X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=README.md;h=36ecedca4b562607a0cc74159ea757accc6cb1ce;hb=903b0fac650c6a5285b7ddbae3e693c2953a78b2;hp=e7e935698bb3d8ee1bb8b466a2e1a7140d1b50b3;hpb=032f67faaae08f120fda81eff042f996bfc3539c;p=kconfig-hardened-check.git
diff --git a/README.md b/README.md
index e7e9356..36ecedc 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
# kernel-hardening-checker
-__(formerly kconfig-hardened-check)__
+__(formerly kconfig-hardened-check)__
[![functional test](https://github.com/a13xp0p0v/kernel-hardening-checker/workflows/functional%20test/badge.svg)](https://github.com/a13xp0p0v/kernel-hardening-checker/actions/workflows/functional_test.yml)
[![functional test coverage](https://codecov.io/gh/a13xp0p0v/kernel-hardening-checker/graph/badge.svg?flag=functional_test)](https://codecov.io/gh/a13xp0p0v/kernel-hardening-checker)
[![engine unit-test](https://github.com/a13xp0p0v/kernel-hardening-checker/workflows/engine%20unit-test/badge.svg)](https://github.com/a13xp0p0v/kernel-hardening-checker/actions/workflows/engine_unit-test.yml)
@@ -68,9 +68,9 @@ Some Linux distributions also provide `kernel-hardening-checker` as a package.
## Usage
```
usage: kernel-hardening-checker [-h] [--version] [-m {verbose,json,show_ok,show_fail}]
- [-c CONFIG] [-l CMDLINE] [-s SYSCTL]
- [-p {X86_64,X86_32,ARM64,ARM}]
- [-g {X86_64,X86_32,ARM64,ARM}]
+ [-c CONFIG] [-l CMDLINE] [-s SYSCTL] [-v KERNEL_VERSION]
+ [-p {X86_64,X86_32,ARM64,ARM}]
+ [-g {X86_64,X86_32,ARM64,ARM}]
A tool for checking the security hardening options of the Linux kernel
@@ -88,6 +88,9 @@ options:
-s SYSCTL, --sysctl SYSCTL
check the security hardening options in the sysctl output file
(`sudo sysctl -a > file`)
+ -v KERNEL_VERSION, --kernel-version KERNEL_VERSION
+ extract the version from the kernel version file (contents of
+ /proc/version)
-p {X86_64,X86_32,ARM64,ARM}, --print {X86_64,X86_32,ARM64,ARM}
print the security hardening recommendations for the selected
microarchitecture
@@ -115,7 +118,7 @@ CONFIG_DEVMEM |kconfig| is not set | kspp |cut_att
## Example output for `Fedora 38` kernel configuration
```
-$ ./bin/kernel-hardening-checker -c kernel_hardening_checker/config_files/distros/fedora_38.config -l /proc/cmdline -s kernel_hardening_checker/config_files/distros/example_sysctls.txt
+$ ./bin/kernel-hardening-checker -c kernel_hardening_checker/config_files/distros/fedora_38.config -l /proc/cmdline -s kernel_hardening_checker/config_files/distros/example_sysctls.txt
[+] Kconfig file to check: kernel_hardening_checker/config_files/distros/fedora_38.config
[+] Kernel cmdline file to check: /proc/cmdline
[+] Sysctl output file to check: kernel_hardening_checker/config_files/distros/example_sysctls.txt
@@ -333,7 +336,6 @@ tsx_async_abort |cmdline| is not off |defconfig | self_p
srbds |cmdline| is not off |defconfig | self_protection | FAIL: is off, not found
mmio_stale_data |cmdline| is not off |defconfig | self_protection | FAIL: is off, not found
retbleed |cmdline| is not off |defconfig | self_protection | FAIL: is off, not found
-kpti |cmdline| is not off |defconfig | self_protection | FAIL: is off, not found
rodata |cmdline| on |defconfig | self_protection | OK: rodata is not found
nosmt |cmdline| is present | kspp | self_protection | FAIL: is not present
mitigations |cmdline| auto,nosmt | kspp | self_protection | FAIL: is not found
@@ -342,10 +344,10 @@ slub_merge |cmdline| is not set | kspp | self_p
slab_nomerge |cmdline| is present | kspp | self_protection | OK: CONFIG_SLAB_MERGE_DEFAULT is "is not set"
init_on_alloc |cmdline| 1 | kspp | self_protection | FAIL: is not found
init_on_free |cmdline| 1 | kspp | self_protection | FAIL: is not found
-iommu.strict |cmdline| 1 | kspp | self_protection | FAIL: is not found
-iommu.passthrough |cmdline| 0 | kspp | self_protection | OK: CONFIG_IOMMU_DEFAULT_PASSTHROUGH is "is not set"
hardened_usercopy |cmdline| 1 | kspp | self_protection | OK: CONFIG_HARDENED_USERCOPY is "y"
slab_common.usercopy_fallback |cmdline| 0 | kspp | self_protection | OK: CONFIG_HARDENED_USERCOPY_FALLBACK is not found
+iommu.strict |cmdline| 1 | kspp | self_protection | FAIL: is not found
+iommu.passthrough |cmdline| 0 | kspp | self_protection | OK: CONFIG_IOMMU_DEFAULT_PASSTHROUGH is "is not set"
randomize_kstack_offset |cmdline| 1 | kspp | self_protection | OK: CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT is "y"
pti |cmdline| on | kspp | self_protection | FAIL: is not found
page_alloc.shuffle |cmdline| 1 | clipos | self_protection | FAIL: is not found
@@ -363,10 +365,8 @@ kernel.kexec_load_disabled |sysctl | 1 | kspp |cut_att
user.max_user_namespaces |sysctl | 0 | kspp |cut_attack_surface| FAIL: "31021"
dev.tty.ldisc_autoload |sysctl | 0 | kspp |cut_attack_surface| FAIL: "1"
kernel.unprivileged_bpf_disabled |sysctl | 1 | kspp |cut_attack_surface| OK
-kernel.kptr_restrict |sysctl | 1 | kspp |cut_attack_surface| FAIL: "0"
-kernel.yama.ptrace_scope |sysctl | 1 | kspp |cut_attack_surface| FAIL: "0"
-[+] Config check is finished: 'OK' - 118 / 'FAIL' - 122
+[+] Config check is finished: 'OK' - 118 / 'FAIL' - 119
```
## Generating a Kconfig fragment with the security hardening options