projects
/
kconfig-hardened-check.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Update KSPP recommendations
[kconfig-hardened-check.git]
/
kconfig_hardened_check
/
config_files
/
kspp-recommendations
/
kspp-recommendations-arm64.config
diff --git
a/kconfig_hardened_check/config_files/kspp-recommendations/kspp-recommendations-arm64.config
b/kconfig_hardened_check/config_files/kspp-recommendations/kspp-recommendations-arm64.config
index 013263c978684c47f2a2d35c9e342ce99d1d9b7e..50434940534812ec3b65de78754b5c69c4b154be 100644
(file)
--- a/
kconfig_hardened_check/config_files/kspp-recommendations/kspp-recommendations-arm64.config
+++ b/
kconfig_hardened_check/config_files/kspp-recommendations/kspp-recommendations-arm64.config
@@
-80,6
+80,9
@@
CONFIG_REFCOUNT_FULL=y
# Check for memory copies that might overflow a structure in str*() and mem*() functions both at build-time and run-time.
CONFIG_FORTIFY_SOURCE=y
# Check for memory copies that might overflow a structure in str*() and mem*() functions both at build-time and run-time.
CONFIG_FORTIFY_SOURCE=y
+# Avoid kernel memory address exposures via dmesg (sets sysctl kernel.dmesg_restrict initial value to 1)
+CONFIG_SECURITY_DMESG_RESTRICT=y
+
# Dangerous; enabling this allows direct physical memory writing.
# CONFIG_ACPI_CUSTOM_METHOD is not set
# Dangerous; enabling this allows direct physical memory writing.
# CONFIG_ACPI_CUSTOM_METHOD is not set