaining at me :)
3674
3675 > I designed `VerCheck` for cases like that:
3676 >  - if `REFCOUNT_FULL` is set to `y`, then `OK`;
3677 >  - if kernel version >= `5.5`, then `OK` (since `REFCOUNT_FULL` is enabled by default and dropped since v5.5);
3678 >  - otherwise `FAIL`.
3679
3680 > N.B. There is an implicit drawback with checking kernel versions.
3681 > Some kernel features are backported to previous stable kernels.
3682 > That's why checking the version can give false positive or false negative result.
3683 > Detailed example: https://github.com/a13xp0p0v/kconfig-hardened-check/pull/32
3684
3685 "Not present" is also risky though, if people don't have some of the
3686 dependencies of a feature enabled. A version whitelist seems the best.
3687
3688 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-03-30 21:12](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/35#issuecomment-606252748):
3689
3690 >> What is the purpose of combining `UMIP` check with version check?
3691
3692 > It's only present in 4.15 or greater; I'm running a 4.14 kernel and kconfig-hardened-check is complaining at me :)
3693
3694 Yes, that's good. The tool inspires you to switch onto a newer kernel :)
3695
3696 > "Not present" is also risky though, if people don't have some of the
3697 dependencies of a feature enabled. 
3698
3699 You know, I haven't seen any example of such unmet dependencies. I suppose that kernel feature dependencies are resolved by Kconfig.
3700
3701 > A version whitelist seems the best.
3702
3703 I would like to avoid version checking as much as possible.
3704 Relying on kernel version brings so many troubles!
3705 For example:
3706  - sometimes new features are backported to previous stable kernels,
3707  - sometimes Linux distributions cherry-pick features into their kernels,
3708  - some Linux distributions have custom kernel versioning scheme -- look at Ubuntu or Red Hat.
3709
3710 Finally, the most important aspect.
3711 I like that kernels of different versions are checked against the same list of recommendations.
3712 Hence they can be compared using `OK/FAIL` numbers that are printed by the tool in the end:
3713 ```
3714 [+] config check is finished: 'OK' - 55 / 'FAIL' - 77
3715 ```
3716
3717 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-04-10 16:49](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/35#issuecomment-612117051):
3718
3719 @tych0 your issue reminded me the idea to create some formatted annotations, that can be used for muting checks for a particular kernel. That was discussed in #9.
3720 Thank you.
3721
3722 #### <img src="https://avatars.githubusercontent.com/u/785111?u=8feaa758657096dbcadcd190fbea88e371aab7be&v=4" width="50">[tych0](https://github.com/tych0) commented at [2020-04-10 16:55](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/35#issuecomment-612119721):
3723
3724 Sorry, I read this and forgot to respond :)
3725
3726 > Yes, that's good. The tool inspires you to switch onto a newer kernel :)
3727
3728 Yes, but switching is not so easy sometimes, because of institutional challenges. If we want to add this to our CI to check our kernel configs or something, it would be nice to exclude stuff that doesn't exist in our kernel. I can do this manually, but it would be nicer to have this knowledge baked into the script.
3729
3730 > You know, I haven't seen any example of such unmet dependencies. I suppose that kernel feature dependencies are resolved by Kconfig.
3731
3732 Consider GCC_PLUGIN_STACKLEAK; we'll report "Not present" if the user hasn't set CONFIG_GCC_PLUGINS=n, but it really should be an error.
3733
3734 #### <img src="https://avatars.githubusercontent.com/u/785111?u=8feaa758657096dbcadcd190fbea88e371aab7be&v=4" width="50">[tych0](https://github.com/tych0) commented at [2020-04-10 16:56](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/35#issuecomment-612119803):
3735
3736 Anwyay, I'll check out the updates, thanks :)
3737
3738
3739 -------------------------------------------------------------------------------
3740
3741 # [\#34 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/34) `merged`: GrapheneOS is the continuation of CopperheadOS
3742
3743 #### <img src="https://avatars.githubusercontent.com/u/50278627?v=4" width="50">[madaidan](https://github.com/madaidan) opened issue at [2020-03-22 19:44](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/34):
3744
3745 "CopperheadOS" is the project's legacy name which is now being used for a scam focused on attacking GrapheneOS, the true continuation.
3746
3747 https://twitter.com/DanielMicay/status/1171170734380654597
3748
3749 https://twitter.com/DanielMicay/status/1160831422908829696
3750
3751 https://old.reddit.com/r/CopperheadOS/comments/8qdnn3/goodbye/
3752
3753 https://github.com/yegortimoshenko/copperhead-takeover
3754
3755
3756
3757
3758 -------------------------------------------------------------------------------
3759
3760 # [\#33 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/33) `closed`: CONFIG_STATIC_USERMODEHELPER
3761
3762 #### <img src="https://avatars.githubusercontent.com/u/543852?v=4" width="50">[anthonyryan1](https://github.com/anthonyryan1) opened issue at [2020-03-20 22:25](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/33):
3763
3764 I read over the CLIP OS notes regarding this option, and they also mention that they are not currently using it in the second paragraph.
3765
3766 It seems to be that this option isn't actually helpful unless you've already got a usermode helper program?
3767
3768 Just questioning the wisdom of this option as I imagine some people will just enable everything they see here, and may wind up with this pointing at a non-existent binary.
3769
3770 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2020-03-21 10:52](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/33#issuecomment-602026415):
3771
3772 Yes, this option needs userspace support and yes, blindly enabling everything may cause harm.
3773
3774 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-03-23 15:22](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/33#issuecomment-602670488):
3775
3776 @Bernhard40, absolutely agree.
3777 N.B. There is a comment about `STATIC_USERMODEHELPER` in the source code:
3778 ```
3779 checklist.append(OptCheck('STATIC_USERMODEHELPER', 'y', 'clipos', 'self_protection')) # needs userspace support (systemd)
3780 ```
3781
3782
3783 -------------------------------------------------------------------------------
3784
3785 # [\#32 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/32) `closed`: Fix LDISC_AUTOLOAD check
3786
3787 #### <img src="https://avatars.githubusercontent.com/u/50278627?v=4" width="50">[madaidan](https://github.com/madaidan) opened issue at [2020-03-09 18:01](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/32):
3788
3789 CONFIG_LDISC_AUTOLOAD has existed since v4.14, not v5.1: https://lkml.org/lkml/2019/4/15/890
3790
3791 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-03-14 09:52](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/32#issuecomment-599034709):
3792
3793 Hello @madaidan,
3794
3795 Thanks for noticing that!
3796
3797 CONFIG_LDISC_AUTOLOAD was introduced in 5.1:
3798 changelog https://kernelnewbies.org/Linux_5.1
3799 upstream commit https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7c0cca7c847e6e019d67b7d793efbbe3b947d004
3800
3801 I checked, it was later backported to stable kernels 4.14, 4.9 and 4.4.
3802 So we can't have a correct check based on a kernel version.
3803 For example this option exists in kernel 4.4.216, but doesn't exist in 4.5.
3804
3805 I think the correct approach here is to add another type of check that can distinguish "is not set" and "not found".
3806
3807 What do you think?
3808
3809 #### <img src="https://avatars.githubusercontent.com/u/50278627?v=4" width="50">[madaidan](https://github.com/madaidan) commented at [2020-03-14 20:29](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/32#issuecomment-599131303):
3810
3811 How about a whitelist of allowed versions? So it checks for 4.4, 4.9, 4.14 or ≥5.1 but not 4.5.
3812
3813 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-03-31 11:46](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/32#issuecomment-606577240):
3814
3815 Hm, I got an idea.
3816 I'll try to create a new check that the option __exists__ in the config.
3817 So for `LDISC_AUTOLOAD` we can create a rule `(exists) AND (is not set)`.
3818
3819 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-03-31 14:13](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/32#issuecomment-606654029):
3820
3821 Done!
3822 Thanks!
3823
3824
3825 -------------------------------------------------------------------------------
3826
3827 # [\#31 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/31) `merged`: Update config files
3828
3829 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) opened issue at [2020-02-24 20:27](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/31):
3830
3831 Hi @a13xp0p0v, 
3832
3833 Here are the updates of the distributions configuration files. I also had to update some links.
3834 Please note that we now have the majority of configurations with versions >= to linux 5.3 🧙‍♂️
3835
3836 See you soon.
3837
3838 Best regards,
3839
3840 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-02-27 17:36](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/31#issuecomment-592084682):
3841
3842 Thanks, @HacKurx!
3843
3844 N.B. I'm going to work on support of new kernel releases in the near future.
3845
3846 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2020-03-04 19:09](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/31#issuecomment-594761475):
3847
3848 @a13xp0p0v, 
3849 > N.B. I'm going to work on support of new kernel releases in the near future.
3850
3851 https://kernsec.org/wiki/index.php?title=Kernel_Self_Protection_Project/Recommended_Settings&diff=4001&oldid=prev
3852
3853 :wink:
3854
3855 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-03-04 19:55](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/31#issuecomment-594797254):
3856
3857 Yes, thanks, I'm already working on that!
3858
3859
3860 -------------------------------------------------------------------------------
3861
3862 # [\#30 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/30) `closed`: Has CONFIG_REFCOUNT_FULL and VMAP_STACK been removed from Kernel-5.5 ?
3863
3864 #### <img src="https://avatars.githubusercontent.com/u/3471772?v=4" width="50">[bryn1u](https://github.com/bryn1u) opened issue at [2020-02-01 12:24](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/30):
3865
3866 Hey everyone,
3867
3868 Im trying to configure Kernel-5.5 config and i don't see CONFIG_REFCOUNT_FULL option and the same with VMAP_STACK.
3869 I use Kernel-5.3 for now and there is an option available. Soo should i think that this option is no longer available ?
3870
3871 Thanks !
3872
3873 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2020-02-02 13:05](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/30#issuecomment-581133592):
3874
3875 `CONFIG_REFCOUNT_FULL` was removed but `CONFIG_VMAP_STACK` is still available.
3876
3877 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-02-05 16:54](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/30#issuecomment-582504214):
3878
3879 Yes, `REFCOUNT_FULL` was removed...
3880 Have to find a way how to check it without false positive.
3881
3882 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2020-02-06 12:30](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/30#issuecomment-582884278):
3883
3884 @a13xp0p0v there is kernel version printed in config header, like:
3885
3886 ```
3887 #
3888 # Automatically generated file; DO NOT EDIT.
3889 # Linux/x86 5.5.2 Kernel Configuration
3890 #
3891 ```
3892
3893 maybe you can parse those?
3894
3895 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-02-06 15:25](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/30#issuecomment-582957059):
3896
3897 Yes, it looks like we have to add some limited kernel version checking...
3898
3899 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-02-06 15:29](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/30#issuecomment-582959470):
3900
3901 I may have time to work on that only after OffensiveCon.
3902 Does anybody want to prepare a pull request?
3903
3904 #### <img src="https://avatars.githubusercontent.com/u/3471772?v=4" width="50">[bryn1u](https://github.com/bryn1u) commented at [2020-02-09 13:03](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/30#issuecomment-583842999):
3905
3906 Hey,
3907
3908 Is a CONFIG_HAVE_ARCH_VMAP_STACK in Kernel-5.5.2 equivalent to
3909 CONFIG_VMAPSTACK ?
3910
3911 Thanks !
3912
3913 czw., 6 lut 2020 o 16:29 Alexander Popov <notifications@github.com>
3914 napisał(a):
3915
3916 > I may have time to work on that only after OffensiveCon.
3917 > Does anybody want to prepare a pull request?
3918 >
3919 > —
3920 > You are receiving this because you authored the thread.
3921 > Reply to this email directly, view it on GitHub
3922 > <https://github.com/a13xp0p0v/kconfig-hardened-check/issues/30?email_source=notifications&email_token=AA2PTHCFMA26NITNFRMNTU3RBQUHBA5CNFSM4KOS3L22YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEK7UC3Q#issuecomment-582959470>,
3923 > or unsubscribe
3924 > <https://github.com/notifications/unsubscribe-auth/AA2PTHBA772R35Y6MYOQS6DRBQUHBANCNFSM4KOS3L2Q>
3925 > .
3926 >
3927
3928 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2020-02-10 14:32](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/30#issuecomment-584150411):
3929
3930 > Is a CONFIG_HAVE_ARCH_VMAP_STACK in Kernel-5.5.2 equivalent to
3931 > CONFIG_VMAPSTACK ?
3932
3933 No `CONFIG_HAVE_ARCH_VMAP_STACK` tells only if `VMAP_STACK` is available for specific cpu architecture. `CONFIG_VMAP_STACK` tells if `VMAP_STACK` is enabled.
3934
3935 You can check that [VMAP_STACK definitely still exist up to 5.6-rc](https://cateee.net/lkddb/web-lkddb/VMAP_STACK.html).
3936
3937 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-03-05 11:03](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/30#issuecomment-595170199):
3938
3939 Hello!
3940
3941 Worked with that issue in 0ace19012b626203d14332090cdcd40ed2237100, 918b12cf6f652ad148c885d1a802459e73d20c48 and 17c22224ac5b20c3d0ed49e7859642756e178bd9.
3942
3943 Also have a look at 61b5ca3c8f95212141284be8eb4036c8c1bda9e7: that fixes the false positive report about LDISC_AUTOLOAD for old kernels.
3944
3945
3946 -------------------------------------------------------------------------------
3947
3948 # [\#29 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/29) `closed`: Recommend PANIC_ON_OOPS
3949
3950 #### <img src="https://avatars.githubusercontent.com/u/50278627?v=4" width="50">[madaidan](https://github.com/madaidan) opened issue at [2020-01-13 21:28](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/29):
3951
3952 This causes the kernel to panic on an oops.
3953
3954 Recommended by the KSPP and CLIP OS.
3955
3956 https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings
3957
3958 > \# Reboot devices immediately if kernel experiences an Oops.
3959 > CONFIG_PANIC_ON_OOPS=y
3960 > CONFIG_PANIC_TIMEOUT=-1
3961
3962 https://docs.clip-os.org/clipos/kernel.html
3963
3964 > CONFIG_PANIC_ON_OOPS=y
3965 > CONFIG_PANIC_TIMEOUT=-1
3966 >
3967 >    Prevent potential further exploitation of a bug by immediately panicking the kernel.
3968
3969 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-01-14 09:23](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/29#issuecomment-574081092):
3970
3971 Hello @madaidan,
3972
3973 Yes, I saw this KSPP recommendation.
3974 I personally don't support it because it provides easy denial-of-service attack for the whole system (there are a lot of BUG()'s in the kernel).
3975
3976 In my opinion having CONFIG_BUG is enough. If we have kernel oops in the process context, the offending/attacking process is killed.
3977
3978 #### <img src="https://avatars.githubusercontent.com/u/50278627?v=4" width="50">[madaidan](https://github.com/madaidan) commented at [2020-01-14 16:52](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/29#issuecomment-574269683):
3979
3980 I think the kernel exploits this can prevent are more important than DoS.
3981
3982 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-01-16 10:06](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/29#issuecomment-575078024):
3983
3984 > I think the kernel exploits this can prevent are more important than DoS.
3985
3986 Could you please give a real example of the exploit that:
3987   1. is NOT blocked by having `CONFIG_BUG=y`,
3988 and
3989   2. is blocked by having `CONFIG_PANIC_ON_OOPS=y`.
3990
3991 Thanks!
3992
3993 #### <img src="https://avatars.githubusercontent.com/u/50278627?v=4" width="50">[madaidan](https://github.com/madaidan) commented at [2020-01-16 17:30](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/29#issuecomment-575259978):
3994
3995 This is a good example since it explicitly mentions panic_on_oops: https://googleprojectzero.blogspot.com/2018/09/a-cache-invalidation-bug-in-linux.html
3996
3997 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-01-17 15:10](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/29#issuecomment-575664888):
3998
3999 > This is a good example since it explicitly mentions panic_on_oops: https://googleprojectzero.blogspot.com/2018/09/a-cache-invalidation-bug-in-linux.html
4000
4001 No, sorry, that's a wrong example.
4002
4003 In that exploit Jann Horn used the output of `WARN_ON_ONCE()`.
4004 Having `CONFIG_PANIC_ON_OOPS=y` doesn't prevent his method, since kernel continues to run after `WARN_ON_ONCE()` anyway.
4005
4006 Moreover, let me quote Jann about CONFIG_PANIC_ON_OOPS:
4007 ```
4008 It is off by default in the upstream kernel - and enabling it by default in distributions
4009 would probably be a bad idea -, but it is e.g. enabled by Android.
4010 ```
4011
4012 If some users want to enable it anyway, they can always use `kernel.panic_on_oops` sysctl or the corresponding kernel command line parameter.
4013
4014 #### <img src="https://avatars.githubusercontent.com/u/50278627?v=4" width="50">[madaidan](https://github.com/madaidan) commented at [2020-01-20 17:34](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/29#issuecomment-576372137):
4015
4016 Alright. Fair enough.
4017
4018
4019 -------------------------------------------------------------------------------
4020
4021 # [\#28 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/28) `closed`: Don't give errors about CONFIG_PAGE_POISONING when using an alternative
4022
4023 #### <img src="https://avatars.githubusercontent.com/u/50278627?v=4" width="50">[madaidan](https://github.com/madaidan) opened issue at [2020-01-09 19:36](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/28):
4024
4025 Some people use `CONFIG_INIT_ON_ALLOC_DEFAULT_ON`/`CONFIG_INIT_ON_FREE_DEFAULT_ON` or linux-hardened's `CONFIG_PAGE_SANITIZE` (for LTS kernels) instead of `CONFIG_PAGE_POISONING`. People using these alternatives will get pointless errors that may confuse them.
4026
4027 It would be better if the errors were only shown when not using these.
4028
4029 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2020-01-09 19:38](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/28#issuecomment-572720806):
4030
4031 I would love this :P
4032
4033 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-01-10 15:26](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/28#issuecomment-573079631):
4034
4035 As I remember, all these features are different in some sense.
4036 Are you sure that they are alternative to each other?
4037
4038 #### <img src="https://avatars.githubusercontent.com/u/50278627?v=4" width="50">[madaidan](https://github.com/madaidan) commented at [2020-01-10 16:40](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/28#issuecomment-573110783):
4039
4040 As far as I know, they all have the same goal which is to overwrite memory to prevent use-after-free but they have some slight differences as `PAGE_POISONING` forces debugging bloat (as it is actually a debugging feature) which makes `init_on_{,free,alloc}` or `PAGE_SANITIZE` (which was dropped in newer linux-hardened versions for `init_on_{,free,alloc}`) better.
4041
4042 `init_on_{,free,alloc}` actually disables itself when `PAGE_POISONING` is being used to prevent conflict.
4043
4044 https://github.com/torvalds/linux/commit/6471384af2a6530696fc0203bafe4de41a23c9ef
4045
4046 > If either SLUB poisoning or page poisoning is enabled, those options take
4047 precedence over init_on_alloc and init_on_free: initialization is only
4048 applied to unpoisoned allocations.
4049
4050 Also notice that linux-hardened and ClipOS do not enable `PAGE_POISONING` but use the others instead.
4051
4052 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-01-14 10:28](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/28#issuecomment-574108331):
4053
4054 @madaidan, thanks for the details.
4055 So yes, `PAGE_POISONING` is a debugging feature.
4056 It provides less erasing than `INIT_ON_FREE_DEFAULT_ON`.
4057
4058 I joined these checks with OR giving preference to `INIT_ON_FREE_DEFAULT_ON`.
4059 Please see the linked commit.
4060
4061 #### <img src="https://avatars.githubusercontent.com/u/50278627?v=4" width="50">[madaidan](https://github.com/madaidan) commented at [2020-01-14 16:55](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/28#issuecomment-574271418):
4062
4063 Great, thanks.
4064
4065
4066 -------------------------------------------------------------------------------
4067
4068 # [\#27 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/27) `closed`: add nix build files
4069
4070 #### <img src="https://avatars.githubusercontent.com/u/96200?u=9ed15c85825694d00e996d605d728179b830c4fa&v=4" width="50">[Mic92](https://github.com/Mic92) opened issue at [2020-01-02 09:02](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/27):
4071
4072
4073
4074 #### <img src="https://avatars.githubusercontent.com/u/96200?u=9ed15c85825694d00e996d605d728179b830c4fa&v=4" width="50">[Mic92](https://github.com/Mic92) commented at [2020-01-02 10:44](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/27#issuecomment-570172617):
4075
4076 These are all possible kernel configurations:
4077 There might be duplicate since linux-latest is basically linux-5.4.
4078 I am not sure which configuration you want to include in this repository.
4079 Maybe _hardened, _latest and the default kernel.
4080
4081 [nixpkgs-linux_latest-libre-config.txt](https://github.com/a13xp0p0v/kconfig-hardened-check/files/4015570/nixpkgs-linux_latest-libre-config.txt)
4082 [nixpkgs-linux_latest_hardened-config.txt](https://github.com/a13xp0p0v/kconfig-hardened-check/files/4015571/nixpkgs-linux_latest_hardened-config.txt)
4083 [nixpkgs-linux_testing_hardened-config.txt](https://github.com/a13xp0p0v/kconfig-hardened-check/files/4015572/nixpkgs-linux_testing_hardened-config.txt)
4084 [nixpkgs-linux_hardened-config.txt](https://github.com/a13xp0p0v/kconfig-hardened-check/files/4015573/nixpkgs-linux_hardened-config.txt)
4085 [nixpkgs-linux_latest-config.txt](https://github.com/a13xp0p0v/kconfig-hardened-check/files/4015574/nixpkgs-linux_latest-config.txt)
4086 [nixpkgs-linux_testing_bcachefs-config.txt](https://github.com/a13xp0p0v/kconfig-hardened-check/files/4015575/nixpkgs-linux_testing_bcachefs-config.txt)
4087 [nixpkgs-linux_testing-config.txt](https://github.com/a13xp0p0v/kconfig-hardened-check/files/4015576/nixpkgs-linux_testing-config.txt)
4088 [nixpkgs-linux_5_4-config.txt](https://github.com/a13xp0p0v/kconfig-hardened-check/files/4015577/nixpkgs-linux_5_4-config.txt)
4089 [nixpkgs-linux_5_3-config.txt](https://github.com/a13xp0p0v/kconfig-hardened-check/files/4015578/nixpkgs-linux_5_3-config.txt)
4090 [nixpkgs-linux_4_9-config.txt](https://github.com/a13xp0p0v/kconfig-hardened-check/files/4015579/nixpkgs-linux_4_9-config.txt)
4091 [nixpkgs-linux_4_14-config.txt](https://github.com/a13xp0p0v/kconfig-hardened-check/files/4015580/nixpkgs-linux_4_14-config.txt)
4092 [nixpkgs-linux_4_4-config.txt](https://github.com/a13xp0p0v/kconfig-hardened-check/files/4015581/nixpkgs-linux_4_4-config.txt)
4093 [nixpkgs-linux_4_19-config.txt](https://github.com/a13xp0p0v/kconfig-hardened-check/files/4015582/nixpkgs-linux_4_19-config.txt)
4094 [nixpkgs-linux_mptcp_94-config.txt](https://github.com/a13xp0p0v/kconfig-hardened-check/files/4015583/nixpkgs-linux_mptcp_94-config.txt)
4095 [nixpkgs-linux_mptcp_95-config.txt](https://github.com/a13xp0p0v/kconfig-hardened-check/files/4015584/nixpkgs-linux_mptcp_95-config.txt)
4096 [nixpkgs-linux_mptcp-config.txt](https://github.com/a13xp0p0v/kconfig-hardened-check/files/4015585/nixpkgs-linux_mptcp-config.txt)
4097
4098 #### <img src="https://avatars.githubusercontent.com/u/96200?u=9ed15c85825694d00e996d605d728179b830c4fa&v=4" width="50">[Mic92](https://github.com/Mic92) commented at [2020-01-02 10:47](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/27#issuecomment-570173237):
4099
4100 This is the output for our hardened kernel:
4101 cc @joachifm (hardened maintainer)
4102
4103 ```
4104 [+] Trying to detect architecture in "kconfig/nixpkgs-linux_hardened-config.txt"...
4105 [+] Detected architecture: X86_64
4106 [+] Checking "kconfig/nixpkgs-linux_hardened-config.txt" against hardening preferences...
4107                  option name                 | desired val | decision |       reason       |   check result
4108 =========================================================================================================================
4109 CONFIG_BUG                                   |      y      |defconfig |  self_protection   |   OK
4110 CONFIG_STRICT_KERNEL_RWX                     |      y      |defconfig |  self_protection   |   OK
4111 CONFIG_STACKPROTECTOR_STRONG                 |      y      |defconfig |  self_protection   |   OK
4112 CONFIG_SLUB_DEBUG                            |      y      |defconfig |  self_protection   |   OK
4113 CONFIG_STRICT_MODULE_RWX                     |      y      |defconfig |  self_protection   |   OK
4114 CONFIG_MICROCODE                             |      y      |defconfig |  self_protection   |   OK
4115 CONFIG_RETPOLINE                             |      y      |defconfig |  self_protection   |   OK
4116 CONFIG_X86_SMAP                              |      y      |defconfig |  self_protection   |   OK
4117 CONFIG_X86_UMIP                              |      y      |defconfig |  self_protection   |   OK: CONFIG_X86_INTEL_UMIP "y"
4118 CONFIG_IOMMU_SUPPORT                         |      y      |defconfig |  self_protection   |   OK
4119 CONFIG_SYN_COOKIES                           |      y      |defconfig |  self_protection   |   OK
4120 CONFIG_PAGE_TABLE_ISOLATION                  |      y      |defconfig |  self_protection   |   OK
4121 CONFIG_RANDOMIZE_MEMORY                      |      y      |defconfig |  self_protection   |   OK
4122 CONFIG_INTEL_IOMMU                           |      y      |defconfig |  self_protection   |   OK
4123 CONFIG_AMD_IOMMU                             |      y      |defconfig |  self_protection   |   OK
4124 CONFIG_VMAP_STACK                            |      y      |defconfig |  self_protection   |   OK
4125 CONFIG_RANDOMIZE_BASE                        |      y      |defconfig |  self_protection   |   OK
4126 CONFIG_THREAD_INFO_IN_TASK                   |      y      |defconfig |  self_protection   |   OK
4127 CONFIG_BUG_ON_DATA_CORRUPTION                |      y      |   kspp   |  self_protection   |   OK
4128 CONFIG_DEBUG_WX                              |      y      |   kspp   |  self_protection   |   OK
4129 CONFIG_SCHED_STACK_END_CHECK                 |      y      |   kspp   |  self_protection   |   OK
4130 CONFIG_SLAB_FREELIST_HARDENED                |      y      |   kspp   |  self_protection   |   OK
4131 CONFIG_SLAB_FREELIST_RANDOM                  |      y      |   kspp   |  self_protection   |   OK
4132 CONFIG_SHUFFLE_PAGE_ALLOCATOR                |      y      |   kspp   |  self_protection   |   FAIL: not found
4133 CONFIG_FORTIFY_SOURCE                        |      y      |   kspp   |  self_protection   |   OK
4134 CONFIG_GCC_PLUGINS                           |      y      |   kspp   |  self_protection   |   OK
4135 CONFIG_GCC_PLUGIN_RANDSTRUCT                 |      y      |   kspp   |  self_protection   |   OK
4136 CONFIG_GCC_PLUGIN_LATENT_ENTROPY             |      y      |   kspp   |  self_protection   |   OK
4137 CONFIG_DEBUG_LIST                            |      y      |   kspp   |  self_protection   |   OK
4138 CONFIG_DEBUG_SG                              |      y      |   kspp   |  self_protection   |   OK
4139 CONFIG_DEBUG_CREDENTIALS                     |      y      |   kspp   |  self_protection   |   OK
4140 CONFIG_DEBUG_NOTIFIERS                       |      y      |   kspp   |  self_protection   |   OK
4141 CONFIG_PAGE_POISONING                        |      y      |   kspp   |  self_protection   |   OK
4142 CONFIG_HARDENED_USERCOPY                     |      y      |   kspp   |  self_protection   |   OK
4143 CONFIG_HARDENED_USERCOPY_FALLBACK            | is not set  |   kspp   |  self_protection   |   OK
4144 CONFIG_MODULE_SIG                            |      y      |   kspp   |  self_protection   |   FAIL: "is not set"
4145 CONFIG_MODULE_SIG_ALL                        |      y      |   kspp   |  self_protection   |   FAIL: not found
4146 CONFIG_MODULE_SIG_SHA512                     |      y      |   kspp   |  self_protection   |   FAIL: not found
4147 CONFIG_MODULE_SIG_FORCE                      |      y      |   kspp   |  self_protection   |   FAIL: not found
4148 CONFIG_DEFAULT_MMAP_MIN_ADDR                 |    65536    |   kspp   |  self_protection   |   OK
4149 CONFIG_REFCOUNT_FULL                         |      y      |   kspp   |  self_protection   |   OK
4150 CONFIG_INIT_STACK_ALL                        |      y      |  clipos  |  self_protection   |   OK: CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL "y"
4151 CONFIG_INIT_ON_ALLOC_DEFAULT_ON              |      y      |  clipos  |  self_protection   |   FAIL: not found
4152 CONFIG_INIT_ON_FREE_DEFAULT_ON               |      y      |  clipos  |  self_protection   |   FAIL: not found
4153 CONFIG_SECURITY_DMESG_RESTRICT               |      y      |  clipos  |  self_protection   |   FAIL: "is not set"
4154 CONFIG_DEBUG_VIRTUAL                         |      y      |  clipos  |  self_protection   |   FAIL: "is not set"
4155 CONFIG_STATIC_USERMODEHELPER                 |      y      |  clipos  |  self_protection   |   FAIL: "is not set"
4156 CONFIG_SLAB_MERGE_DEFAULT                    | is not set  |  clipos  |  self_protection   |   FAIL: "y"
4157 CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE     | is not set  |  clipos  |  self_protection   |   FAIL: "y"
4158 CONFIG_GCC_PLUGIN_STACKLEAK                  |      y      |  clipos  |  self_protection   |   FAIL: not found
4159 CONFIG_STACKLEAK_METRICS                     | is not set  |  clipos  |  self_protection   |   FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is needed
4160 CONFIG_STACKLEAK_RUNTIME_DISABLE             | is not set  |  clipos  |  self_protection   |   FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is needed
4161 CONFIG_RANDOM_TRUST_CPU                      | is not set  |  clipos  |  self_protection   |   OK
4162 CONFIG_INTEL_IOMMU_SVM                       |      y      |  clipos  |  self_protection   |   FAIL: "is not set"
4163 CONFIG_INTEL_IOMMU_DEFAULT_ON                |      y      |  clipos  |  self_protection   |   FAIL: "is not set"
4164 CONFIG_SLUB_DEBUG_ON                         |      y      |    my    |  self_protection   |   FAIL: "is not set"
4165 CONFIG_RESET_ATTACK_MITIGATION               |      y      |    my    |  self_protection   |   FAIL: "is not set"
4166 CONFIG_PAGE_POISONING_NO_SANITY              | is not set  |    my    |  self_protection   |   FAIL: "y"
4167 CONFIG_PAGE_POISONING_ZERO                   | is not set  |    my    |  self_protection   |   FAIL: "y"
4168 CONFIG_AMD_IOMMU_V2                          |      y      |    my    |  self_protection   |   FAIL: "m"
4169 CONFIG_SECURITY                              |      y      |defconfig |  security_policy   |   OK
4170 CONFIG_SECURITY_YAMA                         |      y      |   kspp   |  security_policy   |   OK
4171 CONFIG_SECURITY_LOADPIN                      |      y      |    my    |  security_policy   |   FAIL: "is not set"
4172 CONFIG_SECURITY_LOCKDOWN_LSM                 |      y      |    my    |  security_policy   |   FAIL: not found
4173 CONFIG_SECURITY_LOCKDOWN_LSM_EARLY           |      y      |    my    |  security_policy   |   FAIL: not found
4174 CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY|      y      |    my    |  security_policy   |   FAIL: not found
4175 CONFIG_SECCOMP                               |      y      |defconfig | cut_attack_surface |   OK
4176 CONFIG_SECCOMP_FILTER                        |      y      |defconfig | cut_attack_surface |   OK
4177 CONFIG_STRICT_DEVMEM                         |      y      |defconfig | cut_attack_surface |   OK
4178 CONFIG_MODULES                               | is not set  |   kspp   | cut_attack_surface |   FAIL: "y"
4179 CONFIG_DEVMEM                                | is not set  |   kspp   | cut_attack_surface |   FAIL: "y"
4180 CONFIG_IO_STRICT_DEVMEM                      |      y      |   kspp   | cut_attack_surface |   OK
4181 CONFIG_ACPI_CUSTOM_METHOD                    | is not set  |   kspp   | cut_attack_surface |   OK
4182 CONFIG_COMPAT_BRK                            | is not set  |   kspp   | cut_attack_surface |   OK
4183 CONFIG_DEVKMEM                               | is not set  |   kspp   | cut_attack_surface |   OK
4184 CONFIG_COMPAT_VDSO                           | is not set  |   kspp   | cut_attack_surface |   OK: not found
4185 CONFIG_BINFMT_MISC                           | is not set  |   kspp   | cut_attack_surface |   FAIL: "y"
4186 CONFIG_INET_DIAG                             | is not set  |   kspp   | cut_attack_surface |   FAIL: "y"
4187 CONFIG_KEXEC                                 | is not set  |   kspp   | cut_attack_surface |   FAIL: "y"
4188 CONFIG_PROC_KCORE                            | is not set  |   kspp   | cut_attack_surface |   OK
4189 CONFIG_LEGACY_PTYS                           | is not set  |   kspp   | cut_attack_surface |   OK
4190 CONFIG_HIBERNATION                           | is not set  |   kspp   | cut_attack_surface |   FAIL: "y"
4191 CONFIG_LEGACY_VSYSCALL_NONE                  |      y      |   kspp   | cut_attack_surface |   OK
4192 CONFIG_IA32_EMULATION                        | is not set  |   kspp   | cut_attack_surface |   OK
4193 CONFIG_X86_X32                               | is not set  |   kspp   | cut_attack_surface |   OK
4194 CONFIG_MODIFY_LDT_SYSCALL                    | is not set  |   kspp   | cut_attack_surface |   FAIL: "y"
4195 CONFIG_X86_PTDUMP                            | is not set  |grsecurity| cut_attack_surface |   FAIL: "m"
4196 CONFIG_ZSMALLOC_STAT                         | is not set  |grsecurity| cut_attack_surface |   OK
4197 CONFIG_PAGE_OWNER                            | is not set  |grsecurity| cut_attack_surface |   OK
4198 CONFIG_DEBUG_KMEMLEAK                        | is not set  |grsecurity| cut_attack_surface |   OK
4199 CONFIG_BINFMT_AOUT                           | is not set  |grsecurity| cut_attack_surface |   OK: not found
4200 CONFIG_KPROBES                               | is not set  |grsecurity| cut_attack_surface |   FAIL: "y"
4201 CONFIG_UPROBES                               | is not set  |grsecurity| cut_attack_surface |   FAIL: "y"
4202 CONFIG_GENERIC_TRACER                        | is not set  |grsecurity| cut_attack_surface |   FAIL: "y"
4203 CONFIG_PROC_VMCORE                           | is not set  |grsecurity| cut_attack_surface |   OK: not found
4204 CONFIG_PROC_PAGE_MONITOR                     | is not set  |grsecurity| cut_attack_surface |   FAIL: "y"
4205 CONFIG_USELIB                                | is not set  |grsecurity| cut_attack_surface |   FAIL: "y"
4206 CONFIG_CHECKPOINT_RESTORE                    | is not set  |grsecurity| cut_attack_surface |   OK
4207 CONFIG_USERFAULTFD                           | is not set  |grsecurity| cut_attack_surface |   FAIL: "y"
4208 CONFIG_HWPOISON_INJECT                       | is not set  |grsecurity| cut_attack_surface |   OK: not found
4209 CONFIG_MEM_SOFT_DIRTY                        | is not set  |grsecurity| cut_attack_surface |   OK: not found
4210 CONFIG_DEVPORT                               | is not set  |grsecurity| cut_attack_surface |   FAIL: "y"
4211 CONFIG_DEBUG_FS                              | is not set  |grsecurity| cut_attack_surface |   FAIL: "y"
4212 CONFIG_NOTIFIER_ERROR_INJECTION              | is not set  |grsecurity| cut_attack_surface |   OK
4213 CONFIG_ACPI_TABLE_UPGRADE                    | is not set  | lockdown | cut_attack_surface |   FAIL: "y"
4214 CONFIG_ACPI_APEI_EINJ                        | is not set  | lockdown | cut_attack_surface |   OK: not found
4215 CONFIG_PROFILING                             | is not set  | lockdown | cut_attack_surface |   FAIL: "y"
4216 CONFIG_BPF_SYSCALL                           | is not set  | lockdown | cut_attack_surface |   FAIL: "y"
4217 CONFIG_MMIOTRACE_TEST                        | is not set  | lockdown | cut_attack_surface |   OK: not found
4218 CONFIG_KSM                                   | is not set  |  clipos  | cut_attack_surface |   FAIL: "y"
4219 CONFIG_KALLSYMS                              | is not set  |  clipos  | cut_attack_surface |   FAIL: "y"
4220 CONFIG_X86_VSYSCALL_EMULATION                | is not set  |  clipos  | cut_attack_surface |   FAIL: "y"
4221 CONFIG_MAGIC_SYSRQ                           | is not set  |  clipos  | cut_attack_surface |   FAIL: "y"
4222 CONFIG_KEXEC_FILE                            | is not set  |  clipos  | cut_attack_surface |   FAIL: "y"
4223 CONFIG_USER_NS                               | is not set  |  clipos  | cut_attack_surface |   FAIL: "y"
4224 CONFIG_LDISC_AUTOLOAD                        | is not set  |  clipos  | cut_attack_surface |   FAIL: "y"
4225 CONFIG_MMIOTRACE                             | is not set  |    my    | cut_attack_surface |   OK
4226 CONFIG_LIVEPATCH                             | is not set  |    my    | cut_attack_surface |   OK: not found
4227 CONFIG_IP_DCCP                               | is not set  |    my    | cut_attack_surface |   FAIL: "m"
4228 CONFIG_IP_SCTP                               | is not set  |    my    | cut_attack_surface |   FAIL: "m"
4229 CONFIG_FTRACE                                | is not set  |    my    | cut_attack_surface |   FAIL: "y"
4230 CONFIG_BPF_JIT                               | is not set  |    my    | cut_attack_surface |   FAIL: "y"
4231 CONFIG_ARCH_MMAP_RND_BITS                    |     32      |  clipos  |userspace_hardening |   FAIL: "28"
4232
4233 [+] config check is finished: 'OK' - 66 / 'FAIL' - 57
4234 ```
4235
4236 #### <img src="https://avatars.githubusercontent.com/u/96200?u=9ed15c85825694d00e996d605d728179b830c4fa&v=4" width="50">[Mic92](https://github.com/Mic92) commented at [2020-01-02 10:51](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/27#issuecomment-570174082):
4237
4238 cc @fpletz @andir @flokli @nequissimus regarding security/kernel maintenance.
4239
4240 #### <img src="https://avatars.githubusercontent.com/u/628342?u=948c2401c073b8097e8ec160019140fb6043f266&v=4" width="50">[NeQuissimus](https://github.com/NeQuissimus) commented at [2020-01-02 16:07](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/27#issuecomment-570253840):
4241
4242 There is no (official) open source grsecurity for recent kernels. But for the other options, I'd be interested in a discussion in the nixpkgs repo.
4243
4244 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-01-02 23:11](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/27#issuecomment-570392431):
4245
4246 Hello @Mic92,
4247
4248 > I am not sure which configuration you want to include in this repository.
4249 > Maybe _hardened, _latest and the default kernel.
4250
4251 I would like to have only the default and hardened config for NixOS.
4252 That's useful for a brief comparison of kernel hardening adoption by various Linux distributions.
4253 By the way, we don't have a goal to collect all the latest configs from all the distributions.
4254 @HacKurx updates them from time to time.
4255
4256 Hello @NeQuissimus,
4257
4258 > There is no (official) open source grsecurity for recent kernels. 
4259
4260 Yes.
4261 And do you mean that there is an unofficial grsecurity patch for recent kernels available in public?
4262
4263 > But for the other options, I'd be interested in a discussion in the nixpkgs repo.
4264
4265 I would be glad to join that discussion.
4266 I've accumulated some knowledge about the vanilla kernel hardening.
4267 Please see my Linux Kernel Defence Map https://github.com/a13xp0p0v/linux-kernel-defence-map.
4268 It shows the the relationships between:
4269  - Vulnerability classes,
4270  - Exploitation techniques,
4271  - Bug detection mechanisms,
4272  - Defense technologies.
4273
4274 It could be useful for making a decision about enabling kernel hardening config options.
4275
4276 @Mic92 @fpletz @andir @flokli @NeQuissimus,
4277 Does NixOS have a documentation describing the difference between its hardened and default kernels?
4278
4279 Thanks!
4280
4281 #### <img src="https://avatars.githubusercontent.com/u/628342?u=948c2401c073b8097e8ec160019140fb6043f266&v=4" width="50">[NeQuissimus](https://github.com/NeQuissimus) commented at [2020-01-03 00:29](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/27#issuecomment-570414239):
4282
4283 I was thinking of minipli but I guess those are only for 4.9.
4284
4285 I opened NixOS/nixpkgs#76850, which links to the kernel flags we set for the standard kernel builds and for the hardened one.
4286 Unfortunately I do not think there is good documentation.
4287
4288 #### <img src="https://avatars.githubusercontent.com/u/96200?u=9ed15c85825694d00e996d605d728179b830c4fa&v=4" width="50">[Mic92](https://github.com/Mic92) commented at [2020-01-03 08:37](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/27#issuecomment-570503332):
4289
4290 > Hello @Mic92,
4291
4292 > > I am not sure which configuration you want to include in this repository.
4293 > > Maybe _hardened, _latest and the default kernel.
4294
4295 > I would like to have only the default and hardened config for NixOS.
4296 > That's useful for a brief comparison of kernel hardening adoption by various Linux distributions.
4297 > By the way, we don't have a goal to collect all the latest configs from all the distributions.
4298 > @HacKurx updates them from time to time.
4299
4300 Fair enough I think the other changes that are actually part of this pull request should be still useful though.
4301
4302 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-01-10 14:12](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/27#issuecomment-573050822):
4303
4304 > Fair enough I think the other changes that are actually part of this pull request should be still useful though.
4305
4306 Hi @Mic92,
4307 Could you have a look at my comments for your PR https://github.com/a13xp0p0v/kconfig-hardened-check/pull/26 ?
4308 I need some clarifications to be able to integrate your work.
4309 Thanks!
4310
4311 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2020-02-24 20:57](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/27#issuecomment-590544879):
4312
4313 Hi,
4314
4315 I haven't tested NixOS yet, is there a quick and easy way to retrieve the kernel configuration or it's only dynamically generated?
4316 I only find this but without config files:
4317 https://hydra.nixos.org/job/nixos/release-19.09/nixpkgs.linuxPackages_latest_hardened.kernel.x86_64-linux
4318
4319 Beside the point, I'm not a fan of that :
4320 https://github.com/NixOS/nixpkgs/commit/1b9bf8fa7559d1bbf030f3fe3513d25eada65a41
4321
4322 #### <img src="https://avatars.githubusercontent.com/u/96200?u=9ed15c85825694d00e996d605d728179b830c4fa&v=4" width="50">[Mic92](https://github.com/Mic92) commented at [2020-02-25 09:26](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/27#issuecomment-590768293):
4323
4324 @HacKurx It's generated by nix code. Can you explain why a RANDSTRUCT read from /dev/random is better than a checksum over the linux kernel tarball? From my understanding, once that a package is build, one could extract the seed from the build. In that way reproducible builds would give us other properties i.e. verifying a correct build.
4325
4326 #### <img src="https://avatars.githubusercontent.com/u/41977?u=ba54c9de3752a1aa05a462e38bd6e84bdc26a2bb&v=4" width="50">[joachifm](https://github.com/joachifm) commented at [2020-02-25 17:26](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/27#issuecomment-590976475):
4327
4328 @Mic92 I agree with you. I think it's fair to say that any compile-time randomization is rendered (nearly) pointless by publishing the image.  In our case, the value is likely to change whenever source/config changes, so might be considered "better" than a static seed value (whether it makes any real difference is another matter).  I think users who really care about this type of mitigation should build their own kernel with a custom seed (support for this was added in a later patch, iirc).
4329
4330 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2020-02-25 21:10](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/27#issuecomment-591070826):
4331
4332 @Mic92, @joachifm,
4333 The person who recompile a kernel from your source should have another seed (not your) for more security.
4334 It seems preferable to me of change the SEED variable every time you update the nix kernel. Use a compilation based of a date or the kernel number for example.
4335
4336 #### <img src="https://avatars.githubusercontent.com/u/41977?u=ba54c9de3752a1aa05a462e38bd6e84bdc26a2bb&v=4" width="50">[joachifm](https://github.com/joachifm) commented at [2020-02-25 22:20](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/27#issuecomment-591100811):
4337
4338 @HacKurx note that `${src}` in the snippet you linked above expands to a string that contains both the checksum of the linux source tarball and the version number: it is certain to change in case of version bumps.  
4339
4340 I wouldn't mind including more information in the seed construction to further increase the likelihood that it will differ between builds, but whatever is added needs to preserve determinism (in the sense that same inputs give same output).  
4341
4342 Reproducibility is a key goal for Nix/NixPkgs and usually overrides other concerns.  In this case, I think giving users of the prebuilt image a weak(ened) variant of the mitigation while making it easy to supply a custom seed is a more than fair tradeoff, especially given that the full benefit of this type of mitigation can only be realized with a self-built package anyway.
4343
4344 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-03-27 19:45](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/27#issuecomment-605284899):
4345
4346 Hello @Mic92!
4347 I installed Nix on a Debian machine to test your scripts.
4348 Unfortunately I have to revert the commit that adds `contrib/get-nix-kconfig.py`.
4349 This script is corrupted (has unexpected symbols).
4350 It also has numerous troubles with Python 3.5.3.
4351
4352 #### <img src="https://avatars.githubusercontent.com/u/96200?u=9ed15c85825694d00e996d605d728179b830c4fa&v=4" width="50">[Mic92](https://github.com/Mic92) commented at [2020-03-27 19:52](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/27#issuecomment-605287211):
4353
4354 @a13xp0p0v just add:
4355
4356 ```
4357 #! /usr/bin/env nix-shell
4358 #! nix-shell -i python3
4359 ```
4360
4361 as a shebang. Nixpkgs has python3.6 and the script depends nix anyway.
4362 It is not corrupted but depends on python3.6 or newer.
4363
4364 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-03-27 20:27](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/27#issuecomment-605300321):
4365
4366 Thanks for prompt reply!
4367 1. I perform:
4368 ```
4369 $ nix-shell
4370 ```
4371 2. Then I change the shebang as you described and run the script:
4372 ```
4373 [nix-shell:~/kconfig-hardened-check/contrib]$ ./get-nix-kconfig.py 
4374 error: getting status of '/home/x/kconfig-hardened-check/contrib/default.nix': No such file or directory
4375 ```
4376 3. Finally this makes it work:
4377 ```
4378 [nix-shell:~/kconfig-hardened-check/contrib]$ python3 get-nix-kconfig.py 
4379 ```
4380 I got kernel configs and added hardened one to the collection: 4768e21b33fa9663114eb30c2b2c2cf9e6cf4721
4381
4382 Thanks!
4383
4384 #### <img src="https://avatars.githubusercontent.com/u/96200?u=9ed15c85825694d00e996d605d728179b830c4fa&v=4" width="50">[Mic92](https://github.com/Mic92) commented at [2020-03-28 03:18](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/27#issuecomment-605387095):
4385
4386 My mistake it should have been:
4387
4388 ```
4389 #! /usr/bin/env nix-shell
4390 #! nix-shell -i python3 -p python3
4391 ```
4392
4393
4394 -------------------------------------------------------------------------------
4395
4396 # [\#26 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/26) `closed`: enable distribution via pip/setuptools
4397
4398 #### <img src="https://avatars.githubusercontent.com/u/96200?u=9ed15c85825694d00e996d605d728179b830c4fa&v=4" width="50">[Mic92](https://github.com/Mic92) opened issue at [2020-01-02 09:01](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/26):
4399
4400
4401
4402 #### <img src="https://avatars.githubusercontent.com/u/96200?u=9ed15c85825694d00e996d605d728179b830c4fa&v=4" width="50">[Mic92](https://github.com/Mic92) commented at [2020-02-25 09:34](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/26#issuecomment-590771724):
4403
4404 > Hi Jörg,
4405 > Thanks a lot for your work.
4406 > I'm not familiar with setuptools, but it looks to me that integrating that is a good idea.
4407 > There are a few aspects that I would like to fix before merging.
4408
4409 >     1. Can we avoid creating the `kconfig_hardened_check` directory? I would rather have `bin` and `config_files`.
4410
4411
4412 No one needs a distinct module to put the python code in to avoid conflicts with other installed python packages.
4413
4414 >     2. What is the purpose of splitting the code onto `bin/kconfig_hardened_check` and `kconfig_hardened_check/__init__.py`? Is it some special python feng-shui? (I'm asking because I'm just a kernel developer)
4415
4416
4417 `bin/kconfig_hardened_check` is for people just checking out the repository and running the script without installing it. If you install it with `setuptools`,
4418 it will generate its own wrapper that will eventually load `kconfig_hardened_check/__init__.py`.
4419
4420 >     3. I would like to split setuptools integration and the code refactoring onto separate commits. Moreover, I don't understand the `List[Any]` changes.
4421
4422 `List[Any]` is a type annotation. When you use a typechecker like mypy you can typecheck your code that way.
4423
4424
4425 >     4. Are you sure that the classifiers in `setup.cfg` are correct? It looks like some of them don't fit this project.
4426
4427
4428
4429 >     5. The `package_data` in `setup.cfg` misses some files in the repository. Is it ok?
4430
4431 It should only contain files that are supposed to be installed. I am not even sure having those config files provides any benefit for a user of the tool.
4432 Let me know and I would not include them at all.
4433
4434
4435
4436 > Thanks!
4437
4438 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-03-26 13:20](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/26#issuecomment-604427052):
4439
4440 Hello @Mic92,
4441 I carefully reimplemented your proof-of-concept in a set of separate commits.
4442 Fixed mistakes in setup.cfg, added MANIFEST.in, fixed issues with global variables.
4443 Thank you very much, I learned a lot!
4444
4445
4446 -------------------------------------------------------------------------------
4447
4448 # [\#25 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/25) `closed`: Hardened Kernel Config File for Virtual Machines (VMs) ("cloud kernel")
4449
4450 #### <img src="https://avatars.githubusercontent.com/u/1985040?u=b84e7065f9f8d62fbff9ac468a0cf0757718ed77&v=4" width="50">[adrelanos](https://github.com/adrelanos) opened issue at [2019-12-28 20:35](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/25):
4451
4452 A kernel config specialized for better security inside virtual machines is in development.
4453
4454 The development preview version can be found here:
4455 https://github.com/Whonix/hardened-kernel/blob/master/usr/share/hardened-kernel/hardened-vm-kernel
4456
4457 This work is being done by @madaidan who also contributed pull requests to [linux-hardened](https://github.com/anthraxx/linux-hardened).
4458
4459 https://github.com/anthraxx/linux-hardened/pulls?utf8=%E2%9C%93&q=author%3Amadaidan
4460
4461 Discussions about the kernel config happen mostly in Whonix forums.
4462
4463 https://forums.whonix.org/t/kernel-recompilation-for-better-hardening/7598/214
4464
4465 The hardened kernel config was contributed by @madaidan to the @Whonix project but as the maintainer of Whonix I think that it is not the most suitable project to maintain a kernel config. It would be more impactful and would get more eyes on it if it was hosted here.
4466
4467 Therefore I am wondering if there is any chance you would accept a pull request for a hardened (VM) config file? Which folder would be suitable for such a config file?
4468
4469 @madaidan is also working on a hardened bare metal (i.e. non-VM) kernel config:
4470 https://github.com/Whonix/hardened-kernel/blob/master/usr/share/hardened-kernel/hardened-host-kernel
4471
4472 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-01-02 23:27](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/25#issuecomment-570397241):
4473
4474 Hello @adrelanos,
4475 I guess Whonix has a default and hardened config, am I right?
4476 Is the difference between them documented anywhere?
4477 We can take Whonix official configs to the `config_files/distros/`.
4478 That's useful for a brief comparison of kernel hardening adoption by various Linux distributions.
4479 There is also the `config_files/links.txt` file that describes how to get official configs from various distros.
4480 Thanks!
4481
4482 #### <img src="https://avatars.githubusercontent.com/u/50278627?v=4" width="50">[madaidan](https://github.com/madaidan) commented at [2020-01-05 17:22](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/25#issuecomment-570930694):
4483
4484 The current Whonix default is the Debian default. It will be changed to the config mentioned in the post once it's finished.
4485
4486 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2020-01-10 15:20](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/25#issuecomment-573077384):
4487
4488 Ok.
4489 So when it is finished, you are welcome to send me the pull request that
4490  - adds the official Whonix hardened config to `config_files/distros/`;
4491  - adds the corresponding info to `config_files/links.txt`.
4492
4493 #### <img src="https://avatars.githubusercontent.com/u/42802201?v=4" width="50">[tsautereau-anssi](https://github.com/tsautereau-anssi) commented at [2020-01-13 15:59](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/25#issuecomment-573735007):
4494
4495 @madaidan After reading your [post](https://github.com/anthraxx/linux-hardened/issues/21) on the linux-hardened repository, it seems you might be interested in contributing some of your changes to the [CLIP OS kernel](https://github.com/clipos/src_external_linux/) (see our current configuration [here](https://github.com/clipos/src_platform_config-linux-hardware/tree/master/kernel_config)). If so, don't hesitate to [open an issue](https://github.com/clipos/bugs), it would be much appreciated!
4496
4497 Thanks @msalaun-anssi for the heads-up ;)
4498
4499 #### <img src="https://avatars.githubusercontent.com/u/1985040?u=b84e7065f9f8d62fbff9ac468a0cf0757718ed77&v=4" width="50">[adrelanos](https://github.com/adrelanos) commented at [2020-01-13 16:25](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/25#issuecomment-573747860):
4500
4501 Created https://github.com/clipos/bugs/issues/38 for it.
4502
4503 #### <img src="https://avatars.githubusercontent.com/u/50278627?v=4" width="50">[madaidan](https://github.com/madaidan) commented at [2020-01-13 18:15](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/25#issuecomment-573797636):
4504
4505 > @madaidan After reading your post on the linux-hardened repository, it seems you might be interested in contributing some of your changes to the CLIP OS kernel (see our current configuration here). If so, don't hesitate to open an issue, it would be much appreciated!
4506
4507 Sounds great. I'll see what I can do.
4508
4509
4510 -------------------------------------------------------------------------------
4511
4512 # [\#24 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/24) `closed`: Create debian-buster.config
4513
4514 #### <img src="https://avatars.githubusercontent.com/u/89727?v=4" width="50">[alexandernst](https://github.com/alexandernst) opened issue at [2019-08-27 23:19](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/24):
4515
4516 ```
4517 [+] Trying to detect architecture in "../linux-source-4.19/.config"...
4518 [+] Detected architecture: X86_64
4519 [+] Checking "../linux-source-4.19/.config" against hardening preferences...
4520               option name               | desired val | decision |       reason       ||        check result
4521 ====================================================================================================================
4522 CONFIG_BUG                              |      y      |defconfig |  self_protection   ||             OK
4523 CONFIG_STRICT_KERNEL_RWX                |      y      |defconfig |  self_protection   ||             OK
4524 CONFIG_STACKPROTECTOR_STRONG            |      y      |defconfig |  self_protection   ||             OK
4525 CONFIG_SLUB_DEBUG                       |      y      |defconfig |  self_protection   ||             OK
4526 CONFIG_STRICT_MODULE_RWX                |      y      |defconfig |  self_protection   ||             OK
4527 CONFIG_PAGE_TABLE_ISOLATION             |      y      |defconfig |  self_protection   ||             OK
4528 CONFIG_RANDOMIZE_MEMORY                 |      y      |defconfig |  self_protection   ||             OK
4529 CONFIG_RANDOMIZE_BASE                   |      y      |defconfig |  self_protection   ||             OK
4530 CONFIG_RETPOLINE                        |      y      |defconfig |  self_protection   ||             OK
4531 CONFIG_X86_SMAP                         |      y      |defconfig |  self_protection   ||             OK
4532 CONFIG_X86_INTEL_UMIP                   |      y      |defconfig |  self_protection   ||             OK
4533 CONFIG_SYN_COOKIES                      |      y      |defconfig |  self_protection   ||             OK
4534 CONFIG_VMAP_STACK                       |      y      |defconfig |  self_protection   ||             OK
4535 CONFIG_THREAD_INFO_IN_TASK              |      y      |defconfig |  self_protection   ||             OK
4536 CONFIG_BUG_ON_DATA_CORRUPTION           |      y      |   kspp   |  self_protection   ||             OK
4537 CONFIG_DEBUG_WX                         |      y      |   kspp   |  self_protection   ||             OK
4538 CONFIG_SCHED_STACK_END_CHECK            |      y      |   kspp   |  self_protection   ||             OK
4539 CONFIG_SLAB_FREELIST_HARDENED           |      y      |   kspp   |  self_protection   ||             OK
4540 CONFIG_SLAB_FREELIST_RANDOM             |      y      |   kspp   |  self_protection   ||             OK
4541 CONFIG_SHUFFLE_PAGE_ALLOCATOR           |      y      |   kspp   |  self_protection   ||      FAIL: not found
4542 CONFIG_FORTIFY_SOURCE                   |      y      |   kspp   |  self_protection   ||             OK
4543 CONFIG_GCC_PLUGINS                      |      y      |   kspp   |  self_protection   ||      FAIL: not found
4544 CONFIG_GCC_PLUGIN_RANDSTRUCT            |      y      |   kspp   |  self_protection   ||      FAIL: not found
4545 CONFIG_GCC_PLUGIN_LATENT_ENTROPY        |      y      |   kspp   |  self_protection   ||      FAIL: not found
4546 CONFIG_DEBUG_LIST                       |      y      |   kspp   |  self_protection   ||             OK
4547 CONFIG_DEBUG_SG                         |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"
4548 CONFIG_DEBUG_CREDENTIALS                |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"
4549 CONFIG_DEBUG_NOTIFIERS                  |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"
4550 CONFIG_PAGE_POISONING                   |      y      |   kspp   |  self_protection   ||             OK
4551 CONFIG_HARDENED_USERCOPY                |      y      |   kspp   |  self_protection   ||             OK
4552 CONFIG_HARDENED_USERCOPY_FALLBACK       | is not set  |   kspp   |  self_protection   ||             OK
4553 CONFIG_MODULE_SIG                       |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"
4554 CONFIG_MODULE_SIG_ALL                   |      y      |   kspp   |  self_protection   ||      FAIL: not found
4555 CONFIG_MODULE_SIG_SHA512                |      y      |   kspp   |  self_protection   ||      FAIL: not found
4556 CONFIG_MODULE_SIG_FORCE                 |      y      |   kspp   |  self_protection   ||      FAIL: not found
4557 CONFIG_DEFAULT_MMAP_MIN_ADDR            |    65536    |   kspp   |  self_protection   ||             OK
4558 CONFIG_REFCOUNT_FULL                    |      y      |   kspp   |  self_protection   ||             OK
4559 CONFIG_LOCK_DOWN_KERNEL                 |      y      |  clipos  |  self_protection   ||             OK
4560 CONFIG_SECURITY_DMESG_RESTRICT          |      y      |  clipos  |  self_protection   ||             OK
4561 CONFIG_DEBUG_VIRTUAL                    |      y      |  clipos  |  self_protection   ||     FAIL: "is not set"
4562 CONFIG_STATIC_USERMODEHELPER            |      y      |  clipos  |  self_protection   ||     FAIL: "is not set"
4563 CONFIG_SLAB_MERGE_DEFAULT               | is not set  |  clipos  |  self_protection   ||         FAIL: "y"
4564 CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE| is not set  |  clipos  |  self_protection   ||FAIL: CONFIG_GCC_PLUGIN_RANDSTRUCT is needed
4565 CONFIG_GCC_PLUGIN_STACKLEAK             |      y      |  clipos  |  self_protection   ||      FAIL: not found
4566 CONFIG_STACKLEAK_METRICS                | is not set  |  clipos  |  self_protection   ||FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is needed
4567 CONFIG_STACKLEAK_RUNTIME_DISABLE        | is not set  |  clipos  |  self_protection   ||FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is needed
4568 CONFIG_RANDOM_TRUST_CPU                 | is not set  |  clipos  |  self_protection   ||         FAIL: "y"
4569 CONFIG_MICROCODE                        |      y      |  clipos  |  self_protection   ||             OK
4570 CONFIG_IOMMU_SUPPORT                    |      y      |  clipos  |  self_protection   ||             OK
4571 CONFIG_INTEL_IOMMU                      |      y      |  clipos  |  self_protection   ||             OK
4572 CONFIG_INTEL_IOMMU_SVM                  |      y      |  clipos  |  self_protection   ||             OK
4573 CONFIG_INTEL_IOMMU_DEFAULT_ON           |      y      |  clipos  |  self_protection   ||     FAIL: "is not set"
4574 CONFIG_INIT_STACK_ALL                   |      y      |    my    |  self_protection   ||      FAIL: not found
4575 CONFIG_SLUB_DEBUG_ON                    |      y      |    my    |  self_protection   ||     FAIL: "is not set"
4576 CONFIG_SECURITY_LOADPIN                 |      y      |    my    |  self_protection   ||     FAIL: "is not set"
4577 CONFIG_RESET_ATTACK_MITIGATION          |      y      |    my    |  self_protection   ||     FAIL: "is not set"
4578 CONFIG_PAGE_POISONING_NO_SANITY         | is not set  |    my    |  self_protection   ||         FAIL: "y"
4579 CONFIG_PAGE_POISONING_ZERO              | is not set  |    my    |  self_protection   ||             OK
4580 CONFIG_AMD_IOMMU                        |      y      |    my    |  self_protection   ||             OK
4581 CONFIG_AMD_IOMMU_V2                     |      y      |    my    |  self_protection   ||             OK
4582 CONFIG_SECURITY                         |      y      |defconfig |  security_policy   ||             OK
4583 CONFIG_SECURITY_YAMA                    |      y      |   kspp   |  security_policy   ||             OK
4584 CONFIG_SECCOMP                          |      y      |defconfig | cut_attack_surface ||             OK
4585 CONFIG_SECCOMP_FILTER                   |      y      |defconfig | cut_attack_surface ||             OK
4586 CONFIG_STRICT_DEVMEM                    |      y      |defconfig | cut_attack_surface ||             OK
4587 CONFIG_MODULES                          | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"
4588 CONFIG_DEVMEM                           | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"
4589 CONFIG_IO_STRICT_DEVMEM                 |      y      |   kspp   | cut_attack_surface ||             OK
4590 CONFIG_ACPI_CUSTOM_METHOD               | is not set  |   kspp   | cut_attack_surface ||             OK
4591 CONFIG_COMPAT_BRK                       | is not set  |   kspp   | cut_attack_surface ||             OK
4592 CONFIG_DEVKMEM                          | is not set  |   kspp   | cut_attack_surface ||             OK
4593 CONFIG_COMPAT_VDSO                      | is not set  |   kspp   | cut_attack_surface ||             OK
4594 CONFIG_BINFMT_MISC                      | is not set  |   kspp   | cut_attack_surface ||             OK
4595 CONFIG_INET_DIAG                        | is not set  |   kspp   | cut_attack_surface ||             OK
4596 CONFIG_KEXEC                            | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"
4597 CONFIG_PROC_KCORE                       | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"
4598 CONFIG_LEGACY_PTYS                      | is not set  |   kspp   | cut_attack_surface ||             OK
4599 CONFIG_HIBERNATION                      | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"
4600 CONFIG_LEGACY_VSYSCALL_NONE             |      y      |   kspp   | cut_attack_surface ||             OK
4601 CONFIG_IA32_EMULATION                   | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"
4602 CONFIG_X86_X32                          | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"
4603 CONFIG_MODIFY_LDT_SYSCALL               | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"
4604 CONFIG_X86_PTDUMP                       | is not set  |grsecurity| cut_attack_surface ||             OK
4605 CONFIG_ZSMALLOC_STAT                    | is not set  |grsecurity| cut_attack_surface ||       OK: not found
4606 CONFIG_PAGE_OWNER                       | is not set  |grsecurity| cut_attack_surface ||             OK
4607 CONFIG_DEBUG_KMEMLEAK                   | is not set  |grsecurity| cut_attack_surface ||             OK
4608 CONFIG_BINFMT_AOUT                      | is not set  |grsecurity| cut_attack_surface ||       OK: not found
4609 CONFIG_KPROBES                          | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"
4610 CONFIG_UPROBES                          | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"
4611 CONFIG_GENERIC_TRACER                   | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"
4612 CONFIG_PROC_VMCORE                      | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"
4613 CONFIG_PROC_PAGE_MONITOR                | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"
4614 CONFIG_USELIB                           | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"
4615 CONFIG_CHECKPOINT_RESTORE               | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"
4616 CONFIG_USERFAULTFD                      | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"
4617 CONFIG_HWPOISON_INJECT                  | is not set  |grsecurity| cut_attack_surface ||             OK
4618 CONFIG_MEM_SOFT_DIRTY                   | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"
4619 CONFIG_DEVPORT                          | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"
4620 CONFIG_DEBUG_FS                         | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"
4621 CONFIG_NOTIFIER_ERROR_INJECTION         | is not set  |grsecurity| cut_attack_surface ||             OK
4622 CONFIG_ACPI_TABLE_UPGRADE               | is not set  | lockdown | cut_attack_surface ||         FAIL: "y"
4623 CONFIG_ACPI_APEI_EINJ                   | is not set  | lockdown | cut_attack_surface ||             OK
4624 CONFIG_PROFILING                        | is not set  | lockdown | cut_attack_surface ||         FAIL: "y"
4625 CONFIG_BPF_SYSCALL                      | is not set  | lockdown | cut_attack_surface ||         FAIL: "y"
4626 CONFIG_MMIOTRACE_TEST                   | is not set  | lockdown | cut_attack_surface ||             OK
4627 CONFIG_KSM                              | is not set  |  clipos  | cut_attack_surface ||         FAIL: "y"
4628 CONFIG_IKCONFIG                         | is not set  |  clipos  | cut_attack_surface ||         FAIL: "m"
4629 CONFIG_KALLSYMS                         | is not set  |  clipos  | cut_attack_surface ||         FAIL: "y"
4630 CONFIG_X86_VSYSCALL_EMULATION           | is not set  |  clipos  | cut_attack_surface ||         FAIL: "y"
4631 CONFIG_MAGIC_SYSRQ                      | is not set  |  clipos  | cut_attack_surface ||         FAIL: "y"
4632 CONFIG_KEXEC_FILE                       | is not set  |  clipos  | cut_attack_surface ||         FAIL: "y"
4633 CONFIG_USER_NS                          | is not set  |  clipos  | cut_attack_surface ||         FAIL: "y"
4634 CONFIG_LDISC_AUTOLOAD                   | is not set  |  clipos  | cut_attack_surface ||         FAIL: "y"
4635 CONFIG_MMIOTRACE                        | is not set  |    my    | cut_attack_surface ||         FAIL: "y"
4636 CONFIG_LIVEPATCH                        | is not set  |    my    | cut_attack_surface ||         FAIL: "y"
4637 CONFIG_IP_DCCP                          | is not set  |    my    | cut_attack_surface ||             OK
4638 CONFIG_IP_SCTP                          | is not set  |    my    | cut_attack_surface ||             OK
4639 CONFIG_FTRACE                           | is not set  |    my    | cut_attack_surface ||         FAIL: "y"
4640 CONFIG_BPF_JIT                          | is not set  |    my    | cut_attack_surface ||         FAIL: "y"
4641 CONFIG_ARCH_MMAP_RND_BITS               |     32      |  clipos  |userspace_protection||         FAIL: "28"
4642
4643 [+] config check is finished: 'OK' - 60 / 'FAIL' - 60
4644 ```
4645
4646 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-08-30 12:40](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/24#issuecomment-526586258):
4647
4648 Hello @alexandernst,
4649
4650 Thanks for your PR.
4651
4652 I decided to compare the your config with one available here:
4653 https://packages.debian.org/buster/linux-image-4.19.0-5-amd64
4654
4655 They differ a lot.
4656 Where did you get your config?
4657
4658 Best regards,
4659 Alexander
4660
4661 #### <img src="https://avatars.githubusercontent.com/u/89727?v=4" width="50">[alexandernst](https://github.com/alexandernst) commented at [2019-08-30 12:56](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/24#issuecomment-526591340):
4662
4663 The config file was generated using the instructions in https://kernel-team.pages.debian.net/kernel-handbook/ch-common-tasks.html#s-common-building
4664
4665 ```
4666 apt install -y linux-source fakeroot libelf-dev libssl-dev
4667 tar xaf /usr/src/linux-source-4.19.tar.xz
4668 cd linux-source-4.19/
4669 yes "" | make localmodconfig
4670 scripts/config --disable MODULE_SIG
4671 ```
4672
4673 #### <img src="https://avatars.githubusercontent.com/u/89727?v=4" width="50">[alexandernst](https://github.com/alexandernst) commented at [2019-08-30 12:58](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/24#issuecomment-526591989):
4674
4675 Oh, this was built using an AWS EC2 instance, so that might be causing the differences between a vainilla debian config and my config.
4676
4677 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-08-30 13:07](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/24#issuecomment-526595179):
4678
4679 Right, let me quote the kernel documentation:
4680 ```
4681 "make localmodconfig" Create a config based on current config and loaded modules (lsmod).
4682 ```
4683 https://www.kernel.org/doc/html/latest/admin-guide/README.html?highlight=localmodconfig
4684
4685 Would you like to fix your PR?
4686 If so I would also ask to add info to `config_files/links.txt`.
4687
4688 Thanks!
4689
4690 #### <img src="https://avatars.githubusercontent.com/u/89727?v=4" width="50">[alexandernst](https://github.com/alexandernst) commented at [2019-08-30 13:38](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/24#issuecomment-526605210):
4691
4692 I'm not really sure if by "fix" you mean rename the file to something like `debian-buster-aws.config` or by replace the config with the one from https://packages.debian.org/buster/linux-image-4.19.0-5-amd64 ?
4693
4694 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-08-30 13:44](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/24#issuecomment-526607017):
4695
4696 I think adding an original Debian config would be more useful for everyone.
4697 Also it would be nice if you find a direct link to this config and add it to `links.txt`.
4698
4699 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-11-28 07:36](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/24#issuecomment-559376496):
4700
4701 Closing the PR (I've finally did it myself: ad80700, 4f9c653).
4702 Thanks.
4703
4704
4705 -------------------------------------------------------------------------------
4706
4707 # [\#23 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/23) `closed`: LOCK_DOWN_KERNEL 
4708
4709 #### <img src="https://avatars.githubusercontent.com/u/11277437?v=4" width="50">[rubeecube](https://github.com/rubeecube) opened issue at [2019-07-22 12:05](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/23):
4710
4711 Hello,
4712
4713 Thank you for this awesome project!
4714
4715 It seems that "LOCK_DOWN_KERNEL" / "LOCK_DOWN MANDATORY" enable other flags.
4716
4717 - No unsigned modules and no modules for which can't validate the signature.
4718 - No use of ioperm(), iopl() and no writing to /dev/port.
4719 - No writing to /dev/mem or /dev/kmem.
4720 - No hibernation.
4721 - Restrict PCI BAR access.
4722 - Restrict MSR access.
4723 - No kexec_load().
4724 - Certain ACPI restrictions.
4725 - Restrict debugfs interface to ASUS WMI.
4726
4727 http://lkml.iu.edu/hypermail/linux/kernel/1704.0/02933.html 
4728
4729 Is it possible to reflect this in the script?
4730
4731 #### <img src="https://avatars.githubusercontent.com/u/67428?u=cc677701e49dca0be4cdc6ea10bc60b52a181e4e&v=4" width="50">[jelly](https://github.com/jelly) commented at [2019-07-22 12:18](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/23#issuecomment-513767366):
4732
4733 The kernel lockdown patch has not been merged yet and I'm not sure if it's possible to enable these hardening functionality without the patch.
4734
4735 Also the linked patch is out of a date, there is a newer revision implemented as LSM https://lore.kernel.org/linux-security-module/20190404003249.14356-1-matthewgarrett@google.com/T/#m50dd383459d65d52d80c90f36af860a7c10f364c
4736
4737 #### <img src="https://avatars.githubusercontent.com/u/11277437?v=4" width="50">[rubeecube](https://github.com/rubeecube) commented at [2019-07-22 12:27](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/23#issuecomment-513770393):
4738
4739 Ok, I'm new to this and didn't know that.
4740 Thanks
4741
4742 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2019-07-23 12:15](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/23#issuecomment-514184160):
4743
4744 Some distros like Fedora or Ubuntu are using lockdown kernel patches for a long time.
4745
4746 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-08-12 08:27](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/23#issuecomment-520338183):
4747
4748 Hello everyone!
4749
4750 @bokobok, some time ago I looked through the lockdown patchset in Ubuntu kernel tree.
4751 I marked the kernel options enforced by lockdown with a special comment in the script:
4752 ```
4753 # refers to LOCK_DOWN_KERNEL
4754 ```
4755 For more details please see https://github.com/a13xp0p0v/kconfig-hardened-check/commit/796a22935ab5cd3ddcf19c4ea85411d9bf04fef6
4756
4757 When the lockdown patchset is finally merged, I will look through the commits once again and update the script.
4758
4759 @jelly @Bernhard40, thanks for your commentary.
4760
4761 #### <img src="https://avatars.githubusercontent.com/u/67428?u=cc677701e49dca0be4cdc6ea10bc60b52a181e4e&v=4" width="50">[jelly](https://github.com/jelly) commented at [2019-08-12 18:27](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/23#issuecomment-520540892):
4762
4763 It's getting close to mainline http://kernsec.org/pipermail/linux-security-module-archive/2019-August/015795.html
4764
4765
4766 -------------------------------------------------------------------------------
4767
4768 # [\#22 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/22) `merged`: #20 fix: use right quotes in json output
4769
4770 #### <img src="https://avatars.githubusercontent.com/u/4029800?u=86702d3f2d50ee01ef1c572ef26b1ea1318f28da&v=4" width="50">[adrianopol](https://github.com/adrianopol) opened issue at [2019-07-07 19:27](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/22):
4771
4772 #20: fix quotes for --json
4773
4774
4775
4776
4777 -------------------------------------------------------------------------------
4778
4779 # [\#21 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/21) `merged`: add --json option
4780
4781 #### <img src="https://avatars.githubusercontent.com/u/4029800?u=86702d3f2d50ee01ef1c572ef26b1ea1318f28da&v=4" width="50">[adrianopol](https://github.com/adrianopol) opened issue at [2019-06-21 19:57](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/21):
4782
4783 With `--json` output will be formatted as array of arrays:
4784
4785 `[['CONFIG_BUG', 'y', 'defconfig', 'self_protection', 'OK'], ['CONFIG_STRICT_KERNEL_RWX', 'y', 'defconfig', 'self_protection', 'OK'], ...`
4786
4787 #### <img src="https://avatars.githubusercontent.com/u/4029800?u=86702d3f2d50ee01ef1c572ef26b1ea1318f28da&v=4" width="50">[adrianopol](https://github.com/adrianopol) commented at [2019-06-24 09:24](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/21#issuecomment-504931635):
4788
4789 Fixed.
4790
4791 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-06-24 11:11](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/21#issuecomment-504965369):
4792
4793 Thank you!
4794 Merged.
4795
4796
4797 -------------------------------------------------------------------------------
4798
4799 # [\#20 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/20) `closed`: JSON output
4800
4801 #### <img src="https://avatars.githubusercontent.com/u/964610?u=f244bab6b14967638a88cef92752379e64b15996&v=4" width="50">[Wenzel](https://github.com/Wenzel) opened issue at [2019-06-10 14:11](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/20):
4802
4803 Hi,
4804
4805 I would like to integrate your project into a Python script which would check the security settings automatically and provide a report.
4806
4807 Would it be possible to have an easily parsable JSON output ?
4808 Otherwise processing with your data will be very difficult, if you are not human.
4809
4810 Thanks !
4811
4812 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-06-11 10:03](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/20#issuecomment-500775436):
4813
4814 Hello @Wenzel 
4815
4816 > I would like tot integrate your project into a Python script which would check the security settings automatically and provide a report.
4817
4818 Nice!
4819
4820 > Would it be possible to have an easily parsable JSON output ?
4821 Otherwise processing with your data will be very difficult, if you are not human.
4822
4823 It sounds reasonable. I'll have a look in my free time.
4824 If you already know how to implement it, the pull request is welcome!
4825
4826 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-06-24 11:12](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/20#issuecomment-504965591):
4827
4828 Hello @Wenzel and @nettrino,
4829
4830 @adrianopol has added the JSON output feature (#21), please check the `--json` argument.
4831
4832 #### <img src="https://avatars.githubusercontent.com/u/964610?u=f244bab6b14967638a88cef92752379e64b15996&v=4" width="50">[Wenzel](https://github.com/Wenzel) commented at [2019-07-07 12:51](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/20#issuecomment-508997348):
4833
4834 Hi @a13xp0p0v , @adrianopol ,
4835
4836 I would like to reopen this issue because I just tested the `--json` flag, and the output produced is not valid JSON.
4837
4838 `piping in jq`
4839 ![Screenshot_20190707_144843](https://user-images.githubusercontent.com/964610/60768633-84977d00-a0c6-11e9-978a-ebbb65e9ed11.png)
4840
4841
4842 Output example for `./kconfig-hardened-check.py -c /boot/config-5.1.12-300.fc30.x86_64 --json`
4843 ~~~
4844 [['CONFIG_BUG', 'y', 'defconfig', 'self_protection', 'OK'], ['CONFIG_STRICT_KERNEL_RWX', 'y', 'defconfig', 'self_protection', 'OK'], ['CONFIG_STACKPROTECTOR_STRONG', 'y', 'defconfig', 'self_protection', 'OK'], ['CONFIG_SLUB_DEBUG', 'y', 'defconfig', 'self_protection', 'OK'], ['CONFIG_STRICT_MODULE_RWX', 'y', 'defconfig', 'self_protection', 'OK'], ['CONFIG_PAGE_TABLE_ISOLATION', 'y', 'defconfig', 'self_protection', 'OK'], ['CONFIG_RANDOMIZE_MEMORY', 'y', 'defconfig', 'self_protection', 'OK'], ['CONFIG_RANDOMIZE_BASE', 'y', 'defconfig', 'self_protection', 'OK'], ['CONFIG_RETPOLINE', 'y', 'defconfig', 'self_protection', 'OK'], ['CONFIG_X86_SMAP', 'y', 'defconfig', 'self_protection', 'OK'], ['CONFIG_X86_INTEL_UMIP', 'y', 'defconfig', 'self_protection', 'OK'], ['CONFIG_SYN_COOKIES', 'y', 'defconfig', 'self_protection', 'OK'], ['CONFIG_VMAP_STACK', 'y', 'defconfig', 'self_protection', 'OK'], ['CONFIG_THREAD_INFO_IN_TASK', 'y', 'defconfig', 'self_protection', 'OK'], ['CONFIG_BUG_ON_DATA_CORRUPTION', 'y', 'kspp', 'self_protection', 'OK'], ['CONFIG_DEBUG_WX', 'y', 'kspp', 'self_protection', 'OK'], ['CONFIG_SCHED_STACK_END_CHECK', 'y', 'kspp', 'self_protection', 'FAIL: "is not set"'], ['CONFIG_SLAB_FREELIST_HARDENED', 'y', 'kspp', 'self_protection', 'OK'], ['CONFIG_SLAB_FREELIST_RANDOM', 'y', 'kspp', 'self_protection', 'OK'], ['CONFIG_FORTIFY_SOURCE', 'y', 'kspp', 'self_protection', 'OK'], ['CONFIG_GCC_PLUGINS', 'y', 'kspp', 'self_protection', 'FAIL: not found'], ['CONFIG_GCC_PLUGIN_RANDSTRUCT', 'y', 'kspp', 'self_protection', 'FAIL: not found'], ['CONFIG_GCC_PLUGIN_STRUCTLEAK', 'y', 'kspp', 'self_protection', 'FAIL: not found'], ['CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL', 'y', 'kspp', 'self_protection', 'FAIL: not found'], ['CONFIG_GCC_PLUGIN_LATENT_ENTROPY', 'y', 'kspp', 'self_protection', 'FAIL: not found'], ['CONFIG_DEBUG_LIST', 'y', 'kspp', 'self_protection', 'OK'], ['CONFIG_DEBUG_SG', 'y', 'kspp', 'self_protection', 'FAIL: "is not set"'], ['CONFIG_DEBUG_CREDENTIALS', 'y', 'kspp', 'self_protection', 'FAIL: "is not set"'], ['CONFIG_DEBUG_NOTIFIERS', 'y', 'kspp', 'self_protection', 'FAIL: "is not set"'], ['CONFIG_PAGE_POISONING', 'y', 'kspp', 'self_protection', 'FAIL: "is not set"'], ['CONFIG_HARDENED_USERCOPY', 'y', 'kspp', 'self_protection', 'OK'], ['CONFIG_HARDENED_USERCOPY_FALLBACK', 'is not set', 'kspp', 'self_protection', 'FAIL: "y"'], ['CONFIG_MODULE_SIG', 'y', 'kspp', 'self_protection', 'OK'], ['CONFIG_MODULE_SIG_ALL', 'y', 'kspp', 'self_protection', 'OK'], ['CONFIG_MODULE_SIG_SHA512', 'y', 'kspp', 'self_protection', 'FAIL: "is not set"'], ['CONFIG_MODULE_SIG_FORCE', 'y', 'kspp', 'self_protection', 'FAIL: "is not set"'], ['CONFIG_DEFAULT_MMAP_MIN_ADDR', '65536', 'kspp', 'self_protection', 'OK'], ['CONFIG_REFCOUNT_FULL', 'y', 'kspp', 'self_protection', 'FAIL: "is not set"'], ['CONFIG_LOCK_DOWN_KERNEL', 'y', 'clipos', 'self_protection', 'OK'], ['CONFIG_SECURITY_DMESG_RESTRICT', 'y', 'clipos', 'self_protection', 'FAIL: "is not set"'], ['CONFIG_DEBUG_VIRTUAL', 'y', 'clipos', 'self_protection', 'FAIL: "is not set"'], ['CONFIG_STATIC_USERMODEHELPER', 'y', 'clipos', 'self_protection', 'FAIL: "is not set"'], ['CONFIG_SLAB_MERGE_DEFAULT', 'is not set', 'clipos', 'self_protection', 'FAIL: "y"'], ['CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE', 'is not set', 'clipos', 'self_protection', 'FAIL: CONFIG_GCC_PLUGIN_RANDSTRUCT is needed'], ['CONFIG_GCC_PLUGIN_STACKLEAK', 'y', 'clipos', 'self_protection', 'FAIL: not found'], ['CONFIG_STACKLEAK_METRICS', 'is not set', 'clipos', 'self_protection', 'FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is needed'], ['CONFIG_STACKLEAK_RUNTIME_DISABLE', 'is not set', 'clipos', 'self_protection', 'FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is needed'], ['CONFIG_RANDOM_TRUST_CPU', 'is not set', 'clipos', 'self_protection', 'FAIL: "y"'], ['CONFIG_MICROCODE', 'y', 'clipos', 'self_protection', 'OK'], ['CONFIG_IOMMU_SUPPORT', 'y', 'clipos', 'self_protection', 'OK'], ['CONFIG_INTEL_IOMMU', 'y', 'clipos', 'self_protection', 'OK'], ['CONFIG_INTEL_IOMMU_SVM', 'y', 'clipos', 'self_protection', 'OK'], ['CONFIG_INTEL_IOMMU_DEFAULT_ON', '
4845 y', 'clipos', 'self_protection', 'FAIL: "is not set"'], ['CONFIG_AMD_IOMMU', 'y', 'my', 'self_protection', 'OK'], ['CONFIG_AMD_IOMMU_V2', 'y', 'my', 'self_protection', 'FAIL: "m"'], ['CONFIG_SLUB_DEBUG_ON', 'y', 'my', 'self_protection', 'FAIL: "is not set"'], ['CONFIG_SECURITY_LOADPIN', 'y', 'my', 'self_protection', 'FAIL: "is not set"'], ['CONFIG_RESET_ATTACK_MITIGATION', 'y', 'my', 'self_protection', 'FAIL: "is not set"'], ['CONFIG_PAGE_POISONING_NO_SANITY', 'is not set', 'my', 'self_protection', 'FAIL: CONFIG_PAGE_POISONING is needed'], ['CONFIG_PAGE_POISONING_ZERO', 'is not set', 'my', 'self_protection', 'FAIL: CONFIG_PAGE_POISONING is needed'], ['CONFIG_SECURITY', 'y', 'defconfig', 'security_policy', 'OK'], ['CONFIG_SECURITY_YAMA', 'y', 'kspp', 'security_policy', 'OK'], ['CONFIG_SECCOMP', 'y', 'defconfig', 'cut_attack_surface', 'OK'], ['CONFIG_SECCOMP_FILTER', 'y', 'defconfig', 'cut_attack_surface', 'OK'], ['CONFIG_STRICT_DEVMEM', 'y', 'defconfig', 'cut_attack_surface', 'OK'], ['CONFIG_MODULES', 'is not set', 'kspp', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_DEVMEM', 'is not set', 'kspp', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_IO_STRICT_DEVMEM', 'y', 'kspp', 'cut_attack_surface', 'OK'], ['CONFIG_ACPI_CUSTOM_METHOD', 'is not set', 'kspp', 'cut_attack_surface', 'FAIL: "m"'], ['CONFIG_COMPAT_BRK', 'is not set', 'kspp', 'cut_attack_surface', 'OK'], ['CONFIG_DEVKMEM', 'is not set', 'kspp', 'cut_attack_surface', 'OK'], ['CONFIG_COMPAT_VDSO', 'is not set', 'kspp', 'cut_attack_surface', 'OK'], ['CONFIG_BINFMT_MISC', 'is not set', 'kspp', 'cut_attack_surface', 'FAIL: "m"'], ['CONFIG_INET_DIAG', 'is not set', 'kspp', 'cut_attack_surface', 'FAIL: "m"'], ['CONFIG_KEXEC', 'is not set', 'kspp', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_PROC_KCORE', 'is not set', 'kspp', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_LEGACY_PTYS', 'is not set', 'kspp', 'cut_attack_surface', 'OK'], ['CONFIG_HIBERNATION', 'is not set', 'kspp', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_LEGACY_VSYSCALL_NONE', 'y', 'kspp', 'cut_attack_surface', 'FAIL: "is not set"'], ['CONFIG_IA32_EMULATION', 'is not set', 'kspp', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_X86_X32', 'is not set', 'kspp', 'cut_attack_surface', 'OK'], ['CONFIG_MODIFY_LDT_SYSCALL', 'is not set', 'kspp', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_X86_PTDUMP', 'is not set', 'grsecurity', 'cut_attack_surface', 'OK'], ['CONFIG_ZSMALLOC_STAT', 'is not set', 'grsecurity', 'cut_attack_surface', 'OK'], ['CONFIG_PAGE_OWNER', 'is not set', 'grsecurity', 'cut_attack_surface', 'OK'], ['CONFIG_DEBUG_KMEMLEAK', 'is not set', 'grsecurity', 'cut_attack_surface', 'OK'], ['CONFIG_BINFMT_AOUT', 'is not set', 'grsecurity', 'cut_attack_surface', 'OK: not found'], ['CONFIG_KPROBES', 'is not set', 'grsecurity', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_UPROBES', 'is not set', 'grsecurity', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_GENERIC_TRACER', 'is not set', 'grsecurity', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_PROC_VMCORE', 'is not set', 'grsecurity', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_PROC_PAGE_MONITOR', 'is not set', 'grsecurity', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_USELIB', 'is not set', 'grsecurity', 'cut_attack_surface', 'OK'], ['CONFIG_CHECKPOINT_RESTORE', 'is not set', 'grsecurity', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_USERFAULTFD', 'is not set', 'grsecurity', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_HWPOISON_INJECT', 'is not set', 'grsecurity', 'cut_attack_surface', 'FAIL: "m"'], ['CONFIG_MEM_SOFT_DIRTY', 'is not set', 'grsecurity', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_DEVPORT', 'is not set', 'grsecurity', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_DEBUG_FS', 'is not set', 'grsecurity', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_NOTIFIER_ERROR_INJECTION', 'is not set', 'grsecurity', 'cut_attack_surface', 'OK'], ['CONFIG_ACPI_TABLE_UPGRADE', 'is not set', 'lockdown', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_ACPI_APEI_EINJ', 'is not set', 'lockdown', 'cut_attack_surface', 'FAIL: "m"'], ['CONFIG_PROFILING', 'is not set', '
4846 lockdown', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_BPF_SYSCALL', 'is not set', 'lockdown', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_MMIOTRACE_TEST', 'is not set', 'lockdown', 'cut_attack_surface', 'OK'], ['CONFIG_KSM', 'is not set', 'clipos', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_IKCONFIG', 'is not set', 'clipos', 'cut_attack_surface', 'OK'], ['CONFIG_KALLSYMS', 'is not set', 'clipos', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_X86_VSYSCALL_EMULATION', 'is not set', 'clipos', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_MAGIC_SYSRQ', 'is not set', 'clipos', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_KEXEC_FILE', 'is not set', 'clipos', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_USER_NS', 'is not set', 'clipos', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_LDISC_AUTOLOAD', 'is not set', 'clipos', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_MMIOTRACE', 'is not set', 'my', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_LIVEPATCH', 'is not set', 'my', 'cut_attack_surface', 'OK'], ['CONFIG_IP_DCCP', 'is not set', 'my', 'cut_attack_surface', 'OK'], ['CONFIG_IP_SCTP', 'is not set', 'my', 'cut_attack_surface', 'FAIL: "m"'], ['CONFIG_FTRACE', 'is not set', 'my', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_BPF_JIT', 'is not set', 'my', 'cut_attack_surface', 'FAIL: "y"'], ['CONFIG_ARCH_MMAP_RND_BITS', '32', 'clipos', 'userspace_protection', 'FAIL: "28"']]
4847 ~~~
4848
4849 Could you rework the PR and check the JSON output ?
4850 I think it might be a trivial fix, like double quotes instead of simple quotes:
4851 ![Screenshot_20190707_145217](https://user-images.githubusercontent.com/964610/60768672-e0620600-a0c6-11e9-80f8-4454265c50fc.png)
4852
4853
4854 Thanks !
4855
4856 #### <img src="https://avatars.githubusercontent.com/u/964610?u=f244bab6b14967638a88cef92752379e64b15996&v=4" width="50">[Wenzel](https://github.com/Wenzel) commented at [2019-07-07 12:55](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/20#issuecomment-508997636):
4857
4858 It should be more robust to use `json.dump(obj)` or `json.dumps(string)` instead of printing your own JSON.
4859 https://github.com/a13xp0p0v/kconfig-hardened-check/blob/master/kconfig-hardened-check.py#L377
4860
4861 #### <img src="https://avatars.githubusercontent.com/u/4029800?u=86702d3f2d50ee01ef1c572ef26b1ea1318f28da&v=4" width="50">[adrianopol](https://github.com/adrianopol) commented at [2019-07-07 19:28](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/20#issuecomment-509024571):
4862
4863 Fixed. Thanks.
4864
4865 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-07-08 14:12](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/20#issuecomment-509241942):
4866
4867 @Wenzel, thanks for the report.
4868 @adrianopol, thanks for the fix, merged.
4869 Double-checked it in json validator, now it should be fine.
4870
4871
4872 -------------------------------------------------------------------------------
4873
4874 # [\#19 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/19) `closed`: Compare with clipos recommendations
4875
4876 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) opened issue at [2019-06-01 12:08](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/19):
4877
4878 Hi Alexander,
4879
4880 I monitoring an interesting project ([CLIP OS ](https://github.com/clipos)) in my country and some options should be compared with your project.
4881
4882 Here are some options that are missing or different from kconfig-hardened-check :
4883
4884 ```
4885 CONFIG_AUDIT=y
4886 CONFIG_IKCONFIG=n
4887 CONFIG_KALLSYMS=n
4888 CONFIG_SLAB_HARDENED=y
4889 CONFIG_SLAB_CANARY=y
4890 CONFIG_SLAB_SANITIZE=y
4891 CONFIG_SLAB_SANITIZE_VERIFY=y
4892 CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE=n
4893 CONFIG_LOCAL_INIT=n
4894 CONFIG_X86_VSYSCALL_EMULATION=n
4895 CONFIG_MICROCODE=y
4896 CONFIG_X86_MSR=y
4897 CONFIG_KSM=n
4898 CONFIG_MTRR=y
4899 CONFIG_X86_PAT=y
4900 CONFIG_ARCH_RANDOM=y
4901 CONFIG_X86_INTEL_MPX=n
4902 CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS=n
4903 CONFIG_CRASH_DUMP=n
4904 CONFIG_COREDUMP=n
4905 CONFIG_TCG_TPM=n
4906 CONFIG_RANDOM_TRUST_CPU=n
4907 CONFIG_IOMMU_SUPPORT=y
4908 CONFIG_INTEL_IOMMU=y
4909 CONFIG_INTEL_IOMMU_SVM=y
4910 CONFIG_INTEL_IOMMU_DEFAULT_ON=y
4911 CONFIG_MAGIC_SYSRQ=n
4912 CONFIG_DEBUG_KERNEL=y
4913 CONFIG_DEBUG_VIRTUAL=y
4914 CONFIG_SLUB_DEBUG_ON=n
4915 CONFIG_PANIC_ON_OOPS=y
4916 CONFIG_PANIC_TIMEOUT=-1
4917 CONFIG_INTEL_TXT=n
4918 CONFIG_FORTIFY_SOURCE_STRICT_STRING=n
4919 CONFIG_STATIC_USERMODEHELPER_PATH=""
4920 CONFIG_SECURITY_SELINUX_BOOTPARAM=n
4921 CONFIG_INTEGRITY=n
4922 CONFIG_SECURITY_PERF_EVENTS_RESTRICT=y
4923 CONFIG_PAGE_SANITIZE_VERIFY=y
4924 CONFIG_SECURITY_TIOCSTI_RESTRICT=y
4925 CONFIG_LOCK_DOWN_MANDATORY=y
4926 CONFIG_STACKLEAK_TRACK_MIN_SIZE=100
4927 CONFIG_STACKLEAK_METRICS=n
4928 CONFIG_STACKLEAK_RUNTIME_DISABLE=n
4929 ```
4930
4931 Details of the options are available here:
4932 https://docs.clip-os.org/clipos/kernel.html#configuration
4933
4934 Best regards,
4935
4936 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2019-06-01 12:12](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/19#issuecomment-497939852):
4937
4938 Even if I'm not a fan of black magic (see [this](https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/3)), the CONFIG_MICROCODE=y option is now essential.
4939
4940 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2019-06-02 11:33](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/19#issuecomment-498022889):
4941
4942 Some of those options are available only in linux-hardened patchset thus not applicable here. Others like CONFIG_INTEGRITY=n or CONFIG_INTEL_TXT=n are specific to clipos and general recommendations would be the opposite.
4943
4944 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2019-06-02 15:13](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/19#issuecomment-498039692):
4945
4946 Yes, you're right, I did a quick extraction. 
4947 Are there any options you think are interesting?
4948
4949 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-06-03 10:23](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/19#issuecomment-498201117):
4950
4951 Cool! @HacKurx, learning the CLIP OS config is a nice idea.
4952
4953 Thanks for the link, I'll check the options from their documentation and choose relevant for the script.
4954
4955 Do you have their full kernel config for adding to `config_files`?
4956
4957 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-06-03 18:16](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/19#issuecomment-498368130):
4958
4959 Hi @HacKurx and @Bernhard40,
4960 I've added new checks based on the CLIP OS recommendations.
4961
4962 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2019-06-03 19:02](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/19#issuecomment-498384402):
4963
4964 Hi @a13xp0p0v,
4965
4966 Thanks you :)
4967
4968 > Do you have their full kernel config for adding to config_files?
4969
4970 The configuration is automatically generated by a script in their own kernel source:
4971 https://github.com/clipos/src_platform_config-linux-hardware/tree/master/
4972 https://github.com/clipos/src_external_linux
4973
4974 I can ask @tsautereau-anssi for confirm it.
4975
4976 Best regards,
4977
4978 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2019-06-04 10:20](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/19#issuecomment-498612884):
4979
4980 @a13xp0p0v `CONFIG_X86_MSR` could also be set to `m` which I think should be ok.
4981
4982 At least Ubuntu, Debian, Archlinux and opensSUSE have it set this way.
4983
4984 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-06-04 22:12](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/19#issuecomment-498862822):
4985
4986 >@a13xp0p0v CONFIG_X86_MSR could also be set to m which I think should be ok.
4987 At least Ubuntu, Debian, Archlinux and opensSUSE have it set this way.
4988
4989 @Bernhard40, thanks for pointing this out.
4990 I double-checked and dropped this recommendation - IMO it's wrong.
4991 CONFIG_X86_MSR provides access from the userspace to the x86 MSRs via char devices.
4992 Kernel doesn't need it for mitigating CPU bugs.
4993
4994 I've created an issue with a question for the CLIP OS project:
4995 https://github.com/clipos/src_platform_config-linux-hardware/issues/1
4996
4997
4998 -------------------------------------------------------------------------------
4999
5000 # [\#18 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/18) `merged`: Update pentoo config link
5001
5002 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) opened issue at [2019-06-01 12:02](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/18):
5003
5004
5005
5006
5007
5008
5009 -------------------------------------------------------------------------------
5010
5011 # [\#17 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/17) `merged`: Update and add config
5012
5013 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) opened issue at [2019-05-12 15:09](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/17):
5014
5015 Hi Alexander,
5016
5017 Here are some updates and the addition of two distributions.
5018
5019 I let you choose ;)
5020
5021 Best regards,
5022
5023 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-05-17 15:13](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/17#issuecomment-493490338):
5024
5025 Hello @HacKurx,
5026 Thanks for the update!
5027 I'm merging it.
5028
5029 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-05-17 15:20](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/17#issuecomment-493492947):
5030
5031 @HacKurx, may I ask you to add/update information in the `links.txt` as well?
5032 Thanks!
5033
5034 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2019-05-25 16:59](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/17#issuecomment-495933123):
5035
5036 Hello @a13xp0p0v,
5037
5038 Thank's for the merge. Some configuration files do not have a url (debian, ubuntu, rhel), I had to extract the configuration from the kernel package.
5039 I am willing to maintain all config occasionally.
5040
5041 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-05-27 14:39](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/17#issuecomment-496234113):
5042
5043 Nice, thanks!
5044
5045 I mean some of your new configs now have out-of-date links in `links.txt`.
5046 For example, Alpine, Arch and Pentoo. Could you please update the links?
5047
5048
5049 -------------------------------------------------------------------------------
5050
5051 # [\#16 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/16) `closed`: After kspp settings server if freezed
5052
5053 #### <img src="https://avatars.githubusercontent.com/u/3471772?v=4" width="50">[bryn1u](https://github.com/bryn1u) opened issue at [2019-04-11 12:37](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/16):
5054
5055 Hey guys,
5056
5057 When i setup server Centos 7 with kspp settings (config below) and i install www hosting panels like Cpanel, CWP panel or ISPmanager and then reboot server, many services are freezed. My network is disabled i cant run with command systemct start network, i cant  reboot server and etc... when i push these commend nothing happen, just waiting and waiting.
5058
5059 My KSPP config:
5060
5061 [+] config check is finished: 'OK' - 62 / 'FAIL' - 41
5062 [root@proton kconfig-hardened-check]# ls
5063 config_files  kconfig-hardened-check.py  LICENSE  README.md
5064 [root@proton kconfig-hardened-check]# ./kconfig-hardened-check.py -c /boot/config-5.0.4 > kspp_setting
5065 [root@proton kconfig-hardened-check]# cat kspp_setting 
5066 [+] Trying to detect architecture in "/boot/config-5.0.4"...
5067 [+] Detected architecture: X86_64
5068 [+] Checking "/boot/config-5.0.4" against hardening preferences...
5069   option name                            | desired val | decision |       reason       ||        check result        
5070   ===================================================================================================================
5071   CONFIG_BUG                             |      y      |defconfig |  self_protection   ||             OK             
5072   CONFIG_STRICT_KERNEL_RWX               |      y      |defconfig |  self_protection   ||             OK             
5073   CONFIG_STACKPROTECTOR_STRONG           |      y      |defconfig |  self_protection   ||             OK             
5074   CONFIG_SLUB_DEBUG                      |      y      |defconfig |  self_protection   ||             OK             
5075   CONFIG_STRICT_MODULE_RWX               |      y      |defconfig |  self_protection   ||             OK             
5076   CONFIG_PAGE_TABLE_ISOLATION            |      y      |defconfig |  self_protection   ||             OK             
5077   CONFIG_RANDOMIZE_MEMORY                |      y      |defconfig |  self_protection   ||             OK             
5078   CONFIG_RANDOMIZE_BASE                  |      y      |defconfig |  self_protection   ||             OK             
5079   CONFIG_RETPOLINE                       |      y      |defconfig |  self_protection   ||             OK             
5080   CONFIG_X86_SMAP                        |      y      |defconfig |  self_protection   ||             OK             
5081   CONFIG_X86_INTEL_UMIP                  |      y      |defconfig |  self_protection   ||             OK             
5082   CONFIG_SYN_COOKIES                     |      y      |defconfig |  self_protection   ||             OK             
5083   CONFIG_VMAP_STACK                      |      y      |defconfig |  self_protection   ||             OK             
5084   CONFIG_THREAD_INFO_IN_TASK             |      y      |defconfig |  self_protection   ||             OK             
5085   CONFIG_BUG_ON_DATA_CORRUPTION          |      y      |   kspp   |  self_protection   ||             OK             
5086   CONFIG_DEBUG_WX                        |      y      |   kspp   |  self_protection   ||             OK             
5087   CONFIG_SCHED_STACK_END_CHECK           |      y      |   kspp   |  self_protection   ||             OK             
5088   CONFIG_SLAB_FREELIST_HARDENED          |      y      |   kspp   |  self_protection   ||             OK             
5089   CONFIG_SLAB_FREELIST_RANDOM            |      y      |   kspp   |  self_protection   ||             OK             
5090   CONFIG_FORTIFY_SOURCE                  |      y      |   kspp   |  self_protection   ||             OK             
5091   CONFIG_GCC_PLUGINS                     |      y      |   kspp   |  self_protection   ||             OK             
5092   CONFIG_GCC_PLUGIN_RANDSTRUCT           |      y      |   kspp   |  self_protection   ||             OK             
5093   CONFIG_GCC_PLUGIN_STRUCTLEAK           |      y      |   kspp   |  self_protection   ||             OK             
5094   CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL |      y      |   kspp   |  self_protection   ||             OK             
5095   CONFIG_GCC_PLUGIN_LATENT_ENTROPY       |      y      |   kspp   |  self_protection   ||             OK             
5096   CONFIG_DEBUG_LIST                      |      y      |   kspp   |  self_protection   ||             OK             
5097   CONFIG_DEBUG_SG                        |      y      |   kspp   |  self_protection   ||             OK             
5098   CONFIG_DEBUG_CREDENTIALS               |      y      |   kspp   |  self_protection   ||             OK             
5099   CONFIG_DEBUG_NOTIFIERS                 |      y      |   kspp   |  self_protection   ||             OK             
5100   CONFIG_PAGE_POISONING                  |      y      |   kspp   |  self_protection   ||             OK             
5101   CONFIG_HARDENED_USERCOPY               |      y      |   kspp   |  self_protection   ||             OK             
5102   CONFIG_HARDENED_USERCOPY_FALLBACK      | is not set  |   kspp   |  self_protection   ||             OK             
5103   CONFIG_MODULE_SIG                      |      y      |   kspp   |  self_protection   ||             OK             
5104   CONFIG_MODULE_SIG_ALL                  |      y      |   kspp   |  self_protection   ||             OK             
5105   CONFIG_MODULE_SIG_SHA512               |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"     
5106   CONFIG_MODULE_SIG_FORCE                |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"     
5107   CONFIG_DEFAULT_MMAP_MIN_ADDR           |    65536    |   kspp   |  self_protection   ||             OK             
5108   CONFIG_REFCOUNT_FULL                   |      y      |   kspp   |  self_protection   ||             OK             
5109   CONFIG_GCC_PLUGIN_STACKLEAK            |      y      |    my    |  self_protection   ||             OK             
5110   CONFIG_LOCK_DOWN_KERNEL                |      y      |    my    |  self_protection   ||      FAIL: not found       
5111   CONFIG_SLUB_DEBUG_ON                   |      y      |    my    |  self_protection   ||             OK             
5112   CONFIG_SECURITY_DMESG_RESTRICT         |      y      |    my    |  self_protection   ||             OK             
5113   CONFIG_STATIC_USERMODEHELPER           |      y      |    my    |  self_protection   ||     FAIL: "is not set"     
5114   CONFIG_SECURITY_LOADPIN                |      y      |    my    |  self_protection   ||     FAIL: "is not set"     
5115   CONFIG_RESET_ATTACK_MITIGATION         |      y      |    my    |  self_protection   ||             OK             
5116   CONFIG_SLAB_MERGE_DEFAULT              | is not set  |    my    |  self_protection   ||         FAIL: "y"          
5117   CONFIG_PAGE_POISONING_NO_SANITY        | is not set  |    my    |  self_protection   ||             OK             
5118   CONFIG_PAGE_POISONING_ZERO             | is not set  |    my    |  self_protection   ||             OK             
5119   CONFIG_SECURITY                        |      y      |defconfig |  security_policy   ||             OK             
5120   CONFIG_SECURITY_YAMA                   |      y      |   kspp   |  security_policy   ||             OK             
5121   CONFIG_SECURITY_SELINUX_DISABLE        | is not set  |   kspp   |  security_policy   ||             OK             
5122   CONFIG_SECCOMP                         |      y      |defconfig | cut_attack_surface ||             OK             
5123   CONFIG_SECCOMP_FILTER                  |      y      |defconfig | cut_attack_surface ||             OK             
5124   CONFIG_STRICT_DEVMEM                   |      y      |defconfig | cut_attack_surface ||             OK             
5125   CONFIG_MODULES                         | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
5126   CONFIG_DEVMEM                          | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
5127   CONFIG_IO_STRICT_DEVMEM                |      y      |   kspp   | cut_attack_surface ||     FAIL: "is not set"     
5128   CONFIG_ACPI_CUSTOM_METHOD              | is not set  |   kspp   | cut_attack_surface ||         FAIL: "m"          
5129   CONFIG_COMPAT_BRK                      | is not set  |   kspp   | cut_attack_surface ||             OK             
5130   CONFIG_DEVKMEM                         | is not set  |   kspp   | cut_attack_surface ||             OK             
5131   CONFIG_COMPAT_VDSO                     | is not set  |   kspp   | cut_attack_surface ||             OK             
5132   CONFIG_BINFMT_MISC                     | is not set  |   kspp   | cut_attack_surface ||         FAIL: "m"          
5133   CONFIG_INET_DIAG                       | is not set  |   kspp   | cut_attack_surface ||         FAIL: "m"          
5134   CONFIG_KEXEC                           | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
5135   CONFIG_PROC_KCORE                      | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
5136   CONFIG_LEGACY_PTYS                     | is not set  |   kspp   | cut_attack_surface ||             OK             
5137   CONFIG_HIBERNATION                     | is not set  |   kspp   | cut_attack_surface ||             OK             
5138   CONFIG_LEGACY_VSYSCALL_NONE            |      y      |   kspp   | cut_attack_surface ||     FAIL: "is not set"     
5139   CONFIG_IA32_EMULATION                  | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
5140   CONFIG_X86_X32                         | is not set  |   kspp   | cut_attack_surface ||             OK             
5141   CONFIG_MODIFY_LDT_SYSCALL              | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
5142   CONFIG_X86_PTDUMP                      | is not set  |grsecurity| cut_attack_surface ||             OK             
5143   CONFIG_ZSMALLOC_STAT                   | is not set  |grsecurity| cut_attack_surface ||             OK             
5144   CONFIG_PAGE_OWNER                      | is not set  |grsecurity| cut_attack_surface ||             OK             
5145   CONFIG_DEBUG_KMEMLEAK                  | is not set  |grsecurity| cut_attack_surface ||             OK             
5146   CONFIG_BINFMT_AOUT                     | is not set  |grsecurity| cut_attack_surface ||       OK: not found        
5147   CONFIG_KPROBES                         | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
5148   CONFIG_UPROBES                         | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
5149   CONFIG_GENERIC_TRACER                  | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
5150   CONFIG_PROC_VMCORE                     | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
5151   CONFIG_PROC_PAGE_MONITOR               | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
5152   CONFIG_USELIB                          | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
5153   CONFIG_CHECKPOINT_RESTORE              | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
5154   CONFIG_USERFAULTFD                     | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
5155   CONFIG_HWPOISON_INJECT                 | is not set  |grsecurity| cut_attack_surface ||         FAIL: "m"          
5156   CONFIG_MEM_SOFT_DIRTY                  | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
5157   CONFIG_DEVPORT                         | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
5158   CONFIG_DEBUG_FS                        | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
5159   CONFIG_NOTIFIER_ERROR_INJECTION        | is not set  |grsecurity| cut_attack_surface ||             OK             
5160   CONFIG_ACPI_TABLE_UPGRADE              | is not set  | lockdown | cut_attack_surface ||         FAIL: "y"          
5161   CONFIG_ACPI_APEI_EINJ                  | is not set  | lockdown | cut_attack_surface ||         FAIL: "m"          
5162   CONFIG_PROFILING                       | is not set  | lockdown | cut_attack_surface ||         FAIL: "y"          
5163   CONFIG_BPF_SYSCALL                     | is not set  | lockdown | cut_attack_surface ||         FAIL: "y"          
5164   CONFIG_MMIOTRACE_TEST                  | is not set  | lockdown | cut_attack_surface ||       OK: not found        
5165   CONFIG_MMIOTRACE                       | is not set  |    my    | cut_attack_surface ||             OK             
5166   CONFIG_KEXEC_FILE                      | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
5167   CONFIG_LIVEPATCH                       | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
5168   CONFIG_USER_NS                         | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
5169   CONFIG_IP_DCCP                         | is not set  |    my    | cut_attack_surface ||         FAIL: "m"          
5170   CONFIG_IP_SCTP                         | is not set  |    my    | cut_attack_surface ||         FAIL: "m"          
5171   CONFIG_FTRACE                          | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
5172   CONFIG_BPF_JIT                         | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
5173   CONFIG_ARCH_MMAP_RND_BITS              |     32      |    my    |userspace_protection||         FAIL: "28"         
5174
5175 [+] config check is finished: 'OK' - 62 / 'FAIL' - 41
5176
5177
5178 Someone can help me with this, i would be graceful ?
5179 Could be impact because of this ?
5180 CONFIG_GCC_PLUGINS | y | kspp | self_protection || OK
5181 CONFIG_GCC_PLUGIN_RANDSTRUCT | y | kspp | self_protection || OK
5182 CONFIG_GCC_PLUGIN_STRUCTLEAK | y | kspp | self_protection || OK
5183 CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL | y | kspp | self_protection || OK
5184 CONFIG_GCC_PLUGIN_LATENT_ENTROPY | y | kspp | self_protection || OK
5185
5186 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2019-04-11 19:26](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/16#issuecomment-482272466):
5187
5188 Could you post `dmesg` output?
5189
5190 #### <img src="https://avatars.githubusercontent.com/u/3471772?v=4" width="50">[bryn1u](https://github.com/bryn1u) commented at [2019-04-14 13:50](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/16#issuecomment-482980574):
5191
5192 Hey,
5193
5194 Sure.
5195 I put my KSPP config again but as a screen: https://ufile.io/epovx3h9
5196 Second part of KSPP config:  https://ufile.io/n4087vqn
5197
5198 Output from dmesg:
5199 dmesg 1 - https://ufile.io/2reh95ag
5200 dmesg 2 - https://ufile.io/mkt1sv73
5201
5202 Thanks,
5203
5204 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-04-14 20:45](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/16#issuecomment-483056865):
5205
5206 Hello @bryn1u,
5207
5208 As I can understand, you are trying to run Centos 7 with the mainline kernel (5.0.7).
5209 I would recommend you to move by smaller steps.
5210
5211 First -- update your kernel, but use `make oldconfig` with the original kernel config from Centos 7.
5212 Maybe something will break even after this step.
5213
5214 And then try to enable hardening options one by one performing your functional test after each change.
5215 You can speed up this procedure using bisection method (between the initial and final configs).
5216
5217 @Bernhard40, any other advices?
5218
5219
5220 -------------------------------------------------------------------------------
5221
5222 # [\#15 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/15) `closed`: After used KSPP settings, modules ext4, xfs, iptables are disabled.
5223
5224 #### <img src="https://avatars.githubusercontent.com/u/3471772?v=4" width="50">[bryn1u](https://github.com/bryn1u) opened issue at [2019-03-22 13:09](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/15):
5225
5226 Hello a13xp0p0v :))
5227
5228 Im using centos 7 and i have a weird problem after kernel compilation. Below is my config kernel with KSPP options enabled.
5229 ![kernel1](https://user-images.githubusercontent.com/3471772/54824577-a271db00-4cab-11e9-92fc-4974a17b41d1.png)
5230 ![kernel2](https://user-images.githubusercontent.com/3471772/54824582-a69df880-4cab-11e9-9c34-604be7280fd1.png)
5231 ![kernel3](https://user-images.githubusercontent.com/3471772/54824586-ab62ac80-4cab-11e9-98af-5b5c98baa232.png)
5232
5233 I have no idea why after kernel compiling, modules like for example ext4, xfs and iptables are disabled. I can't login to the system because ext4 module is disable. The only way is to compiling permanently not as a module. But iptables still dosen't work. Which options are responsible for these "issues" ?
5234 Thanks for help :)
5235
5236
5237 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2019-03-23 17:18](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/15#issuecomment-475888038):
5238
5239 It could be caused by `CONFIG_STATIC_USERMODEHELPER`. This option needs userspace support which is pretty much non-existent in distros, don't use it.
5240
5241 #### <img src="https://avatars.githubusercontent.com/u/3471772?v=4" width="50">[bryn1u](https://github.com/bryn1u) commented at [2019-03-23 20:07](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/15#issuecomment-475900478):
5242
5243 Thanks Bernhard40. I disabled usermodhelper and it works.
5244
5245 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-03-24 11:35](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/15#issuecomment-475950377):
5246
5247 Hello!
5248
5249 @Bernhard40, thanks for your help!
5250
5251 @bryn1u, I remember we have discussed with you that STATIC_USERMODEHELPER and SECURITY_LOADPIN influence module loading -- in #8.
5252
5253 That's why the script has the following comments:
5254 ```
5255 checklist.append(OptCheck('STATIC_USERMODEHELPER', 'y', 'my', 'self_protection')) # needs userspace support (systemd)
5256 checklist.append(OptCheck('SECURITY_LOADPIN', 'y', 'my', 'self_protection')) # needs userspace support
5257 ```
5258
5259
5260 -------------------------------------------------------------------------------
5261
5262 # [\#14 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/14) `closed`: User namespace useful especially when running containers
5263
5264 #### <img src="https://avatars.githubusercontent.com/u/1397088?v=4" width="50">[jcberthon](https://github.com/jcberthon) opened issue at [2019-03-19 14:59](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/14):
5265
5266 Maybe I'm wrong, but at least with Kernel 5.0 USER_NS is activated by default, so "is not set" or "y" should be equivalent. At the moment, it fails because it is "y" on my configuration.
5267
5268 I know that activating USER_NS can cut the attack surface if it is not needed on a system. But on my system which are running containers, I want to have USER_NS activated. True this is not pure hardening of the Kernel, but if we take into account the whole kernel including the possibilities to use it to make containers, then USER_NS should be part of the whole hardening.
5269
5270 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2019-03-19 18:02](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/14#issuecomment-474500985):
5271
5272 > Maybe I'm wrong, but at least with Kernel 5.0 USER_NS is activated by default, so "is not set" or "y" should be equivalent. At the moment, it fails because it is "y" on my configuration.
5273
5274 "is not set" (disabled) is the opposite of "y" (enabled). The fail for "y" is desired outcome.
5275
5276 > I know that activating USER_NS can cut the attack surface if it is not needed on a system. But on my system which are running containers, I want to have USER_NS activated. True this is not pure hardening of the Kernel, but if we take into account the whole kernel including the possibilities to use it to make containers, then USER_NS should be part of the whole hardening.
5277
5278 You have it backwards. **Disabling** USER_NS [cuts the attack surface](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings#sysctls) and is part of kernel hardening. USER_NS (unprivileged) are considered inherently insecure and unfixable.
5279
5280 #### <img src="https://avatars.githubusercontent.com/u/1397088?v=4" width="50">[jcberthon](https://github.com/jcberthon) commented at [2019-03-19 21:20](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/14#issuecomment-474589104):
5281
5282 Thanks for clarifying the first point.
5283
5284 Concerning the second point, I know that username space could increase the attack surface (heck I recall there was like 1,5-2 years ago a privilege escalation flaw with user ns - albeit mitigated when using SELinux), that's especially true if the functionality is not used.
5285
5286 Anyway as the site you mention implicitly state, you can still compile it in and use the sysctl knob to disable it depending on your threat model and your usage of the kernel. So your application could test the sysctl knob rather than the kernel config. e.g. for people using Ubuntu but following the guideline (and because they do not need it), they can disable it in sysctl. When running your script, they should see that it is correctly disabled. What do you think?
5287
5288 _Note that when someone requires to run containers, user ns can be a good evil. It increases some risk but diminished others. It is a trade off which depends on one's threat model. I mean that I clearly prefer to run my containers as non-root user with as little capabilities as possible, so I would not need user namespaces. But I'm also maintaining a CI/CD environment based on Docker, and there it is pretty hard to deny users the use of root inside spawned containers. I can control capabilities, seccomp and SELinux, but not the root user. There I really need user namespace, I have no other choice._
5289
5290 Do you have a source for user ns being considered unfixable?
5291
5292 Anyway, I understand your reasoning for marking user ns as insecure, so I would not be offended if you would decide to close this issue. Of course I would appreciate you take my suggestion into account :-)
5293
5294 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2019-03-19 21:32](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/14#issuecomment-474592962):
5295
5296 its not just one like 2 years ago, userns is an endless stream of privilege escalation flaws exposed by root designed functionality accessible to any unprivileged user inside a user namespace over and over again.
5297
5298 In my personal opinion this should remain as is, being an error, and if your personal threat model doesn't care about user_ns you can just ignore the result of kconfig-hardened-check :cat:
5299
5300 #### <img src="https://avatars.githubusercontent.com/u/1397088?v=4" width="50">[jcberthon](https://github.com/jcberthon) commented at [2019-03-19 22:44](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/14#issuecomment-474613483):
5301
5302 Alright, and thanks for the feedback.
5303
5304 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-03-20 06:49](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/14#issuecomment-474708180):
5305
5306 Hello everyone,
5307
5308 I'm a bit late for the discussion.
5309
5310 @jcberthon, thanks for your message.
5311 Yes, the `CONFIG_USER_NS` option provides some isolation between the userspace programs, but the script recommends disabling it to cut the attack surface __of the kernel__.
5312 Let me give the links describing the rationale:
5313   
5314   1. A nice LWN article about the corresponding LKML discussion: https://lwn.net/Articles/673597/
5315   2. A twitter thread about USER_NS and security: https://twitter.com/robertswiecki/status/1095447678949953541
5316
5317 @jcberthon, you are right, USER_NS can be disabled using the sysctl - it is even mentioned in the script source code:
5318 ```
5319 checklist.append(OptCheck('USER_NS', 'is not set', 'my', 'cut_attack_surface')) # user.max_user_namespaces=0
5320 ```
5321
5322 (by the way, adding the ability to check kernel boot parameters and sysctl would be really nice)
5323
5324 Thanks for your discussion, I think I should add some clarification of `cut_attack_surface` to the README.
5325
5326 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2019-03-20 12:25](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/14#issuecomment-474807051):
5327
5328 > (by the way, adding the ability to check kernel boot parameters and sysctl would be really nice)
5329
5330 I'm not sure if it's good idea for this project to start scanning the running system for security features. I would vote for keeping it simple and just check chosen config file.
5331
5332 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-03-20 13:23](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/14#issuecomment-474826371):
5333
5334 > > (by the way, adding the ability to check kernel boot parameters and sysctl would be really nice)
5335
5336 > I'm not sure if it's good idea for this project to start scanning the running system for security features. I would vote for keeping it simple and just check chosen config file.
5337
5338 I agree, I don't like the privileged scanning of a system from the script too.
5339 I mean the script could analyze additional files with the needed information together with the kernel config.
5340 For example, right now we can say nothing about side-channel attack mitigations.
5341
5342 #### <img src="https://avatars.githubusercontent.com/u/1397088?v=4" width="50">[jcberthon](https://github.com/jcberthon) commented at [2019-03-20 23:09](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/14#issuecomment-475063272):
5343
5344 Thank you for the interesting read and for the updated README.
5345
5346
5347 -------------------------------------------------------------------------------
5348
5349 # [\#13 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/13) `closed`: False positive and false negatives
5350
5351 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) opened issue at [2019-03-09 19:13](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/13):
5352
5353 `PAGE_POISONING_NO_SANITY` and `PAGE_POISONING_ZERO` depend on `PAGE_POISONING`. Checking distro config which doesn't enable `PAGE_POISONING` (like Fedora) will show `OK: not found` for the first two even as it's far from ok in this case.
5354
5355 Currently script checks only for `MODULE_SIG_SHA512`. Some distros (like Fedora) may use `SHA256` which I think should be fine as well even if KSPP chose different example.
5356
5357 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-03-11 16:27](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/13#issuecomment-471614645):
5358
5359 Hello @Bernhard40,
5360 Thanks for your report, let's discuss it.
5361
5362 > PAGE_POISONING_NO_SANITY and PAGE_POISONING_ZERO depend on PAGE_POISONING. Checking distro config which doesn't enable PAGE_POISONING (like Fedora) will show OK: not found for the first two even as it's far from ok in this case.
5363
5364 Yes, they are dependent on PAGE_POISONING.
5365 These options make this feature weaker, so the script is checking that they are __disabled__.
5366 When the PAGE_POISONING is disabled, the error count is incremented anyway.
5367 I don't think that checking PAGE_POISONING_NO_SANITY and PAGE_POISONING_ZERO should behave differently in that case.
5368
5369 > Currently script checks only for MODULE_SIG_SHA512. Some distros (like Fedora) may use SHA256 which I think should be fine as well even if KSPP chose different example.
5370
5371 The MODULE_SIG_SHA512 option is the KSPP recommendation, it is explicitly indicated by the script.
5372 Distros may have various reasons to do it differently.
5373 One day the script will support the error annotations (the idea is described here: https://github.com/a13xp0p0v/kconfig-hardened-check/pull/9#issuecomment-453810119)
5374
5375 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2019-03-12 00:07](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/13#issuecomment-471790830):
5376
5377 > Yes, they are dependent on PAGE_POISONING.
5378 > These options make this feature weaker, so the script is checking that they are disabled.
5379 > When the PAGE_POISONING is disabled, the error count is incremented anyway.
5380 > I don't think that checking PAGE_POISONING_NO_SANITY and PAGE_POISONING_ZERO should behave differently in that case.
5381
5382 Consider distro which have PAGE_POISONING=n. In check it gets:
5383 ```
5384 CONFIG_PAGE_POISONING                  |      y      |   kspp   |  self_protection   ||     FAIL: "is not set" 
5385 CONFIG_PAGE_POISONING_NO_SANITY        | is not set  |    my    |  self_protection   ||       OK: not found
5386 CONFIG_PAGE_POISONING_ZERO             | is not set  |    my    |  self_protection   ||       OK: not found
5387 ```
5388 The sum is: 1xFAIL + 2xOK
5389
5390 Now, consider distro which has PAGE_POISONING=y, PAGE_POISONING_NO_SANITY=y, PAGE_POISONING_ZERO=y. In check it gets:
5391 ```
5392 CONFIG_PAGE_POISONING                  |      y      |   kspp   |  self_protection   ||             OK
5393 CONFIG_PAGE_POISONING_NO_SANITY        | is not set  |    my    |  self_protection   ||         FAIL: "y"
5394 CONFIG_PAGE_POISONING_ZERO             | is not set  |    my    |  self_protection   ||         FAIL: "y"
5395 ```
5396 The sum is: 2xFAIL + 1xOK
5397
5398 The check shows that distro which disables PAGE_POISONING completely is better than one which enables its weaker version! Specifically for fedora it's 52 errors with the former (actual config) vs 53 errors with the latter.
5399
5400 > The MODULE_SIG_SHA512 option is the KSPP recommendation, it is explicitly indicated by the script.
5401
5402 I read this recommendation as _sign your modules_ rather than _sign your modules using SHA512_. The KSPP page says [But if CONFIG_MODULE=y is needed, at least they must be signed with a per-build key](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings#CONFIGs). Below they show an example with SHA512. I highly doubt they meant SHA512 explicitly and nothing else. IMO they just used one example because iterating it for SHA256/SHA384 would be rather redundant. You may ask Kees about what he had in mind when he wrote this.
5403
5404 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-03-12 15:31](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/13#issuecomment-472049899):
5405
5406 > The check shows that distro which disables PAGE_POISONING completely is better than one which enables its weaker version! Specifically for fedora it's 52 errors with the former (actual config) vs 53 errors with the latter.
5407
5408 Right. Please have a look how I've solved this issue.
5409  - I've implemented the AND check: 555b588e7b8a620ee57d53ef771e3b128590de45.
5410  - It's now used for PAGE_POISONING_NO_SANITY and PAGE_POISONING_ZERO - they are not checked if PAGE_POISONING is off: a314e4f1df3893864e398ea8565fefdfc036169b.
5411  - The same approach for HARDENED_USERCOPY_FALLBACK: c83dc6c7c804987999296afba385b2349bdda9ac.
5412  - And I improved the output of final results: 43920b20672cd603f7d5e02544a951eec914636b. Now OKs are counted too.
5413
5414 > You may ask Kees about what he had in mind when he wrote this.
5415
5416 Ok, I will remember that. There are several things which can be added to KSPP wiki. I'll work on that later.
5417
5418 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2019-03-12 17:53](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/13#issuecomment-472112024):
5419
5420 > It's now used for PAGE_POISONING_NO_SANITY and PAGE_POISONING_ZERO - they are not checked if PAGE_POISONING is off:
5421
5422 You could also always mark them as failed in that case like `FAIL: "dependency missing"`. That would prevent FAIL count from increasing when enabling only PAGE_POISONING.
5423
5424 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-03-12 21:54](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/13#issuecomment-472196588):
5425
5426 > You could also always mark them as failed in that case like FAIL: "dependency missing"
5427
5428 @Bernhard40, nice idea, thank you.
5429 Implemented in d9aca2d28e9f95266bca2da09625d7d2c885a6b2.
5430
5431
5432 -------------------------------------------------------------------------------
5433
5434 # [\#12 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/12) `closed`: CONFIG_MODULE_SIG_FORCE shouldn't be checked if CONFIG_MODULES is not set
5435
5436 #### <img src="https://avatars.githubusercontent.com/u/990588?v=4" width="50">[hannob](https://github.com/hannob) opened issue at [2019-03-03 12:35](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/12):
5437
5438 I have a minimal kernel without modules for a server. I get a warning about CONFIG_MODULE_SIG_FORCE, which should not apply for a kernel without module support.
5439
5440 For several other module-related options the script behaves correctly (saying 'CONFIG_MODULES: OK ("is not set")' indicating this does not apply), but for CONFIG_MODULE_SIG_FORCE it does not do so.
5441
5442 Output is:
5443 ```
5444   CONFIG_MODULE_SIG_FORCE                |      y      |   kspp   |  self_protection   ||      FAIL: not found       
5445 ```
5446
5447 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-03-04 13:42](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/12#issuecomment-469256961):
5448
5449 Fixed.
5450 Thank you @hannob.
5451
5452
5453 -------------------------------------------------------------------------------
5454
5455 # [\#11 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/11) `closed`: Feature request: Check CONFIG_RESET_ATTACK_MITIGATION
5456
5457 #### <img src="https://avatars.githubusercontent.com/u/990588?v=4" width="50">[hannob](https://github.com/hannob) opened issue at [2019-03-02 08:17](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/11):
5458
5459 Thanks for this tool.
5460
5461 I'd propose to add a check for CONFIG_RESET_ATTACK_MITIGATION.
5462 This is a feature that on modern systems will set a flag on boot that signals the BIOS to wipe the memory if an unclean shutdown happened. This can protect against some forms of cold boot attacks where you reboot into another system and try to read out the memory from the previous run.
5463
5464 Here's the Kernel submission with some explanation:
5465 https://lwn.net/Articles/730006/
5466
5467 It's also explained in this talk:
5468 https://www.youtube.com/watch?v=RqvPZnLkP70 (around minute 35)
5469
5470 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2019-03-02 12:47](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/11#issuecomment-468917523):
5471
5472 This option needs userspace support, otherwise it's not recommended for use:
5473 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a5c03c31af2291f13689d11760c0b59fb70c9a5a
5474
5475 https://bugzilla.redhat.com/show_bug.cgi?id=1532058
5476
5477 #### <img src="https://avatars.githubusercontent.com/u/990588?v=4" width="50">[hannob](https://github.com/hannob) commented at [2019-03-03 12:33](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/11#issuecomment-469018559):
5478
5479 Interesting, is there any userspace tool to do this? Or is this basically unsupported in current systems?
5480
5481 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2019-03-03 12:49](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/11#issuecomment-469019815):
5482
5483 @hannob I wanted to look into this for systemd, but forgot for quite a while. thanks for reminding me, back then there was no userspace support, theoretically you could add a systemd service but doing it _properly_ is bit more tricky. I'm putting this back onto my todo list and take a dive into how to properly implement this into systemd itself at a place that could guarantee that all other services etc. are already properly shut down.
5484
5485 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-03-04 14:52](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/11#issuecomment-469280355):
5486
5487 Hello @hannob @Bernhard40 @anthraxx,
5488
5489 `RESET_ATTACK_MITIGATION` is a nice option, I will add this check to the script with a comment about userspace support.
5490
5491 That case will be similar to the `STATIC_USERMODEHELPER` option, which needs the userspace support as well (but, as I know, enabling it currently breaks systemd workflow on Ubuntu).
5492
5493 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-03-04 18:29](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/11#issuecomment-469362767):
5494
5495 Hm... By the way Ubuntu 18 has `RESET_ATTACK_MITIGATION` enabled.
5496
5497
5498 -------------------------------------------------------------------------------
5499
5500 # [\#10 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/10) `closed`: Add support for x86_32, arm, and arm64 architectures
5501
5502 #### <img src="https://avatars.githubusercontent.com/u/1051156?u=82b8caad104296ef90ffe2f5807dc34d82c31c2b&v=4" width="50">[tyhicks](https://github.com/tyhicks) opened issue at [2019-01-14 19:37](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/10):
5503
5504 (This is a continuation of #9)
5505
5506 Some hardening recommendations are dependent on the processor architecture. For example, the KSPP recommendations differ between [x86_32](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings#x86_32) and [x86_64](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings#x86_64).
5507
5508 This pull request adds the ability to reason about the architecture when constructing the checklist. It also teaches the script about `x86_32`, `arm`, and `arm64` specific config recommendations.
5509
5510 I verified that all the example configs in `config_files/` show the same number of config check failures before and after these changes are applied. Of course, the ordering of the options are changed since the ordering used to construct the checklist has been changed.
5511
5512 Some changes since #9 include:
5513 - Drop kernel version detection from the pull request
5514 - Rename `detect_arch_and_version()` to `detect_arch_from_config()`
5515 - Look for `CONFIG_X86_32` and `CONFIG_X86_64` when detecting `x86` sub architecture
5516 - Restrict the accepted `-a <ARCHITECTURE>` values to those found in `SUPPORTED_ARCHS`
5517
5518 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-01-14 20:58](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/10#issuecomment-454158772):
5519
5520 Hello @tyhicks , thanks a lot for the follow-up! Let me propose some improvements.
5521
5522 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-01-14 21:45](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/10#issuecomment-454173475):
5523
5524 @tyhicks , thanks for your work again!
5525 Let me propose one more idea. What do you think about splitting [KSPP recommended settings](http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings) onto 4 arch-specific configs in `./config_files/`?
5526
5527 #### <img src="https://avatars.githubusercontent.com/u/1051156?u=82b8caad104296ef90ffe2f5807dc34d82c31c2b&v=4" width="50">[tyhicks](https://github.com/tyhicks) commented at [2019-01-17 18:04](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/10#issuecomment-455270114):
5528
5529 Yes, I can add 4 arch-specific configs in `./config_files/`.
5530
5531 #### <img src="https://avatars.githubusercontent.com/u/1051156?u=82b8caad104296ef90ffe2f5807dc34d82c31c2b&v=4" width="50">[tyhicks](https://github.com/tyhicks) commented at [2019-01-17 23:44](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/10#issuecomment-455373860):
5532
5533 I've rebased on top of your current tree, fixed up a few things, added what I think you were asking for in the arch-specific KSPP files, and force pushed to this branch.
5534
5535 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-01-18 12:12](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/10#issuecomment-455526516):
5536
5537 Ouch. 
5538 @tyhicks , excuse me please!
5539 I've made a code review 3 days ago, but didn't hit "submit" button, so it is "pending" :(
5540 I've just realized that you haven't seen my review when I looked at your rebased branch.
5541 My fault.
5542
5543 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-01-18 13:01](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/10#issuecomment-455538355):
5544
5545 If you don't have time/desire, I can pick up your branch and polish it myself.
5546 Thank you again!
5547
5548 #### <img src="https://avatars.githubusercontent.com/u/1051156?u=82b8caad104296ef90ffe2f5807dc34d82c31c2b&v=4" width="50">[tyhicks](https://github.com/tyhicks) commented at [2019-01-18 23:16](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/10#issuecomment-455718260):
5549
5550 > If you don't have time/desire, I can pick up your branch and polish it myself.
5551
5552 I won't mind if you do the polishing yourself.
5553
5554 > Thank you again!
5555
5556 No problem. Thanks for all the review comments.
5557
5558 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-01-24 08:02](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/10#issuecomment-457102717):
5559
5560 Hello @tyhicks ,
5561
5562 I've finished with arch support based on your work.
5563 Do you like it?
5564 Do you have any comments or requests?
5565 Thanks!
5566
5567 #### <img src="https://avatars.githubusercontent.com/u/1051156?u=82b8caad104296ef90ffe2f5807dc34d82c31c2b&v=4" width="50">[tyhicks](https://github.com/tyhicks) commented at [2019-01-24 15:34](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/10#issuecomment-457240527):
5568
5569 Thanks for finishing out the work. It looks very good to me. I'll make use of the changes over the next week or so and submit new pull requests if I spot anything wrong/missing. Thanks again!
5570
5571
5572 -------------------------------------------------------------------------------
5573
5574 # [\#9 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/9) `closed`: Teach the script about target architecture and kernel version
5575
5576 #### <img src="https://avatars.githubusercontent.com/u/1051156?u=82b8caad104296ef90ffe2f5807dc34d82c31c2b&v=4" width="50">[tyhicks](https://github.com/tyhicks) opened issue at [2019-01-12 00:16](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/9):
5577
5578 Some recommendations are dependent on the processor architecture and/or the kernel version. For example, the KSPP recommendations differ between [x86_32](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings#x86_32) and [x86_64](https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings#x86_64). Additionally, option names change over time such as when `CONFIG_CC_STACKPROTECTOR_STRONG` was [renamed](https://kernsec.org/wiki/index.php?title=Kernel_Self_Protection_Project%2FRecommended_Settings&diff=3983&oldid=3976).
5579
5580 This pull request adds the ability to reason about the architecture and version when constructing the checklist. It also teaches the script about `x86_32`, `arm`, and `arm64` specific config recommendations.
5581
5582 #### <img src="https://avatars.githubusercontent.com/u/1051156?u=82b8caad104296ef90ffe2f5807dc34d82c31c2b&v=4" width="50">[tyhicks](https://github.com/tyhicks) commented at [2019-01-12 00:18](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/9#issuecomment-453698919):
5583
5584 I verified that all the example configs in `config_files/` show the same number of config check failures before and after these changes are applied. Of course, the ordering of the options are changed since the ordering used to construct the checklist has been changed.
5585
5586 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-01-12 17:49](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/9#issuecomment-453767322):
5587
5588 Hello @tyhicks ,
5589
5590 Thank you very much for this pull request! Great!
5591
5592 I briefly looked through the patches and I would like to discuss the approach with you before we proceed.
5593
5594 1. Generally I like the way you introduce SUPPORTED_ARCHS. I also like that the script will have this '-a' argument, it's a good idea. I will look closer to this code.
5595
5596 2. It looks to me that introducing kernel versions will bring more troubles than profit.
5597 In fact all these options have a special version when they appeared in the mainline. Some of them were renamed as well. So if we make the script aware of kernel versions, we will have to add full knowledge about them, but I don't think that it's useful.
5598 IMO it's better to check the config against the recent mainline options and support renamed ones using the OR operator. If the user checks some old config with the script, we will print the errors for hardening options which appeared later, and it is nice. Maybe that will even encourage the user to update the kernel for getting these new hardening features.
5599 What do you think?
5600
5601 May I ask you to extract arch support into a separate pull request? We will work further to merge it.
5602
5603 Thanks again for your time!
5604
5605 #### <img src="https://avatars.githubusercontent.com/u/1051156?u=82b8caad104296ef90ffe2f5807dc34d82c31c2b&v=4" width="50">[tyhicks](https://github.com/tyhicks) commented at [2019-01-12 19:48](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/9#issuecomment-453775979):
5606
5607 > Thank you very much for this pull request! Great!
5608
5609 Glad that you find it useful. I plan to use the script and these changes to audit all of the Ubuntu kernel configs and enable reasonable hardening options that aren't yet enabled.
5610
5611 > It looks to me that introducing kernel versions will bring more troubles than profit.
5612 In fact all these options have a special version when they appeared in the mainline. Some of them were renamed as well. So if we make the script aware of kernel versions, we will have to add full knowledge about them, but I don't think that it's useful.
5613 IMO it's better to check the config against the recent mainline options and support renamed ones using the OR operator. If the user checks some old config with the script, we will print the errors for hardening options which appeared later, and it is nice. Maybe that will even encourage the user to update the kernel for getting these new hardening features.
5614 What do you think?
5615
5616 To be honest, I expected that you'd dislike the kernel version checking. I am on the fence about its usefulness, as well. It currently doesn't add much functionality on top of what `OR()` already provides. My long term thought was to extend minimum version checks to all the options (it really isn't too difficult to do that) so that I could then run the script on old Ubuntu kernel configs, such as the `3.13` kernel in Ubuntu 14.04 LTS, and get clean output that doesn't have a bunch of false negatives for that old kernel.
5617
5618 Maybe I'll just drop the version checking now and, in the future, propose some type of external overrides file that lets me ignore the false negatives when running against a given version of an old kernel. Additionally, this would let me specify overrides for certain options that we simply can't enable in a general purpose distro kernel.
5619
5620 > May I ask you to extract arch support into a separate pull request? We will work further to merge it.
5621
5622 Certainly. It might not happen today but I'll get a new PR up very soon.
5623
5624 #### <img src="https://avatars.githubusercontent.com/u/1051156?u=82b8caad104296ef90ffe2f5807dc34d82c31c2b&v=4" width="50">[tyhicks](https://github.com/tyhicks) commented at [2019-01-12 19:51](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/9#issuecomment-453776169):
5625
5626 @a13xp0p0v I have a slightly unrelated question about the script that I'll ask here since I mentioned using this script with our Ubuntu kernel configs. What does `ubuntu18` mean in the `decision` column of the script output? I assume that you're talking about Ubuntu 18.04 LTS but it feels like `kspp` should be used for nearly all of those rows instead of `ubuntu18` as I consider the KSPP project as the "upstream" that makes these recommendations.
5627
5628 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-01-13 08:03](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/9#issuecomment-453810119):
5629
5630 > Glad that you find it useful. I plan to use the script and these changes to audit all of the Ubuntu kernel configs and enable reasonable hardening options that aren't yet enabled.
5631
5632 Nice. I want this script to serve all your needs out of the box.
5633
5634 > To be honest, I expected that you'd dislike the kernel version checking. I am on the fence about its usefulness, as well. It currently doesn't add much functionality on top of what `OR()` already provides. My long term thought was to extend minimum version checks to all the options (it really isn't too difficult to do that) so that I could then run the script on old Ubuntu kernel configs, such as the `3.13` kernel in Ubuntu 14.04 LTS, and get clean output that doesn't have a bunch of false negatives for that old kernel.
5635
5636 Ok, I see. In other words we need some functionality for categorizing and muting script errors, right?
5637
5638 I face a similar task as well and currently I solve it manually:
5639 1. check some kernel config using the script;
5640 2. copy errors from the report to a separate file and annotate each error. Examples:
5641     - this option doesn't exist in that old kernel version,
5642     - enabling/disabling this option breaks the user requirement (e.g. some users need HIBERNATION),
5643     - enabling/disabling this option breaks some code (e.g. enabling STATIC_USERMODEHELPER breaks systemd workflow on Ubuntu 18),
5644     - this option is not enabled since the feature is controlled via kernel command line param (e.g. CONFIG_LEGACY_VSYSCALL_NONE is not set, but the kernel command line has vsyscall=none),
5645     - and finally some errors are marked with TODO.
5646
5647 > Maybe I'll just drop the version checking now and, in the future, propose some type of external overrides file that lets me ignore the false negatives when running against a given version of an old kernel. Additionally, this would let me specify overrides for certain options that we simply can't enable in a general purpose distro kernel.
5648
5649 Yes, let's create that!
5650
5651 I see two approaches:
5652   - Support the formatted comments in the kernel config. The script will parse them and mute/annotate the errors in its report.
5653   - Support formatted annotations in a separate file. We will run `./kconfig-hardened-check.py -c config -a annotations` and have a pretty report.
5654
5655 What do you think?
5656
5657 > > May I ask you to extract arch support into a separate pull request? We will work further to merge it.
5658
5659 > Certainly. It might not happen today but I'll get a new PR up very soon.
5660
5661 Thank you! Take your time, we are not in a hurry.
5662
5663 > I have a slightly unrelated question about the script that I'll ask here since I mentioned using this script with our Ubuntu kernel configs. What does ubuntu18 mean in the decision column of the script output? I assume that you're talking about Ubuntu 18.04 LTS but it feels like kspp should be used for nearly all of those rows instead of ubuntu18 as I consider the KSPP project as the "upstream" that makes these recommendations.
5664
5665 The `decision` column helps me to maintain the list of recommendations.
5666
5667 The values in `decision` column have this "rank" for me:
5668   1. ubuntu18
5669   2. kspp
5670   3. grsecurity and lockdown
5671   4. my
5672
5673 So I use:
5674   - `ubuntu18` for hardening recommendations already adopted by Ubuntu 18.04 LTS,
5675   - `kspp` for hardening recommendations that are listed in KSPP recommended settings but __not__ adopted by Ubuntu 18.04 LTS,
5676   - `grsecurity` for `cut_attack_surface` recommendations from their patch which are __not__ in KSPP recommended settings list,
5677   - `lockdown` for `cut_attack_surface` functionality from the lockdown patch series which is __not__ mentioned in KSPP recommended settings list,
5678   - `my` for hardening recommendations which I consider reasonable, but others don't mention.
5679
5680 Thanks for your question, I think I should document that in the README.
5681
5682 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2019-01-13 12:31](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/9#issuecomment-453825869):
5683
5684 @a13xp0p0v isn't better to make `kspp` as base for recommendations instead of `ubuntu18`? As @tyhicks mentioned the current order takes it backwards . The alternative would be to use `defconfig` here. I understand that `ubuntu18` is your personal choice but it's highly opinioniated.
5685
5686 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2019-01-14 13:35](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/9#issuecomment-454006535):
5687
5688 @Bernhard40 , thanks for a reasonable comment. I will use `defconfig` as the basis.
5689
5690 #### <img src="https://avatars.githubusercontent.com/u/1051156?u=82b8caad104296ef90ffe2f5807dc34d82c31c2b&v=4" width="50">[tyhicks](https://github.com/tyhicks) commented at [2019-01-14 19:38](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/9#issuecomment-454133942):
5691
5692 Closing this pull request in favor of #10
5693
5694
5695 -------------------------------------------------------------------------------
5696
5697 # [\#8 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/8) `closed`: couldn't mount to /sysroot after compile kernel with KSPP options.
5698
5699 #### <img src="https://avatars.githubusercontent.com/u/3471772?v=4" width="50">[bryn1u](https://github.com/bryn1u) opened issue at [2018-12-17 15:33](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/8):
5700
5701 Hello Alexander,
5702
5703 After kernel compilation im getting issue "unknow filesystem type ext4", "Failed to mount /sysroot"
5704 I was wondering which KSSP feature could be responsible for it ? I was trying many times and always getting the same issue as i mentioned. Sceenshot 
5705 https://www.centos.org/forums/download/file.php?id=2571
5706 It looks like my initramfs doesn't have the kernel module for ext4 but why.
5707
5708 Im using Centos 7 with gcc 7.2
5709
5710 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-12-18 11:55](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/8#issuecomment-448195919):
5711
5712 Hello @bryn1u ,
5713
5714 I don't know the reason of such behavior on Centos.
5715 Distros can have various issues because of the kernel hardening options, for example systemd on Ubuntu-18 has troubles with kernel modules unloading because of CONFIG_STATIC_USERMODEHELPER.
5716
5717 It would be great if you find the reason and share the result.
5718 I would recommend you to use binary search to do it faster.
5719
5720 #### <img src="https://avatars.githubusercontent.com/u/3471772?v=4" width="50">[bryn1u](https://github.com/bryn1u) commented at [2018-12-18 22:12](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/8#issuecomment-448390343):
5721
5722 Hey,
5723
5724 I checked many options and recompiled kernel many times to find some answers, but it looks like everything works like a charm. I was doing everything based on Centos 7 with devtoolset-7 enabled to get never version of gcc like 7.2.  With CONFIG_SECURITY_LOADPIN  enabled im not able to load any module and getting "operation not permitted". Im guessing it's supposed to be like that. 
5725 @a13xp0p0v 
5726 Don't you know if ubuntu developers will enable KSPP options to the ubuntu kernel ? Or only manual compilation is available to get more security features ?
5727 Thanks !
5728
5729 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-12-19 11:57](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/8#issuecomment-448569306):
5730
5731 > With CONFIG_SECURITY_LOADPIN enabled im not able to load any module and getting "operation not permitted". Im guessing it's supposed to be like that.
5732
5733 Thanks for information!
5734
5735 That's the description of CONFIG_SECURITY_LOADPIN:
5736 `Any files read through the kernel file reading interface (kernel modules, firmware, kexec images, security policy) can be pinned to the first filesystem used for loading. When enabled, any files that come from other filesystems will be rejected.`
5737
5738 I guess in your case the first modules are loaded from the ramdisk, and later loading from root filesystem fails.
5739
5740 >Don't you know if ubuntu developers will enable KSPP options to the ubuntu kernel ? Or only manual compilation is available to get more security features ?
5741
5742 It's slow but steady process. More and more kernel hardening options are enabled by distros.
5743
5744 #### <img src="https://avatars.githubusercontent.com/u/3471772?v=4" width="50">[bryn1u](https://github.com/bryn1u) commented at [2018-12-22 12:38](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/8#issuecomment-449567219):
5745
5746 Hello
5747 I have a weir problem. After successfully compiled kernel i can't use iptables:
5748
5749
5750 > [root@localhost ~]# iptables -L
5751 > iptables v1.4.21: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
5752 > Perhaps iptables or your kernel needs to be upgraded.
5753
5754 What am i doing wrong ?
5755
5756 Kernel KSSP options:
5757
5758 ```
5759 option name                            | desired val | decision |       reason       ||        check result        
5760   ===================================================================================================================
5761   CONFIG_BUG                             |      y      | ubuntu18 |  self_protection   ||             OK             
5762   CONFIG_PAGE_TABLE_ISOLATION            |      y      | ubuntu18 |  self_protection   ||             OK             
5763   CONFIG_RETPOLINE                       |      y      | ubuntu18 |  self_protection   ||             OK             
5764   CONFIG_X86_64                          |      y      | ubuntu18 |  self_protection   ||             OK             
5765   CONFIG_X86_SMAP                        |      y      | ubuntu18 |  self_protection   ||             OK             
5766   CONFIG_X86_INTEL_UMIP                  |      y      | ubuntu18 |  self_protection   ||             OK             
5767   CONFIG_STRICT_KERNEL_RWX               |      y      | ubuntu18 |  self_protection   ||             OK             
5768   CONFIG_DEBUG_WX                        |      y      | ubuntu18 |  self_protection   ||             OK             
5769   CONFIG_RANDOMIZE_BASE                  |      y      | ubuntu18 |  self_protection   ||             OK             
5770   CONFIG_RANDOMIZE_MEMORY                |      y      | ubuntu18 |  self_protection   ||             OK             
5771   CONFIG_STACKPROTECTOR_STRONG           |      y      | ubuntu18 |  self_protection   ||             OK             
5772   CONFIG_VMAP_STACK                      |      y      | ubuntu18 |  self_protection   ||             OK             
5773   CONFIG_THREAD_INFO_IN_TASK             |      y      | ubuntu18 |  self_protection   ||             OK             
5774   CONFIG_SCHED_STACK_END_CHECK           |      y      | ubuntu18 |  self_protection   ||             OK             
5775   CONFIG_SLUB_DEBUG                      |      y      | ubuntu18 |  self_protection   ||             OK             
5776   CONFIG_SLAB_FREELIST_HARDENED          |      y      | ubuntu18 |  self_protection   ||             OK             
5777   CONFIG_SLAB_FREELIST_RANDOM            |      y      | ubuntu18 |  self_protection   ||             OK             
5778   CONFIG_HARDENED_USERCOPY               |      y      | ubuntu18 |  self_protection   ||             OK             
5779   CONFIG_FORTIFY_SOURCE                  |      y      | ubuntu18 |  self_protection   ||             OK             
5780   CONFIG_LOCK_DOWN_KERNEL                |      y      | ubuntu18 |  self_protection   ||      FAIL: not found       
5781   CONFIG_STRICT_MODULE_RWX               |      y      | ubuntu18 |  self_protection   ||             OK             
5782   CONFIG_MODULE_SIG                      |      y      | ubuntu18 |  self_protection   ||             OK             
5783   CONFIG_MODULE_SIG_ALL                  |      y      | ubuntu18 |  self_protection   ||             OK             
5784   CONFIG_MODULE_SIG_SHA512               |      y      | ubuntu18 |  self_protection   ||     FAIL: "is not set"     
5785   CONFIG_SYN_COOKIES                     |      y      | ubuntu18 |  self_protection   ||             OK             
5786   CONFIG_DEFAULT_MMAP_MIN_ADDR           |    65536    | ubuntu18 |  self_protection   ||             OK             
5787   CONFIG_BUG_ON_DATA_CORRUPTION          |      y      |   kspp   |  self_protection   ||             OK             
5788   CONFIG_PAGE_POISONING                  |      y      |   kspp   |  self_protection   ||             OK             
5789   CONFIG_GCC_PLUGINS                     |      y      |   kspp   |  self_protection   ||             OK             
5790   CONFIG_GCC_PLUGIN_RANDSTRUCT           |      y      |   kspp   |  self_protection   ||             OK             
5791   CONFIG_GCC_PLUGIN_STRUCTLEAK           |      y      |   kspp   |  self_protection   ||             OK             
5792   CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL |      y      |   kspp   |  self_protection   ||             OK             
5793   CONFIG_GCC_PLUGIN_LATENT_ENTROPY       |      y      |   kspp   |  self_protection   ||             OK             
5794   CONFIG_REFCOUNT_FULL                   |      y      |   kspp   |  self_protection   ||             OK             
5795   CONFIG_DEBUG_LIST                      |      y      |   kspp   |  self_protection   ||             OK             
5796   CONFIG_DEBUG_SG                        |      y      |   kspp   |  self_protection   ||             OK             
5797   CONFIG_DEBUG_CREDENTIALS               |      y      |   kspp   |  self_protection   ||             OK             
5798   CONFIG_DEBUG_NOTIFIERS                 |      y      |   kspp   |  self_protection   ||             OK             
5799   CONFIG_MODULE_SIG_FORCE                |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"     
5800   CONFIG_HARDENED_USERCOPY_FALLBACK      | is not set  |   kspp   |  self_protection   ||         FAIL: "y"          
5801   CONFIG_GCC_PLUGIN_STACKLEAK            |      y      |    my    |  self_protection   ||      FAIL: not found       
5802   CONFIG_SLUB_DEBUG_ON                   |      y      |    my    |  self_protection   ||             OK             
5803   CONFIG_SECURITY_DMESG_RESTRICT         |      y      |    my    |  self_protection   ||             OK             
5804   CONFIG_STATIC_USERMODEHELPER           |      y      |    my    |  self_protection   ||             OK             
5805   CONFIG_SECURITY_LOADPIN                |      y      |    my    |  self_protection   ||     FAIL: "is not set"     
5806   CONFIG_PAGE_POISONING_NO_SANITY        | is not set  |    my    |  self_protection   ||             OK             
5807   CONFIG_PAGE_POISONING_ZERO             | is not set  |    my    |  self_protection   ||             OK             
5808   CONFIG_SLAB_MERGE_DEFAULT              | is not set  |    my    |  self_protection   ||             OK             
5809   CONFIG_SECURITY                        |      y      | ubuntu18 |  security_policy   ||             OK             
5810   CONFIG_SECURITY_YAMA                   |      y      | ubuntu18 |  security_policy   ||             OK             
5811   CONFIG_SECURITY_SELINUX_DISABLE        | is not set  | ubuntu18 |  security_policy   ||             OK             
5812   CONFIG_SECCOMP                         |      y      | ubuntu18 | cut_attack_surface ||             OK             
5813   CONFIG_SECCOMP_FILTER                  |      y      | ubuntu18 | cut_attack_surface ||             OK             
5814   CONFIG_STRICT_DEVMEM                   |      y      | ubuntu18 | cut_attack_surface ||             OK             
5815   CONFIG_ACPI_CUSTOM_METHOD              | is not set  | ubuntu18 | cut_attack_surface ||         FAIL: "m"          
5816   CONFIG_COMPAT_BRK                      | is not set  | ubuntu18 | cut_attack_surface ||             OK             
5817   CONFIG_DEVKMEM                         | is not set  | ubuntu18 | cut_attack_surface ||             OK             
5818   CONFIG_COMPAT_VDSO                     | is not set  | ubuntu18 | cut_attack_surface ||       OK: not found        
5819   CONFIG_X86_PTDUMP                      | is not set  | ubuntu18 | cut_attack_surface ||             OK             
5820   CONFIG_ZSMALLOC_STAT                   | is not set  | ubuntu18 | cut_attack_surface ||             OK             
5821   CONFIG_PAGE_OWNER                      | is not set  | ubuntu18 | cut_attack_surface ||             OK             
5822   CONFIG_DEBUG_KMEMLEAK                  | is not set  | ubuntu18 | cut_attack_surface ||             OK             
5823   CONFIG_BINFMT_AOUT                     | is not set  | ubuntu18 | cut_attack_surface ||       OK: not found        
5824   CONFIG_MMIOTRACE_TEST                  | is not set  | ubuntu18 | cut_attack_surface ||       OK: not found        
5825   CONFIG_IO_STRICT_DEVMEM                |      y      |   kspp   | cut_attack_surface ||             OK             
5826   CONFIG_LEGACY_VSYSCALL_NONE            |      y      |   kspp   | cut_attack_surface ||             OK             
5827   CONFIG_BINFMT_MISC                     | is not set  |   kspp   | cut_attack_surface ||         FAIL: "m"          
5828   CONFIG_INET_DIAG                       | is not set  |   kspp   | cut_attack_surface ||         FAIL: "m"          
5829   CONFIG_KEXEC                           | is not set  |   kspp   | cut_attack_surface ||             OK             
5830   CONFIG_PROC_KCORE                      | is not set  |   kspp   | cut_attack_surface ||             OK             
5831   CONFIG_LEGACY_PTYS                     | is not set  |   kspp   | cut_attack_surface ||             OK             
5832   CONFIG_IA32_EMULATION                  | is not set  |   kspp   | cut_attack_surface ||             OK             
5833   CONFIG_X86_X32                         | is not set  |   kspp   | cut_attack_surface ||             OK             
5834   CONFIG_MODIFY_LDT_SYSCALL              | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
5835   CONFIG_HIBERNATION                     | is not set  |   kspp   | cut_attack_surface ||             OK             
5836   CONFIG_KPROBES                         | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
5837   CONFIG_UPROBES                         | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
5838   CONFIG_GENERIC_TRACER                  | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
5839   CONFIG_PROC_VMCORE                     | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
5840   CONFIG_PROC_PAGE_MONITOR               | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
5841   CONFIG_USELIB                          | is not set  |grsecurity| cut_attack_surface ||             OK             
5842   CONFIG_CHECKPOINT_RESTORE              | is not set  |grsecurity| cut_attack_surface ||             OK             
5843   CONFIG_USERFAULTFD                     | is not set  |grsecurity| cut_attack_surface ||             OK             
5844   CONFIG_HWPOISON_INJECT                 | is not set  |grsecurity| cut_attack_surface ||             OK             
5845   CONFIG_MEM_SOFT_DIRTY                  | is not set  |grsecurity| cut_attack_surface ||       OK: not found        
5846   CONFIG_DEVPORT                         | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
5847   CONFIG_DEBUG_FS                        | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
5848   CONFIG_NOTIFIER_ERROR_INJECTION        | is not set  |grsecurity| cut_attack_surface ||             OK             
5849   CONFIG_ACPI_TABLE_UPGRADE              | is not set  | lockdown | cut_attack_surface ||         FAIL: "y"          
5850   CONFIG_ACPI_APEI_EINJ                  | is not set  | lockdown | cut_attack_surface ||         FAIL: "m"          
5851   CONFIG_PROFILING                       | is not set  | lockdown | cut_attack_surface ||         FAIL: "y"          
5852   CONFIG_BPF_SYSCALL                     | is not set  | lockdown | cut_attack_surface ||         FAIL: "y"          
5853   CONFIG_MMIOTRACE                       | is not set  |    my    | cut_attack_surface ||             OK             
5854   CONFIG_KEXEC_FILE                      | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
5855   CONFIG_LIVEPATCH                       | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
5856   CONFIG_USER_NS                         | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
5857   CONFIG_IP_DCCP                         | is not set  |    my    | cut_attack_surface ||         FAIL: "m"          
5858   CONFIG_IP_SCTP                         | is not set  |    my    | cut_attack_surface ||         FAIL: "m"          
5859   CONFIG_FTRACE                          | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
5860   CONFIG_BPF_JIT                         | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
5861   CONFIG_ARCH_MMAP_RND_BITS              |     32      |    my    |userspace_protection||         FAIL: "28"         
5862
5863 [-] config check is NOT PASSED: 29 errors
5864
5865 ```
5866
5867 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-12-25 12:27](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/8#issuecomment-449846419):
5868
5869 Hello @bryn1u ,
5870 The error message which you posted makes me think that your issue is about kernel modules loading.
5871 I would recommend you to look at the kernel log for more information and bisect again to find the reason.
5872
5873
5874 -------------------------------------------------------------------------------
5875
5876 # [\#7 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/7) `closed`: Removing security features during kernel compilation.
5877
5878 #### <img src="https://avatars.githubusercontent.com/u/3471772?v=4" width="50">[bryn1u](https://github.com/bryn1u) opened issue at [2018-12-05 13:21](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/7):
5879
5880 Hey,
5881
5882 Im trying do my best with security options based on your script. I have a litte problems with few options. 
5883
5884 When im adding these options:
5885 ```
5886 # Enable GCC Plugins
5887 CONFIG_GCC_PLUGINS=y
5888
5889 # Gather additional entropy at boot time for systems that may not have appropriate entropy sources.
5890 CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y
5891
5892 # Force all structures to be initialized before they are passed to other functions.
5893 CONFIG_GCC_PLUGIN_STRUCTLEAK=y
5894 CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y
5895
5896 # Randomize the layout of system structures. This may have dramatic performance impact, so
5897 # use with caution or also use CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE=y
5898 CONFIG_GCC_PLUGIN_RANDSTRUCT=y
5899 ```
5900 And make a "make -j 8 deb-pkg" on ubuntu or "make -j8 bzImage ...." on centos, these options are removing immediately from ".config" in kernel-4.19.6 . I have no idea what's going on. Could you tell me what am i doing wrong ?
5901
5902 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-12-05 21:08](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/7#issuecomment-444648549):
5903
5904 Hello @bryn1u ,
5905
5906 Kconfig disables these options automatically because your gcc doesn't support plugins.
5907 If you have gcc-7 on Ubuntu, try to install gcc-7-plugin-dev package. It should help.
5908
5909 And thanks for your question. I'll add this information to README.
5910
5911 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-12-05 21:31](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/7#issuecomment-444656696):
5912
5913 Added 478e5f266df05b5f75badef59914c8b0e71e3e0e
5914
5915 #### <img src="https://avatars.githubusercontent.com/u/3471772?v=4" width="50">[bryn1u](https://github.com/bryn1u) commented at [2018-12-06 21:08](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/7#issuecomment-445030219):
5916
5917 Hello,
5918
5919 Now it works :) thanks ! I have one question about CONFIG_GCC_PLUGIN_STACKLEAK . This is the one option which is removing during compilation. Is it any way to enable it or isn't it available in kernel-4.19.7 yet ?
5920 Thanks again :)
5921
5922 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-12-07 06:59](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/7#issuecomment-445141837):
5923
5924 Yes, CONFIG_GCC_PLUGIN_STACKLEAK will be available in Linux 4.20.
5925
5926
5927 -------------------------------------------------------------------------------
5928
5929 # [\#6 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/6) `closed`: Removed long lines on output + minor fix
5930
5931 #### <img src="https://avatars.githubusercontent.com/u/7037785?u=6ac77234884c153e7fd38e3732be16d9760509ea&v=4" width="50">[c0rv4x](https://github.com/c0rv4x) opened issue at [2018-07-30 14:38](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/6):
5932
5933 I removed long lines from `print` and `format` functions.
5934 Also i edited function `get_option_state` now uses `dict.get` method to extract a key from dict with default value 
5935
5936 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-07-30 20:09](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/6#issuecomment-408993713):
5937
5938 Applied!
5939 Thank you @iad42 !
5940
5941
5942 -------------------------------------------------------------------------------
5943
5944 # [\#5 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/5) `closed`: Oop refactoring
5945
5946 #### <img src="https://avatars.githubusercontent.com/u/7037785?u=6ac77234884c153e7fd38e3732be16d9760509ea&v=4" width="50">[c0rv4x](https://github.com/c0rv4x) opened issue at [2018-07-28 21:49](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/5):
5947
5948 Made the program a liitle bit more OOP.
5949
5950 I created a UserConfig class to store the state of the user's config.
5951 Outputter class is responsible for outputting major results (however, not all the prints are there)
5952 OR and OptConifg were moved to a separate file
5953 Checklist got its own class with a method `check(config)` that performs all the checks from the checklist against user's config
5954
5955 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2018-07-30 09:43](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/5#issuecomment-408807705):
5956
5957 The last commit adds a ```__pycache__``` directory with bython bytecode cache files, that commit should be amended
5958
5959 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2018-07-30 09:50](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/5#issuecomment-408809392):
5960
5961 Cool that you invest time with this, but personally speaking I'm bit mixed here what the justification/gain is to introduce the complexity and split other then "but oop and modules". Right now it's quite handy to just have the whole thing in a single file that could be copied to /usr/bin dir f.e. and I don't think its expected that lots lots lots of additional modules and python functions are needed beyond this.
5962
5963 Otherwise, if the project goes the path to make it more modular, then it should at least also have setup.py dist file (you may want to add one) so it can actually be distributed and used properly as a module and by distros for packaging python.
5964
5965 My 2 cents is that a single file isn't too bad after considering the current scope and content
5966
5967 #### <img src="https://avatars.githubusercontent.com/u/7037785?u=6ac77234884c153e7fd38e3732be16d9760509ea&v=4" width="50">[c0rv4x](https://github.com/c0rv4x) commented at [2018-07-30 10:36](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/5#issuecomment-408821023):
5968
5969 You are right about `__pycache__`, that is my fault.
5970
5971 As for sticking to a single file, i clearly see your point and agree with you. However, OOP style is obviously easier to extend and easier to read. As long as the author (a13xp0p0v) is expecting the tool to grow, i consider that we should stick to an easier form of code in terms of adding code rather that terms of easy-to-run. 
5972
5973 Also, thanks for the note on setup.py file, i will surely fix that problem!
5974
5975 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-07-30 10:42](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/5#issuecomment-408822137):
5976
5977 Hello @iad42 and @anthraxx ,
5978
5979 Yes, Anatoly, thanks for your time! Your PR made me review the script and gave some new ideas.
5980 I see now what we can improve:
5981  1. currently parsing config file, filling 'OptCheck.state' values in 'checklist' and performing actual checks all mixed in check_config_file(). It would be nice to split them. What approaches do you see?
5982  2. there are two global vars now: 'checklist' and 'debug_mode'. I see that some of design drawbacks are connected with that fact. It would be cool to get rid of them during the refactoring.
5983  3. the script is quite small now, I like that all the functionality stays in a single file.
5984  4. @iad42 , I like how you cut the long lines in printing the output. I want to merge it. Can you put the final ')' on the second line, like that:
5985 ```
5986 print('  CONFIG_{:<32}|{:^13}|{:^10}|{:^20}||{:^28}'.format(
5987             opt.name, opt.expected, opt.decision, opt.reason, opt.result))
5988 ```
5989
5990 Thanks!
5991
5992 #### <img src="https://avatars.githubusercontent.com/u/7037785?u=6ac77234884c153e7fd38e3732be16d9760509ea&v=4" width="50">[c0rv4x](https://github.com/c0rv4x) commented at [2018-07-30 14:39](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/5#issuecomment-408886952):
5993
5994 @a13xp0p0v 
5995
5996 I created a separate pull request https://github.com/a13xp0p0v/kconfig-hardened-check/pull/6 for the 4th bullet point on your list. Also i added a tiny fix for working with dict
5997
5998
5999 -------------------------------------------------------------------------------
6000
6001 # [\#4 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/4) `closed`: Add more config files
6002
6003 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) opened issue at [2018-07-20 20:31](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/4):
6004
6005 Hello @a13xp0p0v,
6006
6007 Just like I promised.
6008
6009 Best regards.
6010
6011 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2018-07-23 19:03](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/4#issuecomment-407166514):
6012
6013 Don't we overdo with the number of configs here? This project allows everyone for checking any config they want themselves so what is the point of storing them here? One or two as example is enough. Most of them will be outdated sooner or later anyway.
6014
6015 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2018-07-23 19:18](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/4#issuecomment-407170808):
6016
6017 Yeah I agree, also they are outdated quite fast and who maintains the configs?
6018 To compare and test stuff, it would make sense to have a small amount of general purpose configs like ubuntu, debian and have some hardened examples like kspp, archlinux-hardened and others. I don't think it is or should be the scope of the project to collect them all
6019
6020 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2018-07-24 12:11](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/4#issuecomment-407384626):
6021
6022 Hello,
6023
6024 Allow me first of all to take stock of the results:
6025
6026 **pentoo-hardened-2018.0rc7.config** = **30 errors** (config of iso image)
6027 **Archlinux-hardened.config** = 33 errors (config available via **gitweb**)
6028 Qubes-latest.config = 38 errors (config of linux package)
6029 **Alpinelinux-edge.config** = 44 errors (config available via **gitweb**)
6030 Fedora-Rawhide.config = 48 errors (config of linux package)
6031 **Archlinux-Testing.config** = 49 errors (config available via **gitweb**)
6032 debian-sid-amd64.config = 49 errors (config of linux package)
6033 Kali-linux.config = 49 errors (config of linux package)
6034 Owl-3.1config = 50 errors (config of linux package)
6035 Parrot-security-4.1.config = 52 errors (config of linux package)
6036 ubuntu-bionic-generic.config = 52 errors (config of linux package)
6037 **oracle-uek5.config** = 54 errors (config available via **gitweb**)
6038 Mageia-cauldron.config = 57 errors (config of linux package)
6039 **SLE15.config** = 58 errors (config available via **gitweb**)
6040 **Opensuse-git.config** = 62 errors (config available via **gitweb**)
6041 Trisquel-Flidas.config = 63 errors (config of linux package)
6042
6043 All config available via **gitweb** are easy to maintain with a bash script.
6044 Then for some I didn't use the stable branch but the development branch to have an up-to-date config.
6045
6046 So I lets @a13xp0p0v choose what he prefers.
6047
6048 But I wish in any case to maintain pentoo-hardened in view of its result :smiley:
6049
6050 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-07-24 23:06](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/4#issuecomment-407580227):
6051
6052 Hello @HacKurx @anthraxx @Bernhard40 ,
6053
6054 Yes, we don't have a goal to collect all the configs and update them.
6055 At the same time I appreciate @HacKurx efforts.
6056
6057 So what do you think about this solution:
6058 1. drop the configs of minor distributions (Owl-3.1config, Kali-linux.config, Parrot-security-4.1.config, Mageia-cauldron.config, Trisquel-Flidas.config);
6059 2. add the concrete release/version to the config file names ("sid" and "rawhide" are bad version names since they just mean "unstable", right?);
6060 3. add a links.txt with the available links to the configs.
6061
6062 Does it sound reasonable to you?
6063
6064 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2018-07-25 11:41](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/4#issuecomment-407725269):
6065
6066 Yeah, keeping well know distros and non-rolling release kernels make sense.
6067
6068 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2018-07-25 19:28](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/4#issuecomment-407868315):
6069
6070 Hello @a13xp0p0v ,
6071
6072 > Does it sound reasonable to you?
6073
6074 Yeah, okay, I'll take care of it.
6075
6076 @Bernhard40 
6077
6078 > Yeah, keeping well know distros and non-rolling release kernels make sense.
6079
6080 I know, but for old kernels we need use more OR class. Example: CONFIG_DEBUG_SET_MODULE_RONX, CONFIG_DEBUG_KERNEL, CONFIG_DEBUG_RODATA.
6081
6082 In addition certain points must be corrected, as for example the recommendation "CONFIG_LKDTM" is impossible to respect without breaking the recommendation of Grsecurity on DEBUG_FS.
6083
6084 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-07-27 21:29](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/4#issuecomment-408543338):
6085
6086 Hello @HacKurx , thanks for your work.
6087
6088 1. I've commented out the LKDTM rule. You are right about it.
6089
6090 2. I'll check what we can do about CONFIG_DEBUG_SET_MODULE_RONX, CONFIG_DEBUG_KERNEL, CONFIG_DEBUG_RODATA. 
6091
6092 3. I've merged some of your commits, so now 'config' directory has: 
6093  -  Alpinelinux-edge.config (I want to keep it)
6094  -  Archlinux-hardened.config (ditto)
6095  -  debian-stretch.config
6096  -  oracle-uek5.config
6097  -  SLE15.config
6098  -  ubuntu-bionic-generic.config
6099
6100 May I ask you to do a bit more work to make it excellent?
6101  - could you check the links for Alpine Linux in your links.txt? They both give similar result.
6102  - could you find links for debian-stretch and ubuntu-bionic configs?
6103  - could you add configs for some stable versions of Pentoo Hardened and openSUSE?
6104 If so, in the result we will have some consistence between links.txt and config files.
6105
6106 Thank you a lot!
6107
6108 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2018-07-28 06:57](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/4#issuecomment-408587814):
6109
6110 Hello @a13xp0p0v ,
6111
6112 > could you check the links for Alpine Linux in your links.txt? They both give similar result.
6113
6114 Because the edge version currently uses the same kernel as the stable 3.8 version.
6115
6116 > could you find links for debian-stretch and ubuntu-bionic configs?
6117
6118 Not sure, but I'll look.
6119
6120 > could you add configs for some stable versions of Pentoo Hardened and openSUSE?
6121
6122 Yes of course the links are in the file.
6123
6124 I'll take care of it soon.
6125 Thank you too. Best regards.
6126
6127 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2018-08-01 21:45](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/4#issuecomment-409734659):
6128
6129 Hello @a13xp0p0v ,
6130
6131 > I'll check what we can do about CONFIG_DEBUG_SET_MODULE_RONX, CONFIG_DEBUG_KERNEL, CONFIG_DEBUG_RODATA.
6132
6133 Thank you, I just saw your changes regarding that. If you want to be thorough then you should also do the same for :
6134 ```
6135 PAGE_TABLE_ISOLATION             = PAX_PER_CPU_PGD, MEMORY_UDEREF_MELTDOWN
6136 RANDOMIZE_BASE, RANDOMIZE_MEMORY = PAX_ASLR
6137 HARDENED_USERCOPY                = PAX_USERCOPY
6138 GCC_PLUGIN_RANDSTRUCT            = GRKERNSEC_RANDSTRUCT
6139 GCC_PLUGIN_STRUCTLEAK            = PAX_MEMORY_STRUCTLEAK
6140 GCC_PLUGIN_STRUCTLEAK_BYREF_ALL  = PAX_MEMORY_STRUCTLEAK ?
6141 GCC_PLUGIN_LATENT_ENTROPY        = PAX_LATENT_ENTROPY
6142 REFCOUNT_FULL                    = PAX_REFCOUNT
6143 GCC_PLUGIN_STACKLEAK             = PAX_MEMORY_STACKLEAK
6144 SECURITY_YAMA                    = GRKERNSEC
6145 ```
6146
6147 It's be a good friendly gesture.
6148
6149 I'm still looking for some points and I'm quite busy but I always take care of them.
6150
6151 Regards.
6152
6153 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-08-03 20:52](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/4#issuecomment-410373163):
6154
6155 Hi @HacKurx ,
6156
6157 > PAGE_TABLE_ISOLATION             = PAX_PER_CPU_PGD, MEMORY_UDEREF_MELTDOWN
6158
6159 Umm... Where can I learn more about these options?
6160
6161 > RANDOMIZE_BASE, RANDOMIZE_MEMORY = PAX_ASLR
6162
6163 No, I'm absolutely sure that KASLR != PAX_ASLR.
6164
6165 > HARDENED_USERCOPY                = PAX_USERCOPY
6166 > GCC_PLUGIN_RANDSTRUCT            = GRKERNSEC_RANDSTRUCT
6167 > GCC_PLUGIN_STRUCTLEAK            = PAX_MEMORY_STRUCTLEAK
6168 > GCC_PLUGIN_STRUCTLEAK_BYREF_ALL  = PAX_MEMORY_STRUCTLEAK ?
6169 > GCC_PLUGIN_LATENT_ENTROPY        = PAX_LATENT_ENTROPY
6170 > REFCOUNT_FULL                    = PAX_REFCOUNT
6171 > GCC_PLUGIN_STACKLEAK             = PAX_MEMORY_STACKLEAK
6172
6173 Have you seen my Linux Kernel Defence Map?
6174 https://github.com/a13xp0p0v/linux-kernel-defence-map
6175 Please have a look, I've displayed the origins of these features (and praised grsecurity) in that map.
6176
6177 > SECURITY_YAMA                    = GRKERNSEC
6178
6179 Excuse me, I don't see the connection between these options. Can you share more details?
6180
6181 Thank you!
6182
6183 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2018-08-04 14:56](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/4#issuecomment-410455183):
6184
6185 Hi @a13xp0p0v ,
6186
6187 > Umm... Where can I learn more about these options?
6188
6189 ```
6190  config PAGE_TABLE_ISOLATION
6191         bool "Remove the kernel mapping in user mode"
6192         default y
6193 -       depends on X86_64 && SMP
6194 +       depends on X86_64 && SMP && !PAX_PER_CPU_PGD && BROKEN
6195         help
6196           This enforces a strict kernel and user space isolation, in order
6197           to close hardware side channels on kernel address information.
6198 ```
6199
6200 and 
6201
6202 ```
6203 +config PAX_MEMORY_UDEREF_MELTDOWN
6204 +       bool "Prevent i386 Meltdown attacks (READ HELP!)"
6205 +       default n
6206 +       depends on X86_32 && PAX_MEMORY_UDEREF
6207 +       help
6208 +         By saying Y here, UDEREF will be enhanced to fully close off
6209 +         Meltdown attacks against the kernel.  This will prevent the
6210 +         creation of expand-down segments and will limit all TLS segments
6211 +         to the end of the userland address space.
6212 ...
6213 ```
6214 If you want to know more, you just have to convince a large company (google? microsoft ^^) to finance their research in a public way :innocent:
6215
6216 > No, I'm absolutely sure that KASLR != PAX_ASLR.
6217
6218 Oops I confused PAX_RANDUSTACK(depends on PAX_ASLR) and PAX_RANDKSTACK.
6219
6220 > Excuse me, I don't see the connection between these options. Can you share more details?
6221
6222 ```
6223  config SECURITY_YAMA
6224         bool "Yama support"
6225 -       depends on SECURITY
6226 +       depends on SECURITY && !GRKERNSEC
6227         default n
6228 ```
6229
6230 Because not compatible.
6231
6232 > Have you seen my Linux Kernel Defence Map?
6233
6234 Great ! I'll look into it.
6235
6236 For the rest I couldn't find a link for the complete debian and ubuntu configurations. The reason is that the files are generated automatically:
6237 https://salsa.debian.org/kernel-team/linux/tree/master/debian/config
6238 https://salsa.debian.org/kernel-team/linux/raw/master/debian/config/amd64/config
6239
6240 What about CRYPTO_SPECK, what do you think?
6241
6242 Thanks you to again.
6243
6244 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2018-08-04 16:14](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/4#issuecomment-410460070):
6245
6246 > If you want to know more, you just have to convince a large company (google? microsoft ^^) to finance their research in a public way 😇
6247
6248 So, until that happens there is no point for adding support for options which almost no one can use.
6249
6250 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2018-08-04 17:30](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/4#issuecomment-410465146):
6251
6252 >  So, until that happens there is no point for adding support for options which almost no one can use.
6253
6254 So you want to create a false error to the persons who uses it?
6255 KSPP's advances come from grsecurity don't forget it.
6256 Besides the old versions are still a source of inspiration, right?
6257
6258 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2018-08-04 17:53](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/4#issuecomment-410466573):
6259
6260 If someone uses grsecurity private code then they should seek support from grsecurity which they pay for, not from volunteers working for free.
6261
6262 Old versions are dead, nothing we can do about it.
6263
6264 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-08-04 20:51](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/4#issuecomment-410476855):
6265
6266 Hello @HacKurx and @Bernhard40 ,
6267
6268 Please don't start another holy war about grsecurity.
6269 - Yes, Brad and PaX Team are genius.
6270 - Yes, a lot of KSPP work is inspired by (and sometimes copied from) grsecurity. The map shows that fact explicitly.
6271 - Yes, almost all the mainline kernel self protection features are not compatible with grsecurity (and even marked as BROKEN).
6272
6273 @HacKurx , it's great that you have access to the recent grsecurity patches, lucky you. 
6274 I don't have it, and I guess they will never give it to me.
6275 So I would like to focus on the mainline kconfig options. Moreover, grsecurity users really don't need this funny script at all.
6276
6277 Thanks for understanding.
6278
6279 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-08-08 12:36](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/4#issuecomment-411389774):
6280
6281 Hello @HacKurx ,
6282
6283 I've merged the rest of your PR with some fixes I previously mentioned.
6284 Thank you very much.
6285
6286 Closing it now.
6287
6288 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2018-08-08 21:57](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/4#issuecomment-411565682):
6289
6290 Hello @a13xp0p0v ,
6291
6292 > it's great that you have access to the recent grsecurity patches
6293
6294 Well, not really. It's complicated... Let's just say that I have elements that you don't have and that out of respect I didn't publish them. Spender and Pipacs have always answered my questions which is not the case with Linus for example (at the terrorist attack in my country I asked him to rename the version name to "Pray for Paris") but he didn't even take the time to answer...
6295
6296 > So I would like to focus on the mainline kconfig options.
6297
6298 Ok no problem. Rest assured I am not here for divide. I do not forget that if we discuss together it is above all because we appreciate at security in linux ;)
6299
6300 > I've merged the rest of your PR with some fixes I previously mentioned.
6301
6302 Great, thank you. I haven't found much interesting since.
6303
6304 Best regards.
6305
6306
6307 -------------------------------------------------------------------------------
6308
6309 # [\#3 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/3) `closed`: Add Grsecurity recommendation on BINFMT_AOUT
6310
6311 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) opened issue at [2018-07-18 18:52](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/3):
6312
6313 Hi,
6314
6315 Recommendation starting from grsecurity-2.2.0-2.6.32.22-201009241805.patch.
6316 Sorry, Linux historical interest is not secure ;)
6317
6318 Sorry for the tabulations in my code :D
6319
6320 Regards,
6321
6322 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2018-07-18 19:14](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/3#issuecomment-406043222):
6323
6324 I'm curious, does anyone seen kernel with that option enabled in last 10 years?
6325
6326 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2018-07-18 19:49](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/3#issuecomment-406052730):
6327
6328 Today his is not the case but it is necessary to warn users better about the old code that is dangerous and that Linus will never want to delete.
6329
6330 Because otherwise I'm sure he's got geeks who'll activate him for fun...
6331
6332 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2018-07-18 20:13](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/3#issuecomment-406059551):
6333
6334 @Bernhard40 to be precise (extraction from linux-4.18-rc5) shows that it's still using a little. The equipment on ARM being more recent.
6335
6336 m68k/configs/mvme147_defconfig:CONFIG_BINFMT_AOUT=m
6337 m68k/configs/apollo_defconfig:CONFIG_BINFMT_AOUT=m
6338 m68k/configs/multi_defconfig:CONFIG_BINFMT_AOUT=m
6339 m68k/configs/amiga_defconfig:CONFIG_BINFMT_AOUT=m
6340 m68k/configs/bvme6000_defconfig:CONFIG_BINFMT_AOUT=m
6341 m68k/configs/hp300_defconfig:CONFIG_BINFMT_AOUT=m
6342 m68k/configs/atari_defconfig:CONFIG_BINFMT_AOUT=m
6343 m68k/configs/q40_defconfig:CONFIG_BINFMT_AOUT=m
6344 m68k/configs/mac_defconfig:CONFIG_BINFMT_AOUT=m
6345 m68k/configs/sun3_defconfig:CONFIG_BINFMT_AOUT=m
6346 m68k/configs/sun3x_defconfig:CONFIG_BINFMT_AOUT=m
6347 m68k/configs/mvme16x_defconfig:CONFIG_BINFMT_AOUT=m
6348
6349 arm/configs/iop32x_defconfig:CONFIG_BINFMT_AOUT=y
6350 arm/configs/badge4_defconfig:CONFIG_BINFMT_AOUT=m
6351 arm/configs/corgi_defconfig:CONFIG_BINFMT_AOUT=m
6352 arm/configs/neponset_defconfig:CONFIG_BINFMT_AOUT=y
6353 arm/configs/imote2_defconfig:CONFIG_BINFMT_AOUT=m
6354 arm/configs/lart_defconfig:CONFIG_BINFMT_AOUT=y
6355 arm/configs/ebsa110_defconfig:CONFIG_BINFMT_AOUT=y
6356 arm/configs/hackkit_defconfig:CONFIG_BINFMT_AOUT=y
6357 arm/configs/ezx_defconfig:CONFIG_BINFMT_AOUT=m
6358 arm/configs/jornada720_defconfig:CONFIG_BINFMT_AOUT=y
6359 arm/configs/rpc_defconfig:CONFIG_BINFMT_AOUT=y
6360 arm/configs/nuc960_defconfig:CONFIG_BINFMT_AOUT=y
6361 arm/configs/nuc950_defconfig:CONFIG_BINFMT_AOUT=y
6362 arm/configs/spitz_defconfig:CONFIG_BINFMT_AOUT=m
6363 arm/configs/footbridge_defconfig:CONFIG_BINFMT_AOUT=y
6364 arm/configs/netwinder_defconfig:CONFIG_BINFMT_AOUT=y
6365 arm/configs/iop13xx_defconfig:CONFIG_BINFMT_AOUT=y
6366 arm/configs/iop33x_defconfig:CONFIG_BINFMT_AOUT=y
6367
6368 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2018-07-19 19:02](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/3#issuecomment-406381446):
6369
6370 No thanks to you @a13xp0p0v 
6371
6372 I have corrected as requested, I hope it will suit you.
6373 I've done everything since the github editor which explains the many commit.
6374
6375 Too bad kconfig is so limited with conditions because it would be nice to have a menu to choose its security level (basic, custom, paranoid) when configuring the linux kernel.
6376
6377 So I took my inspiration from grsec to make something simpler:
6378 https://github.com/HacKurx/public-sharing/blob/master/disables_unsecured_options.patch
6379
6380 Thanks, best regards.
6381
6382 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2018-07-19 20:43](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/3#issuecomment-406408269):
6383
6384 @HacKurx btw, i have seen you added Arch Linux config: there is a hardened arch kernel as well with more protective options.
6385
6386 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-07-19 21:08](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/3#issuecomment-406414918):
6387
6388 Hello @HacKurx,
6389
6390 Cool thanks, I'll merge it soon!
6391
6392 I only will not take dropping "not found" from OK status, since it is important information:
6393 explicit "is not set" is different from the option absence in the config file, I want it to be displayed in the script output.
6394
6395 Thanks again!
6396 Till soon.
6397
6398 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2018-07-20 11:56](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/3#issuecomment-406579032):
6399
6400 @anthraxx 
6401 > there is a hardened arch kernel as well with more protective options.
6402
6403 Yes indeed. It's fixed.
6404
6405 @a13xp0p0v 
6406
6407 I will have fun adding main distributions config but it would be necessary to create a folder not to pollute it.
6408 This will allow an easy comparison to be made.
6409
6410 What do you think of that?
6411
6412 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-07-20 12:26](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/3#issuecomment-406585795):
6413
6414 Yes, moving configs into a separate directory is a good idea.
6415
6416 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2018-07-20 14:59](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/3#issuecomment-406627110):
6417
6418 It's done.
6419
6420 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-07-20 18:10](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/3#issuecomment-406683275):
6421
6422 Hello @HacKurx,
6423 Thanks for your work, it's merged (except "not found" dropping).
6424 Nice!
6425
6426 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2018-07-20 18:54](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/3#issuecomment-406695869):
6427
6428 Thank you to you too.
6429 I will complete the config_files folder because the results are very interesting :)
6430
6431 See you soon. Best regards,
6432
6433
6434 -------------------------------------------------------------------------------
6435
6436 # [\#2 PR](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2) `closed`: Feature/improvements
6437
6438 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) opened issue at [2018-06-20 22:14](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2):
6439
6440 Improve the source to make it easier to iterate over options by making the checks and all kernel config options a dictionary. Additionally implement logical operator to support or conditional checks.
6441
6442 Refactor option parsing to use pythons argparse
6443
6444 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2018-06-20 22:16](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-398915150):
6445
6446 At the end lots of lines changed, please ask anything you want to suggest any changes you would like to see. Even through the changes look massive, I believe they will pay out and make some stuff easier to maintain and access for potential future features.
6447
6448 I'm happy to take any feedback :cat:
6449
6450 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-06-21 20:50](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-399239396):
6451
6452 Thank you very much for your time spent on that!
6453 I like the ideas behind your changes and I want to merge them in the end.
6454
6455 Currently I have 2 concerns about the changes:
6456 1. the commits are really big, I would like to split them. From the top of my head, we can split infrastructure changes from new checks, etc.
6457 2. we should consider the case: MODULES or (MODULE_SIG and MODULE_SIG_ALL and MODULE_SIG_SHA512).
6458
6459 How much time would you like to spend on this? I don't have a right to ask you for more.
6460 At least I see your ideas and I can split (and learn) the commits myself.
6461
6462 Thank you, again.
6463
6464 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2018-06-21 23:13](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-399271969):
6465
6466 All of this sounds reasonable to me! I already spent some time on this and I'm sure I may contribute in the future as well so I would be super happy to change the commits as long as it satisfies you!
6467 I will split out the DEVMEM and STACKPROTECTOR changes and see if I can split at even more. Should be easy with rebase edit.
6468
6469 Latter case you described should easily be possible with an AND class that is like the OR class, everything else should work out of the box.
6470
6471 Cheers
6472 Levente
6473
6474 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) commented at [2018-06-22 20:50](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-399578012):
6475
6476 Just FYI, in Linux 4.18 `CC_STACKPROTECTOR_STRONG` [was renamed](https://github.com/torvalds/linux/blob/v4.18-rc1/arch/Kconfig#L585) to `STACKPROTECTOR_STRONG` and `CC_STACKPROTECTOR_AUTO` is gone.
6477
6478 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-06-25 16:27](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-400013145):
6479
6480 Thanks for the info, @Bernhard40. I'll update the STACKPROTECTOR config option when 4.18 is released.
6481
6482 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2018-06-25 22:47](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-400119687):
6483
6484 @a13xp0p0v I have splitted up the commits as much as made sense, can you please take a look? Really don't fear nitpicking, I'm used to do open-source :yum: 
6485
6486 PS: this also handles STACKPROTECTOR_STRONG by using the OR operator.
6487
6488 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-06-26 21:26](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-400467818):
6489
6490 Thanks a lot for your work, @anthraxx !
6491 I'll review this version in a couple of days.
6492 Till soon.
6493
6494 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2018-07-09 18:23](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-403574284):
6495
6496 @a13xp0p0v round 2, fight! :cat:
6497
6498 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2018-07-14 09:00](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-405010041):
6499
6500 Well I personally don't think it's a good idea to parse and check one line separately and don't really see why It can't be a dict. Curious how you want to check AND and OR logic on other opts if the config it not fully parsed yet. Personally, parsing it yet again for such logic sounds like non optimal algorithm/approach to me.
6501
6502 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2018-07-14 09:02](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-405010151):
6503
6504 Why not just check for existence before assigning parsed_options[config] and call it a day?
6505
6506 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-07-14 20:05](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-405046688):
6507
6508 Ah, yes, I see.
6509 You are right. AND & OR logic can't be implemented if we check the config file line by line.
6510 Moreover, separating parsing the file and checks should be a good design solution.
6511
6512 So the first commit in the series is fine.
6513 I would only ask to add the assertion to get_option_state() and call this function outside the Opt class method (just use the Opt.name from outside).
6514 I would also ask to reorder the series:
6515   1. all arch changes and renaming;
6516   2. AND & OR;
6517   3. new rules.
6518
6519 If you have no time/motivation for that work, I will do it myself.
6520
6521 Thanks again, @anthraxx. I'm glad to have your attention to this project.
6522
6523 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2018-07-14 20:57](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-405049389):
6524
6525 Yay! No worries, I like to discuss solutions and opinions as collaborative work and exchange is much more effective!
6526 I would be happy to make the changes as you requested, will push an update and rebased version very soon.
6527 Cheers 🍻
6528
6529 #### <img src="https://avatars.githubusercontent.com/u/4661917?u=bb7aeb3c77839cea055b49b80168666b36315f3d&v=4" width="50">[theLOICofFRANCE](https://github.com/theLOICofFRANCE) commented at [2018-07-19 19:14](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-406384461):
6530
6531 I don't know if you're doing it, but CONFIG_ARCH_MMAP_RND_BITS should be replaced by: 
6532 ```
6533 CONFIG_ARCH_MMAP_RND_BITS_MIN=28
6534 CONFIG_ARCH_MMAP_RND_BITS_MAX=32
6535 ```
6536
6537 found in Linux kernels: 4.5–4.17, 4.18-rc+HEAD
6538
6539 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2018-07-19 20:44](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-406408491):
6540
6541 @HacKurx no, i really want to get this PR through finally. After that me, you or whoever can make that CONFIG_ARCH_MMAP_RND_BITS change.
6542
6543 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2018-07-19 20:48](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-406409433):
6544
6545 @a13xp0p0v I have made the adjustments you wanted to see:
6546 - get_option_state is moved out of the class and assigned before checking
6547 - reordered all commits (wow, this was quite some work >.>)
6548
6549 I really hope we can get this in soon, I'm still there to make any changes if you request some but quite a lot of time already went in to make you happy :cat: :cat:
6550
6551 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-07-19 20:56](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-406411723):
6552
6553 Hello @anthraxx 
6554
6555 Cool, thanks for your work, I'm going to do the review soon.
6556 Yes, we've already spent plenty of time on that, because it's not so easy: this PR changes almost everything :)
6557
6558 Anyway, I like your ideas, they will be merged in the end.
6559
6560 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2018-07-19 20:58](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-406412140):
6561
6562 @a13xp0p0v Yay thanks, don't get me wrong I really like to work with you on this and i really enjoy it very much. Also I'm 100% on your side to get commits that make it into the tree proper, I just wanted to get that the rework conflicted a lot off my chest :smile:
6563
6564 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2018-07-19 21:15](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-406416764):
6565
6566 @a13xp0p0v just in case you already pulled my branch, please re-pull as there was a typo in the STACKPROTECTOR option, sorry. tested and reviewd every single commit independent from each other again
6567
6568 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-07-20 18:09](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-406683207):
6569
6570 Hello @anthraxx,
6571
6572 I've cherry-picked all your architecture improvements and added some minor fixes (please have a look).
6573 You've done a great job, I appreciate it!
6574
6575 Now we are ready to merge your OR and AND support.
6576 I have some questions, could you answer please?
6577
6578 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2018-07-21 08:12](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-406779757):
6579
6580 These are used to print the table and use the very first option of a logical class to represent the group by showing the first entries name and expected value
6581
6582 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-07-24 22:00](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-407566128):
6583
6584 Hello @anthraxx ,
6585 Thanks for your explanation.
6586 It took me some time to realize that self.opts[0] is the option which that OR-check is about.
6587 I.e. OR class use case is: OR(<X_is_hardened>, <X_is_disabled>)
6588
6589 I've merged your OR class with my minor fixes.
6590
6591 I don't think that we need AND right now. Rationale: our config checks are already implicitly connected with AND; if any of them fails, the error count increments anyway. Do you agree?
6592
6593 I also have a question about your STACKPROTECTOR commit.
6594 As I see in the kernel git history, the "CC_" prefix is dropped from both STACKPROTECTOR and STACKPROTECTOR_STRONG. So how about having:
6595 ```
6596 -    checklist.append(OptCheck('CC_STACKPROTECTOR',       'y', 'ubuntu18', 'self_protection'))
6597 -    checklist.append(OptCheck('CC_STACKPROTECTOR_STRONG','y', 'ubuntu18', 'self_protection'))
6598 +    checklist.append(OR(OptCheck('CC_STACKPROTECTOR',    'y', 'ubuntu18', 'self_protection'), \
6599 +                        OptCheck('STACKPROTECTOR',       'y', 'ubuntu18', 'self_protection')))
6600 +    checklist.append(OR(OptCheck('CC_STACKPROTECTOR_STRONG','y', 'ubuntu18', 'self_protection'), \
6601 +                        OptCheck('STACKPROTECTOR_STRONG','y', 'ubuntu18', 'self_protection')))
6602 ```
6603
6604 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2018-07-24 22:41](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-407575301):
6605
6606 @a13xp0p0v Hmm true, it is for >= 4.18 but for all kernels before 4.18 this would generate an error where non should be. Having CC_STACKPROTECTOR_STRONG without CC_STACKPROTECTOR is a totally correct setting pre 4.18 which would yield to an error.
6607 Its shitty, but the more generally compatible way would be to combine the different "correct sets" with the logical class to just have a single checklist.append for STACKPROTECTOR
6608
6609 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-07-24 23:19](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-407582510):
6610
6611 And how about this?
6612 ```
6613 -    checklist.append(OptCheck('CC_STACKPROTECTOR',       'y', 'ubuntu18', 'self_protection'))
6614 -    checklist.append(OptCheck('CC_STACKPROTECTOR_STRONG','y', 'ubuntu18', 'self_protection'))
6615 +    checklist.append(OR(OptCheck('CC_STACKPROTECTOR_STRONG','y', 'ubuntu18', 'self_protection'), \
6616 +                        OptCheck('STACKPROTECTOR_STRONG','y', 'ubuntu18', 'self_protection')))
6617 ```
6618
6619 It fits your logic "be strong or fail".
6620 At the same time it fits the case of old configs, where there is no CC_STACKPROTECTOR, right?
6621
6622 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2018-07-25 07:05](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-407655722):
6623
6624 yeah, i think that should work :smiley_cat:
6625
6626 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-07-25 11:45](https://github.com/a13xp0p0v/kernel-hardening-checker/pull/2#issuecomment-407726202):
6627
6628 Done with STACKPROTECTOR and MODULES.
6629 @anthraxx we have finished with this pull request.
6630 Thanks for your excellent work :thumbsup:
6631
6632
6633 -------------------------------------------------------------------------------
6634
6635 # [\#1 Issue](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/1) `closed`: Couple ideas
6636
6637 #### <img src="https://avatars.githubusercontent.com/u/32568352?v=4" width="50">[Bernhard40](https://github.com/Bernhard40) opened issue at [2018-06-20 13:19](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/1):
6638
6639 Shouldn't [NAMESPACES](https://github.com/a13xp0p0v/kconfig-hardened-check/blob/master/kconfig-hardened-check.py#L94) be replaced by `USER_NS`? AFAIK only user namespaces have security concerns, others are fine. Disabling them all will negatively affect many applications which use various namespaces for sandboxing.
6640
6641 Since linux 4.16 there is `CC_STACKPROTECTOR_AUTO` kconfig which effectively replaces [CC_STACKPROTECTOR_STRONG](https://github.com/a13xp0p0v/kconfig-hardened-check/blob/master/kconfig-hardened-check.py#L54) and make it false negative in script.
6642
6643 Script doesn't check for [DEVMEM](https://github.com/a13xp0p0v/kconfig-hardened-check/blob/master/kspp-recommendations.config#L18) which when set to `n` make [STRICT_DEVMEM](https://github.com/a13xp0p0v/kconfig-hardened-check/blob/master/kconfig-hardened-check.py#L38) and [IO_STRICT_DEVMEM](https://github.com/a13xp0p0v/kconfig-hardened-check/blob/master/kconfig-hardened-check.py#L65) false negative.
6644
6645
6646
6647 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2018-06-20 13:23](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/1#issuecomment-398746587):
6648
6649 I already nearly finished a PR for the DEVMEM and CC_STACKPROTECTOR_* case by adding context aware logic to the option checks.
6650 Pull request incoming later today, it extends the options with logical operators like OR()
6651
6652 #### <img src="https://avatars.githubusercontent.com/u/203012?u=939d6d3b5ff0b9e46e911d8792a40c20408574e2&v=4" width="50">[anthraxx](https://github.com/anthraxx) commented at [2018-06-20 19:14](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/1#issuecomment-398864576):
6653
6654 @a13xp0p0v please no force push, that creates weird merge diffs when working on something :smile_cat:
6655
6656 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-06-20 20:43](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/1#issuecomment-398890140):
6657
6658 @Bernhard40 , thanks a lot for the ideas. I agree. Just fixed the namespaces mistake.
6659 @anthraxx , thanks, cool! Waiting for your PR.
6660 And, yes, no more force push from me.
6661
6662 #### <img src="https://avatars.githubusercontent.com/u/1419667?u=de82e29061c3ef5f1c19f95528f8a82b08051fd2&v=4" width="50">[a13xp0p0v](https://github.com/a13xp0p0v) commented at [2018-07-04 15:38](https://github.com/a13xp0p0v/kernel-hardening-checker/issues/1#issuecomment-402512111):
6663
6664 Closing, since @anthraxx PR will resolve it.
6665
6666
6667 -------------------------------------------------------------------------------
6668