X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;ds=sidebyside;f=README.md;h=3f07f0d1798dd669fa87bd240526ed4eb84a014f;hb=47226fe77ab14311a172343d3e306264d9062d88;hp=10703ba6faf6235e3cd581247b2c1c21ae67cb63;hpb=8510fc06c7b5f77477895a4bb14ae86942686f45;p=kconfig-hardened-check.git

diff --git a/README.md b/README.md
index 10703ba..3f07f0d 100644
--- a/README.md
+++ b/README.md
@@ -9,55 +9,60 @@ make our systems more secure.
 But nobody likes checking configs manually. So let the computers do their job!
 
 __kconfig-hardened-check.py__ helps me to check the Linux kernel Kconfig option list
-against my hardening preferences for `x86_64`, which are based on the
+against my hardening preferences, which are based on the
 [KSPP recommended settings][1] and last public [grsecurity][2] patch (options
 which they disable).
 
 Please don't cry if my Python code looks like C. I'm just a kernel developer.
 
-__TODO:__ add hardening preferences for ARM.
+## Supported microarchitectures
+
+  - X86_64
+  - X86_32
+  - ARM64
+  - ARM
 
 ## Script output examples
 
 ### Usage
 ```
-#./kconfig-hardened-check.py
-usage: kconfig-hardened-check.py [-h] [-p {X86_64,X86_32}] [-c CONFIG]
-                                 [--debug]
+#usage: kconfig-hardened-check.py [-h] [-p {X86_64,X86_32,ARM64,ARM}]
+                                 [-c CONFIG] [--debug]
 
 Checks the hardening options in the Linux kernel config
 
 optional arguments:
   -h, --help            show this help message and exit
-  -p {X86_64,X86_32}, --print {X86_64,X86_32}
+  -p {X86_64,X86_32,ARM64,ARM}, --print {X86_64,X86_32,ARM64,ARM}
                         print hardening preferences for selected architecture
   -c CONFIG, --config CONFIG
                         check the config_file against these preferences
   --debug               enable internal debug mode
+
 ```
 
 ### Script output for `Ubuntu 18.04 (Bionic Beaver)` kernel config
 ```
-#./kconfig-hardened-check.py  -c config_files/distros/ubuntu-bionic-generic.config 
+#./kconfig-hardened-check.py -c config_files/distros/ubuntu-bionic-generic.config
 [+] Trying to detect architecture in "config_files/distros/ubuntu-bionic-generic.config"...
 [+] Detected architecture: X86_64
 [+] Checking "config_files/distros/ubuntu-bionic-generic.config" against hardening preferences...
   option name                            | desired val | decision |       reason       ||        check result        
   ===================================================================================================================
   CONFIG_BUG                             |      y      |defconfig |  self_protection   ||             OK             
-  CONFIG_RETPOLINE                       |      y      |defconfig |  self_protection   ||             OK             
-  CONFIG_X86_SMAP                        |      y      |defconfig |  self_protection   ||             OK             
-  CONFIG_X86_INTEL_UMIP                  |      y      |defconfig |  self_protection   ||             OK             
   CONFIG_STRICT_KERNEL_RWX               |      y      |defconfig |  self_protection   ||             OK             
-  CONFIG_RANDOMIZE_BASE                  |      y      |defconfig |  self_protection   ||             OK             
   CONFIG_STACKPROTECTOR_STRONG           |      y      |defconfig |  self_protection   ||CONFIG_CC_STACKPROTECTOR_STRONG: OK ("y")
-  CONFIG_THREAD_INFO_IN_TASK             |      y      |defconfig |  self_protection   ||             OK             
   CONFIG_SLUB_DEBUG                      |      y      |defconfig |  self_protection   ||             OK             
   CONFIG_STRICT_MODULE_RWX               |      y      |defconfig |  self_protection   ||             OK             
-  CONFIG_SYN_COOKIES                     |      y      |defconfig |  self_protection   ||             OK             
   CONFIG_PAGE_TABLE_ISOLATION            |      y      |defconfig |  self_protection   ||             OK             
   CONFIG_RANDOMIZE_MEMORY                |      y      |defconfig |  self_protection   ||             OK             
+  CONFIG_RANDOMIZE_BASE                  |      y      |defconfig |  self_protection   ||             OK             
+  CONFIG_RETPOLINE                       |      y      |defconfig |  self_protection   ||             OK             
+  CONFIG_X86_SMAP                        |      y      |defconfig |  self_protection   ||             OK             
+  CONFIG_X86_INTEL_UMIP                  |      y      |defconfig |  self_protection   ||             OK             
+  CONFIG_SYN_COOKIES                     |      y      |defconfig |  self_protection   ||             OK             
   CONFIG_VMAP_STACK                      |      y      |defconfig |  self_protection   ||             OK             
+  CONFIG_THREAD_INFO_IN_TASK             |      y      |defconfig |  self_protection   ||             OK             
   CONFIG_BUG_ON_DATA_CORRUPTION          |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"     
   CONFIG_DEBUG_WX                        |      y      |   kspp   |  self_protection   ||             OK             
   CONFIG_SCHED_STACK_END_CHECK           |      y      |   kspp   |  self_protection   ||             OK             
@@ -72,7 +77,6 @@ optional arguments:
   CONFIG_GCC_PLUGIN_STRUCTLEAK           |      y      |   kspp   |  self_protection   ||      FAIL: not found       
   CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL |      y      |   kspp   |  self_protection   ||      FAIL: not found       
   CONFIG_GCC_PLUGIN_LATENT_ENTROPY       |      y      |   kspp   |  self_protection   ||      FAIL: not found       
-  CONFIG_REFCOUNT_FULL                   |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"     
   CONFIG_DEBUG_LIST                      |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"     
   CONFIG_DEBUG_SG                        |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"     
   CONFIG_DEBUG_CREDENTIALS               |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"     
@@ -82,12 +86,14 @@ optional arguments:
   CONFIG_MODULE_SIG_SHA512               |      y      |   kspp   |  self_protection   ||             OK             
   CONFIG_MODULE_SIG_FORCE                |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"     
   CONFIG_DEFAULT_MMAP_MIN_ADDR           |    65536    |   kspp   |  self_protection   ||             OK             
+  CONFIG_REFCOUNT_FULL                   |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"     
   CONFIG_GCC_PLUGIN_STACKLEAK            |      y      |    my    |  self_protection   ||      FAIL: not found       
   CONFIG_LOCK_DOWN_KERNEL                |      y      |    my    |  self_protection   ||             OK             
   CONFIG_SLUB_DEBUG_ON                   |      y      |    my    |  self_protection   ||     FAIL: "is not set"     
   CONFIG_SECURITY_DMESG_RESTRICT         |      y      |    my    |  self_protection   ||     FAIL: "is not set"     
   CONFIG_STATIC_USERMODEHELPER           |      y      |    my    |  self_protection   ||     FAIL: "is not set"     
   CONFIG_SECURITY_LOADPIN                |      y      |    my    |  self_protection   ||     FAIL: "is not set"     
+  CONFIG_RESET_ATTACK_MITIGATION         |      y      |    my    |  self_protection   ||             OK             
   CONFIG_PAGE_POISONING_NO_SANITY        | is not set  |    my    |  self_protection   ||       OK: not found        
   CONFIG_PAGE_POISONING_ZERO             | is not set  |    my    |  self_protection   ||       OK: not found        
   CONFIG_SLAB_MERGE_DEFAULT              | is not set  |    my    |  self_protection   ||         FAIL: "y"