Change 'decision' to 'defconfig' for hardening features enabled by default

[kconfig-hardened-check.git] / README.md

diff --git a/README.md b/README.md
index ac72965e792f69d99286b3faf8eba033740ab6aa..1403bd84c9a0cd522959f450d763d959588c9bca 100644 (file)
--- a/README.md
+++ b/README.md
@@ -15,6 +15,8 @@ which they disable).
 
 Please don't cry if my Python code looks like C. I'm just a kernel developer.
 
+__TODO:__ add hardening preferences for ARM.
+
 ## Script output examples
 
 ### Usage
@@ -42,13 +44,13 @@ optional arguments:
   CONFIG_PAGE_TABLE_ISOLATION            |      y      | ubuntu18 |  self_protection   ||             OK             
   CONFIG_RETPOLINE                       |      y      | ubuntu18 |  self_protection   ||             OK             
   CONFIG_X86_64                          |      y      | ubuntu18 |  self_protection   ||             OK             
+  CONFIG_X86_SMAP                        |      y      | ubuntu18 |  self_protection   ||             OK             
+  CONFIG_X86_INTEL_UMIP                  |      y      | ubuntu18 |  self_protection   ||             OK             
   CONFIG_STRICT_KERNEL_RWX               |      y      | ubuntu18 |  self_protection   ||             OK             
-  CONFIG_STRICT_MODULE_RWX               |      y      | ubuntu18 |  self_protection   ||             OK             
   CONFIG_DEBUG_WX                        |      y      | ubuntu18 |  self_protection   ||             OK             
   CONFIG_RANDOMIZE_BASE                  |      y      | ubuntu18 |  self_protection   ||             OK             
   CONFIG_RANDOMIZE_MEMORY                |      y      | ubuntu18 |  self_protection   ||             OK             
-  CONFIG_CC_STACKPROTECTOR               |      y      | ubuntu18 |  self_protection   ||             OK             
-  CONFIG_CC_STACKPROTECTOR_STRONG        |      y      | ubuntu18 |  self_protection   ||             OK             
+  CONFIG_STACKPROTECTOR_STRONG           |      y      | ubuntu18 |  self_protection   ||CONFIG_CC_STACKPROTECTOR_STRONG: OK ("y")
   CONFIG_VMAP_STACK                      |      y      | ubuntu18 |  self_protection   ||             OK             
   CONFIG_THREAD_INFO_IN_TASK             |      y      | ubuntu18 |  self_protection   ||             OK             
   CONFIG_SCHED_STACK_END_CHECK           |      y      | ubuntu18 |  self_protection   ||             OK             
@@ -57,6 +59,8 @@ optional arguments:
   CONFIG_SLAB_FREELIST_RANDOM            |      y      | ubuntu18 |  self_protection   ||             OK             
   CONFIG_HARDENED_USERCOPY               |      y      | ubuntu18 |  self_protection   ||             OK             
   CONFIG_FORTIFY_SOURCE                  |      y      | ubuntu18 |  self_protection   ||             OK             
+  CONFIG_LOCK_DOWN_KERNEL                |      y      | ubuntu18 |  self_protection   ||             OK             
+  CONFIG_STRICT_MODULE_RWX               |      y      | ubuntu18 |  self_protection   ||             OK             
   CONFIG_MODULE_SIG                      |      y      | ubuntu18 |  self_protection   ||             OK             
   CONFIG_MODULE_SIG_ALL                  |      y      | ubuntu18 |  self_protection   ||             OK             
   CONFIG_MODULE_SIG_SHA512               |      y      | ubuntu18 |  self_protection   ||             OK             
@@ -80,8 +84,10 @@ optional arguments:
   CONFIG_SLUB_DEBUG_ON                   |      y      |    my    |  self_protection   ||     FAIL: "is not set"     
   CONFIG_SECURITY_DMESG_RESTRICT         |      y      |    my    |  self_protection   ||     FAIL: "is not set"     
   CONFIG_STATIC_USERMODEHELPER           |      y      |    my    |  self_protection   ||     FAIL: "is not set"     
+  CONFIG_SECURITY_LOADPIN                |      y      |    my    |  self_protection   ||     FAIL: "is not set"     
   CONFIG_PAGE_POISONING_NO_SANITY        | is not set  |    my    |  self_protection   ||       OK: not found        
   CONFIG_PAGE_POISONING_ZERO             | is not set  |    my    |  self_protection   ||       OK: not found        
+  CONFIG_SLAB_MERGE_DEFAULT              | is not set  |    my    |  self_protection   ||         FAIL: "y"          
   CONFIG_SECURITY                        |      y      | ubuntu18 |  security_policy   ||             OK             
   CONFIG_SECURITY_YAMA                   |      y      | ubuntu18 |  security_policy   ||             OK             
   CONFIG_SECURITY_SELINUX_DISABLE        | is not set  | ubuntu18 |  security_policy   ||             OK             
@@ -97,6 +103,7 @@ optional arguments:
   CONFIG_PAGE_OWNER                      | is not set  | ubuntu18 | cut_attack_surface ||             OK             
   CONFIG_DEBUG_KMEMLEAK                  | is not set  | ubuntu18 | cut_attack_surface ||             OK             
   CONFIG_BINFMT_AOUT                     | is not set  | ubuntu18 | cut_attack_surface ||       OK: not found        
+  CONFIG_MMIOTRACE_TEST                  | is not set  | ubuntu18 | cut_attack_surface ||             OK             
   CONFIG_IO_STRICT_DEVMEM                |      y      |   kspp   | cut_attack_surface ||     FAIL: "is not set"     
   CONFIG_LEGACY_VSYSCALL_NONE            |      y      |   kspp   | cut_attack_surface ||     FAIL: "is not set"     
   CONFIG_BINFMT_MISC                     | is not set  |   kspp   | cut_attack_surface ||         FAIL: "m"          
@@ -121,21 +128,29 @@ optional arguments:
   CONFIG_DEVPORT                         | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
   CONFIG_DEBUG_FS                        | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
   CONFIG_NOTIFIER_ERROR_INJECTION        | is not set  |grsecurity| cut_attack_surface ||         FAIL: "m"          
+  CONFIG_ACPI_TABLE_UPGRADE              | is not set  | lockdown | cut_attack_surface ||         FAIL: "y"          
+  CONFIG_ACPI_APEI_EINJ                  | is not set  | lockdown | cut_attack_surface ||         FAIL: "m"          
+  CONFIG_PROFILING                       | is not set  | lockdown | cut_attack_surface ||         FAIL: "y"          
+  CONFIG_BPF_SYSCALL                     | is not set  | lockdown | cut_attack_surface ||         FAIL: "y"          
+  CONFIG_MMIOTRACE                       | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
   CONFIG_KEXEC_FILE                      | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
   CONFIG_LIVEPATCH                       | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
   CONFIG_USER_NS                         | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
   CONFIG_IP_DCCP                         | is not set  |    my    | cut_attack_surface ||         FAIL: "m"          
   CONFIG_IP_SCTP                         | is not set  |    my    | cut_attack_surface ||         FAIL: "m"          
   CONFIG_FTRACE                          | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
-  CONFIG_PROFILING                       | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
   CONFIG_BPF_JIT                         | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
-  CONFIG_BPF_SYSCALL                     | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
   CONFIG_ARCH_MMAP_RND_BITS              |     32      |    my    |userspace_protection||         FAIL: "28"         
-  CONFIG_LKDTM                           |      m      |    my    |    feature_test    ||     FAIL: "is not set"     
 
-[-] config check is NOT PASSED: 52 errors
+[-] config check is NOT PASSED: 56 errors
 ```
 
+
+N.B. If `CONFIG_GCC_PLUGIN*` options are automatically disabled during your kernel compilation,
+that means that your gcc doesn't support plugins. For example, if you have `gcc-7` on Ubuntu,
+try to install `gcc-7-plugin-dev` package, it should help.
+
+
 __Go and fix them all!__
 
 [1]: http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings