X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=README.md;h=e73ebff6a3216bfce4c83f7bd465d211d5c4c698;hb=6b72b6c171069049ad87d7d424c65703820dda4b;hp=5f12164c9da9f33acc2ad939382eeaefa966c396;hpb=08e4957827d9b60e874986156c030f2a97058d5c;p=kconfig-hardened-check.git

diff --git a/README.md b/README.md
index 5f12164..e73ebff 100644
--- a/README.md
+++ b/README.md
@@ -10,8 +10,10 @@ But nobody likes checking configs manually. So let the computers do their job!
 
 __kconfig-hardened-check.py__ helps me to check the Linux kernel Kconfig option list
 against my hardening preferences, which are based on the
-[KSPP recommended settings][1] and last public [grsecurity][2] patch (options
-which they disable).
+
+  - [KSPP recommended settings][1],
+  - [CLIP OS kernel configuration][2],
+  - last public [grsecurity][3] patch (options which they disable).
 
 Please don't cry if my Python code looks like C. I'm just a kernel developer.
 
@@ -26,8 +28,8 @@ Please don't cry if my Python code looks like C. I'm just a kernel developer.
 
 ### Usage
 ```
-#usage: kconfig-hardened-check.py [-h] [-p {X86_64,X86_32,ARM64,ARM}]
-                                 [-c CONFIG] [--debug]
+usage: kconfig-hardened-check.py [-h] [-p {X86_64,X86_32,ARM64,ARM}]
+                                 [-c CONFIG] [--debug] [--json]
 
 Checks the hardening options in the Linux kernel config
 
@@ -38,6 +40,7 @@ optional arguments:
   -c CONFIG, --config CONFIG
                         check the config_file against these preferences
   --debug               enable internal debug mode
+  --json                print results in JSON format
 
 ```
 
@@ -93,18 +96,17 @@ CONFIG_DEBUG_VIRTUAL                    |      y      |  clipos  |  self_protect
 CONFIG_STATIC_USERMODEHELPER            |      y      |  clipos  |  self_protection   ||     FAIL: "is not set"     
 CONFIG_SLAB_MERGE_DEFAULT               | is not set  |  clipos  |  self_protection   ||         FAIL: "y"          
 CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE| is not set  |  clipos  |  self_protection   ||FAIL: CONFIG_GCC_PLUGIN_RANDSTRUCT is needed
+CONFIG_GCC_PLUGIN_STACKLEAK             |      y      |  clipos  |  self_protection   ||      FAIL: not found       
+CONFIG_STACKLEAK_METRICS                | is not set  |  clipos  |  self_protection   ||FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is needed
+CONFIG_STACKLEAK_RUNTIME_DISABLE        | is not set  |  clipos  |  self_protection   ||FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is needed
 CONFIG_RANDOM_TRUST_CPU                 | is not set  |  clipos  |  self_protection   ||       OK: not found        
 CONFIG_MICROCODE                        |      y      |  clipos  |  self_protection   ||             OK             
-CONFIG_X86_MSR                          |      y      |  clipos  |  self_protection   ||         FAIL: "m"          
 CONFIG_IOMMU_SUPPORT                    |      y      |  clipos  |  self_protection   ||             OK             
 CONFIG_INTEL_IOMMU                      |      y      |  clipos  |  self_protection   ||             OK             
 CONFIG_INTEL_IOMMU_SVM                  |      y      |  clipos  |  self_protection   ||             OK             
 CONFIG_INTEL_IOMMU_DEFAULT_ON           |      y      |  clipos  |  self_protection   ||     FAIL: "is not set"     
 CONFIG_AMD_IOMMU                        |      y      |    my    |  self_protection   ||             OK             
 CONFIG_AMD_IOMMU_V2                     |      y      |    my    |  self_protection   ||         FAIL: "m"          
-CONFIG_GCC_PLUGIN_STACKLEAK             |      y      |    my    |  self_protection   ||      FAIL: not found       
-CONFIG_STACKLEAK_METRICS                | is not set  |    my    |  self_protection   ||FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is needed
-CONFIG_STACKLEAK_RUNTIME_DISABLE        | is not set  |    my    |  self_protection   ||FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is needed
 CONFIG_SLUB_DEBUG_ON                    |      y      |    my    |  self_protection   ||     FAIL: "is not set"     
 CONFIG_SECURITY_LOADPIN                 |      y      |    my    |  self_protection   ||     FAIL: "is not set"     
 CONFIG_RESET_ATTACK_MITIGATION          |      y      |    my    |  self_protection   ||             OK             
@@ -161,16 +163,17 @@ CONFIG_KALLSYMS                         | is not set  |  clipos  | cut_attack_su
 CONFIG_X86_VSYSCALL_EMULATION           | is not set  |  clipos  | cut_attack_surface ||         FAIL: "y"          
 CONFIG_MAGIC_SYSRQ                      | is not set  |  clipos  | cut_attack_surface ||         FAIL: "y"          
 CONFIG_KEXEC_FILE                       | is not set  |  clipos  | cut_attack_surface ||         FAIL: "y"          
+CONFIG_USER_NS                          | is not set  |  clipos  | cut_attack_surface ||         FAIL: "y"          
+CONFIG_LDISC_AUTOLOAD                   | is not set  |  clipos  | cut_attack_surface ||       OK: not found        
 CONFIG_MMIOTRACE                        | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
 CONFIG_LIVEPATCH                        | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
-CONFIG_USER_NS                          | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
 CONFIG_IP_DCCP                          | is not set  |    my    | cut_attack_surface ||         FAIL: "m"          
 CONFIG_IP_SCTP                          | is not set  |    my    | cut_attack_surface ||         FAIL: "m"          
 CONFIG_FTRACE                           | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
 CONFIG_BPF_JIT                          | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
-CONFIG_ARCH_MMAP_RND_BITS               |     32      |    my    |userspace_protection||         FAIL: "28"         
+CONFIG_ARCH_MMAP_RND_BITS               |     32      |  clipos  |userspace_protection||         FAIL: "28"         
 
-[+] config check is finished: 'OK' - 49 / 'FAIL' - 71
+[+] config check is finished: 'OK' - 50 / 'FAIL' - 70
 ```
 
 
@@ -196,4 +199,5 @@ try to install `gcc-7-plugin-dev` package, it should help.
 
 
 [1]: http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings
-[2]: https://grsecurity.net/
+[2]: https://docs.clip-os.org/clipos/kernel.html#configuration
+[3]: https://grsecurity.net/