X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=README.md;h=95cd7013b712d7924db0a2aaf3dae16402e1edbe;hb=478e5f266df05b5f75badef59914c8b0e71e3e0e;hp=fe20cfe3391721ba8bab8495a9631c6eca9ea0cd;hpb=dd429b9bcd068e3b049677d020d0dd6f0ca1f5d3;p=kconfig-hardened-check.git diff --git a/README.md b/README.md index fe20cfe..95cd701 100644 --- a/README.md +++ b/README.md @@ -43,7 +43,6 @@ optional arguments: CONFIG_RETPOLINE | y | ubuntu18 | self_protection || OK CONFIG_X86_64 | y | ubuntu18 | self_protection || OK CONFIG_STRICT_KERNEL_RWX | y | ubuntu18 | self_protection || OK - CONFIG_STRICT_MODULE_RWX | y | ubuntu18 | self_protection || OK CONFIG_DEBUG_WX | y | ubuntu18 | self_protection || OK CONFIG_RANDOMIZE_BASE | y | ubuntu18 | self_protection || OK CONFIG_RANDOMIZE_MEMORY | y | ubuntu18 | self_protection || OK @@ -56,6 +55,7 @@ optional arguments: CONFIG_SLAB_FREELIST_RANDOM | y | ubuntu18 | self_protection || OK CONFIG_HARDENED_USERCOPY | y | ubuntu18 | self_protection || OK CONFIG_FORTIFY_SOURCE | y | ubuntu18 | self_protection || OK + CONFIG_STRICT_MODULE_RWX | y | ubuntu18 | self_protection || OK CONFIG_MODULE_SIG | y | ubuntu18 | self_protection || OK CONFIG_MODULE_SIG_ALL | y | ubuntu18 | self_protection || OK CONFIG_MODULE_SIG_SHA512 | y | ubuntu18 | self_protection || OK @@ -130,11 +130,16 @@ optional arguments: CONFIG_BPF_JIT | is not set | my | cut_attack_surface || FAIL: "y" CONFIG_BPF_SYSCALL | is not set | my | cut_attack_surface || FAIL: "y" CONFIG_ARCH_MMAP_RND_BITS | 32 | my |userspace_protection|| FAIL: "28" - CONFIG_LKDTM | m | my | feature_test || FAIL: "is not set" -[-] config check is NOT PASSED: 52 errors +[-] config check is NOT PASSED: 51 errors ``` + +N.B. If `CONFIG_GCC_PLUGIN*` options are automatically disabled during your kernel compilation, +that means that your gcc doesn't support plugins. For example, if you have `gcc-7` on Ubuntu, +try to install `gcc-7-plugin-dev` package, it should help. + + __Go and fix them all!__ [1]: http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings