Move some features to 'cut_attack_surface' category

[kconfig-hardened-check.git] / README.md

diff --git a/README.md b/README.md
index 8fdd80cf010a6a89effd9a47403bc3a75cf5e487..1ad19fec3172769e7167671387afccb37c3f163c 100644 (file)
--- a/README.md
+++ b/README.md
@@ -41,6 +41,7 @@ Usage: ./kconfig-hardened-check.py [-p | -c <config_file>]
   CONFIG_DEBUG_WX                        |      y      | ubuntu18 |  self_protection   ||         OK         
   CONFIG_RANDOMIZE_BASE                  |      y      | ubuntu18 |  self_protection   ||         OK         
   CONFIG_RANDOMIZE_MEMORY                |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_CC_STACKPROTECTOR               |      y      | ubuntu18 |  self_protection   ||         OK         
   CONFIG_CC_STACKPROTECTOR_STRONG        |      y      | ubuntu18 |  self_protection   ||         OK         
   CONFIG_VMAP_STACK                      |      y      | ubuntu18 |  self_protection   ||         OK         
   CONFIG_THREAD_INFO_IN_TASK             |      y      | ubuntu18 |  self_protection   ||         OK         
@@ -50,13 +51,10 @@ Usage: ./kconfig-hardened-check.py [-p | -c <config_file>]
   CONFIG_SLAB_FREELIST_RANDOM            |      y      | ubuntu18 |  self_protection   ||         OK         
   CONFIG_HARDENED_USERCOPY               |      y      | ubuntu18 |  self_protection   ||         OK         
   CONFIG_FORTIFY_SOURCE                  |      y      | ubuntu18 |  self_protection   ||         OK         
-  CONFIG_STRICT_DEVMEM                   |      y      | ubuntu18 |  self_protection   ||         OK         
-  CONFIG_SYN_COOKIES                     |      y      | ubuntu18 |  self_protection   ||         OK         
-  CONFIG_SECCOMP                         |      y      | ubuntu18 |  self_protection   ||         OK         
-  CONFIG_SECCOMP_FILTER                  |      y      | ubuntu18 |  self_protection   ||         OK         
   CONFIG_MODULE_SIG                      |      y      | ubuntu18 |  self_protection   ||         OK         
   CONFIG_MODULE_SIG_ALL                  |      y      | ubuntu18 |  self_protection   ||         OK         
   CONFIG_MODULE_SIG_SHA512               |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_SYN_COOKIES                     |      y      | ubuntu18 |  self_protection   ||         OK         
   CONFIG_DEFAULT_MMAP_MIN_ADDR           |    65536    | ubuntu18 |  self_protection   ||         OK         
   CONFIG_BUG_ON_DATA_CORRUPTION          |      y      |   kspp   |  self_protection   || FAIL: "is not set" 
   CONFIG_PAGE_POISONING                  |      y      |   kspp   |  self_protection   || FAIL: "is not set" 
@@ -65,7 +63,6 @@ Usage: ./kconfig-hardened-check.py [-p | -c <config_file>]
   CONFIG_GCC_PLUGIN_STRUCTLEAK           |      y      |   kspp   |  self_protection   ||  FAIL: not found   
   CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL |      y      |   kspp   |  self_protection   ||  FAIL: not found   
   CONFIG_GCC_PLUGIN_LATENT_ENTROPY       |      y      |   kspp   |  self_protection   ||  FAIL: not found   
-  CONFIG_IO_STRICT_DEVMEM                |      y      |   kspp   |  self_protection   || FAIL: "is not set" 
   CONFIG_REFCOUNT_FULL                   |      y      |   kspp   |  self_protection   || FAIL: "is not set" 
   CONFIG_DEBUG_LIST                      |      y      |   kspp   |  self_protection   || FAIL: "is not set" 
   CONFIG_DEBUG_SG                        |      y      |   kspp   |  self_protection   || FAIL: "is not set" 
@@ -77,13 +74,19 @@ Usage: ./kconfig-hardened-check.py [-p | -c <config_file>]
   CONFIG_SLUB_DEBUG_ON                   |      y      |    my    |  self_protection   || FAIL: "is not set" 
   CONFIG_SECURITY_DMESG_RESTRICT         |      y      |    my    |  self_protection   || FAIL: "is not set" 
   CONFIG_STATIC_USERMODEHELPER           |      y      |    my    |  self_protection   || FAIL: "is not set" 
+  CONFIG_PAGE_POISONING_NO_SANITY        | is not set  |    my    |  self_protection   ||  FAIL: not found   
+  CONFIG_PAGE_POISONING_ZERO             | is not set  |    my    |  self_protection   ||  FAIL: not found   
   CONFIG_SECURITY                        |      y      | ubuntu18 |  security_policy   ||         OK         
   CONFIG_SECURITY_YAMA                   |      y      | ubuntu18 |  security_policy   ||         OK         
   CONFIG_SECURITY_SELINUX_DISABLE        | is not set  | ubuntu18 |  security_policy   ||         OK         
+  CONFIG_SECCOMP                         |      y      | ubuntu18 | cut_attack_surface ||         OK         
+  CONFIG_SECCOMP_FILTER                  |      y      | ubuntu18 | cut_attack_surface ||         OK         
+  CONFIG_STRICT_DEVMEM                   |      y      | ubuntu18 | cut_attack_surface ||         OK         
   CONFIG_ACPI_CUSTOM_METHOD              | is not set  | ubuntu18 | cut_attack_surface ||         OK         
   CONFIG_COMPAT_BRK                      | is not set  | ubuntu18 | cut_attack_surface ||         OK         
   CONFIG_DEVKMEM                         | is not set  | ubuntu18 | cut_attack_surface ||         OK         
   CONFIG_COMPAT_VDSO                     | is not set  | ubuntu18 | cut_attack_surface ||         OK         
+  CONFIG_IO_STRICT_DEVMEM                |      y      |   kspp   | cut_attack_surface || FAIL: "is not set" 
   CONFIG_LEGACY_VSYSCALL_NONE            |      y      |   kspp   | cut_attack_surface || FAIL: "is not set" 
   CONFIG_BINFMT_MISC                     | is not set  |   kspp   | cut_attack_surface ||     FAIL: "m"      
   CONFIG_INET_DIAG                       | is not set  |   kspp   | cut_attack_surface ||     FAIL: "m"      
@@ -93,6 +96,7 @@ Usage: ./kconfig-hardened-check.py [-p | -c <config_file>]
   CONFIG_IA32_EMULATION                  | is not set  |   kspp   | cut_attack_surface ||     FAIL: "y"      
   CONFIG_X86_X32                         | is not set  |   kspp   | cut_attack_surface ||     FAIL: "y"      
   CONFIG_MODIFY_LDT_SYSCALL              | is not set  |   kspp   | cut_attack_surface ||     FAIL: "y"      
+  CONFIG_HIBERNATION                     | is not set  |   kspp   | cut_attack_surface ||     FAIL: "y"      
   CONFIG_KEXEC_FILE                      | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      
   CONFIG_LIVEPATCH                       | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      
   CONFIG_USER_NS                         | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      
@@ -104,9 +108,10 @@ Usage: ./kconfig-hardened-check.py [-p | -c <config_file>]
   CONFIG_UPROBES                         | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      
   CONFIG_BPF_JIT                         | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      
   CONFIG_BPF_SYSCALL                     | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      
+  CONFIG_ARCH_MMAP_RND_BITS              |     32      |    my    |userspace_protection||     FAIL: "28"     
   CONFIG_LKDTM                           |      m      |    my    |    feature_test    || FAIL: "is not set" 
 
-[-] config check is NOT PASSED: 40 errors
+[-] config check is NOT PASSED: 44 errors
 ```
 
 __Go and fix them all!__