Update the KSPP recommendations in the config_files

[kconfig-hardened-check.git] / kconfig_hardened_check / config_files / kspp-recommendations / kspp-recommendations-arm64.config

diff --git a/kconfig_hardened_check/config_files/kspp-recommendations/kspp-recommendations-arm64.config b/kconfig_hardened_check/config_files/kspp-recommendations/kspp-recommendations-arm64.config
index 50434940534812ec3b65de78754b5c69c4b154be..c1662903e2154aeaeb3e3ff9fec667fe0d2ed530 100644 (file)
--- a/kconfig_hardened_check/config_files/kspp-recommendations/kspp-recommendations-arm64.config
+++ b/kconfig_hardened_check/config_files/kspp-recommendations/kspp-recommendations-arm64.config
@@ -1,5 +1,5 @@
 # CONFIGs
-# Linux/arm64 5.4.0 Kernel Configuration
+# Linux/arm64 5.14.0 Kernel Configuration
 
 # Report BUG() conditions and kill the offending process.
 CONFIG_BUG=y
@@ -68,8 +68,8 @@ CONFIG_PAGE_POISONING_ZERO=y
 CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
 CONFIG_INIT_ON_FREE_DEFAULT_ON=y
 
-# Initialize all stack variables on function entry. (Clang builds only. For GCC, see CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y below)
-CONFIG_INIT_STACK_ALL=y
+# Initialize all stack variables on function entry. (Clang and GCC 12+ builds only. For earlier GCC, see CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y below)
+CONFIG_INIT_STACK_ALL_ZERO=y
 
 # Adds guard pages to kernel stacks (not all architectures support this yet).
 CONFIG_VMAP_STACK=y
@@ -83,6 +83,24 @@ CONFIG_FORTIFY_SOURCE=y
 # Avoid kernel memory address exposures via dmesg (sets sysctl kernel.dmesg_restrict initial value to 1)
 CONFIG_SECURITY_DMESG_RESTRICT=y
 
+# Randomize kernel stack offset on syscall entry (since v5.13).
+CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y
+
+# Enable sampling-based overflow detection. This is similar to KASAN coverage, but with almost zero runtime overhead.
+CONFIG_KFENCE=y
+
+# Do not ignore compile-time warnings (since v5.15)
+CONFIG_WERROR=y
+
+# Force IOMMU TLB invalidation so devices will never be able to access stale data contents (or set "iommu.passthrough=0 iommu.strict=1" at boot)
+CONFIG_IOMMU_DEFAULT_DMA_STRICT=y
+
+# Make scheduler aware of SMT Cores. Program needs to opt-in to using this feature with prctl(PR_SCHED_CORE).
+CONFIG_SCHED_CORE=y
+
+# Wipe all caller-used registers on exit from the function (reduces available ROP gadgets and minimizes stale data in registers)
+CONFIG_ZERO_CALL_USED_REGS=y
+
 # Dangerous; enabling this allows direct physical memory writing.
 # CONFIG_ACPI_CUSTOM_METHOD is not set
 
@@ -152,7 +170,6 @@ CONFIG_GCC_PLUGIN_STACKLEAK=y
 # use with caution or also use CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE=y
 CONFIG_GCC_PLUGIN_RANDSTRUCT=y
 
-
 # arm64
 
 CONFIG_ARM64=y
@@ -168,3 +185,5 @@ CONFIG_ARM64_SW_TTBR0_PAN=y
 
 # Enable Kernel Page Table Isolation to remove an entire class of cache timing side-channels.
 CONFIG_UNMAP_KERNEL_AT_EL0=y
+
+