3 # Report BUG() conditions and kill the offending process.
6 # Make sure kernel page tables have safe permissions.
7 CONFIG_STRICT_KERNEL_RWX=y
9 # Report any dangerous memory permissions (not available on all archs).
12 # Use -fstack-protector-strong (gcc 4.9+) for best stack canary coverage.
13 CONFIG_CC_STACKPROTECTOR=y
14 CONFIG_CC_STACKPROTECTOR_STRONG=y
16 # Do not allow direct physical memory access (but if you must have it, at least enable STRICT mode...)
17 # CONFIG_DEVMEM is not set
18 CONFIG_STRICT_DEVMEM=y
19 CONFIG_IO_STRICT_DEVMEM=y
21 # Provides some protections against SYN flooding.
24 # Perform additional validation of various commonly targeted structures.
25 CONFIG_DEBUG_CREDENTIALS=y
26 CONFIG_DEBUG_NOTIFIERS=y
29 CONFIG_BUG_ON_DATA_CORRUPTION=y
30 CONFIG_SCHED_STACK_END_CHECK=y
32 # Provide userspace with seccomp BPF API for syscall attack surface reduction.
34 CONFIG_SECCOMP_FILTER=y
36 # Provide userspace with ptrace ancestry protections.
38 CONFIG_SECURITY_YAMA=y
40 # Perform usercopy bounds checking. (And disable fallback to gain full whitelist enforcement.)
41 CONFIG_HARDENED_USERCOPY=y
42 # CONFIG_HARDENED_USERCOPY_FALLBACK is not set
44 # Randomize allocator freelists, harden metadata.
45 CONFIG_SLAB_FREELIST_RANDOM=y
46 CONFIG_SLAB_FREELIST_HARDENED=y
48 # Allow allocator validation checking to be enabled (see "slub_debug=P" below).
51 # Wipe higher-level memory allocations when they are freed (needs "page_poison=1" command line below).
52 # (If you can afford even more performance penalty, leave CONFIG_PAGE_POISONING_NO_SANITY=n)
53 CONFIG_PAGE_POISONING=y
54 CONFIG_PAGE_POISONING_NO_SANITY=y
55 CONFIG_PAGE_POISONING_ZERO=y
57 # Adds guard pages to kernel stacks (not all architectures support this yet).
60 # Perform extensive checks on reference counting.
61 CONFIG_REFCOUNT_FULL=y
63 # Check for memory copies that might overflow a structure in str*() and mem*() functions both at build-time and run-time.
64 CONFIG_FORTIFY_SOURCE=y
66 # Dangerous; enabling this allows direct physical memory writing.
67 # CONFIG_ACPI_CUSTOM_METHOD is not set
69 # Dangerous; enabling this disables brk ASLR.
70 # CONFIG_COMPAT_BRK is not set
72 # Dangerous; enabling this allows direct kernel memory writing.
73 # CONFIG_DEVKMEM is not set
75 # Dangerous; exposes kernel text image layout.
76 # CONFIG_PROC_KCORE is not set
78 # Dangerous; enabling this disables VDSO ASLR.
79 # CONFIG_COMPAT_VDSO is not set
81 # Dangerous; enabling this allows replacement of running kernel.
82 # CONFIG_KEXEC is not set
84 # Dangerous; enabling this allows replacement of running kernel.
85 # CONFIG_HIBERNATION is not set
87 # Prior to v4.1, assists heap memory attacks; best to keep interface disabled.
88 # CONFIG_INET_DIAG is not set
90 # Easily confused by misconfigured userspace, keep off.
91 # CONFIG_BINFMT_MISC is not set
93 # Use the modern PTY interface (devpts) only.
94 # CONFIG_LEGACY_PTYS is not set
96 # If SELinux can be disabled at runtime, the LSM structures cannot be read-only; keep off.
97 # CONFIG_SECURITY_SELINUX_DISABLE is not set
99 # Reboot devices immediately if kernel experiences an Oops.
100 CONFIG_PANIC_ON_OOPS=y
101 CONFIG_PANIC_TIMEOUT=-1
103 # Keep root from altering kernel memory via loadable modules.
104 # CONFIG_MODULES is not set
106 # But if CONFIG_MODULE=y is needed, at least they must be signed with a per-build key.
107 CONFIG_STRICT_MODULE_RWX=y
109 CONFIG_MODULE_SIG_FORCE=y
110 CONFIG_MODULE_SIG_ALL=y
111 CONFIG_MODULE_SIG_SHA512=y
112 CONFIG_MODULE_SIG_HASH="sha512"
113 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
121 # Gather additional entropy at boot time for systems that may not have appropriate entropy sources.
122 CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y
124 # Force all structures to be initialized before they are passed to other functions.
125 CONFIG_GCC_PLUGIN_STRUCTLEAK=y
126 CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y
128 # Randomize the layout of system structures. This may have dramatic performance impact, so
129 # use with caution or also use CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE=y
130 CONFIG_GCC_PLUGIN_RANDSTRUCT=y
135 # Full 64-bit means PAE and NX bit.
138 # Disallow allocating the first 64k of memory.
139 CONFIG_DEFAULT_MMAP_MIN_ADDR=65536
141 # Randomize position of kernel and memory.
142 CONFIG_RANDOMIZE_BASE=y
143 CONFIG_RANDOMIZE_MEMORY=y
145 # Modern libc no longer needs a fixed-position mapping in userspace, remove it as a possible target.
146 CONFIG_LEGACY_VSYSCALL_NONE=y
148 # Enable Kernel Page Table Isolation to remove an entire class of cache timing side-channels.
149 CONFIG_PAGE_TABLE_ISOLATION=y
151 # Remove additional attack surface, unless you really need them.
152 # CONFIG_IA32_EMULATION is not set
153 # CONFIG_X86_X32 is not set
154 # CONFIG_MODIFY_LDT_SYSCALL is not set