X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig_hardened_check%2Fconfig_files%2Fkspp-recommendations%2Fkspp-recommendations-arm.config;fp=kconfig_hardened_check%2Fconfig_files%2Fkspp-recommendations%2Fkspp-recommendations-arm.config;h=0000000000000000000000000000000000000000;hb=475291b45f54422c5c0d4e6e49b69f158f62c2d1;hp=d4493e7eaa3bf932d40904d91f0777afc7366d8e;hpb=593bdbbca0064f2a9042e082569bb5bd89c64098;p=kconfig-hardened-check.git diff --git a/kconfig_hardened_check/config_files/kspp-recommendations/kspp-recommendations-arm.config b/kconfig_hardened_check/config_files/kspp-recommendations/kspp-recommendations-arm.config deleted file mode 100644 index d4493e7..0000000 --- a/kconfig_hardened_check/config_files/kspp-recommendations/kspp-recommendations-arm.config +++ /dev/null @@ -1,244 +0,0 @@ -# Linux/arm 6.1.5 Kernel Configuration - -# Report BUG() conditions and kill the offending process. -CONFIG_BUG=y - -# Make sure kernel page tables have safe permissions. -CONFIG_STRICT_KERNEL_RWX=y - -# Report any dangerous memory permissions (not available on all archs). -CONFIG_DEBUG_WX=y - -# Use -fstack-protector-strong (gcc 4.9+) for best stack canary coverage. -# Prior to v4.18, these are: -# CONFIG_CC_STACKPROTECTOR=y -# CONFIG_CC_STACKPROTECTOR_STRONG=y -CONFIG_STACKPROTECTOR=y -CONFIG_STACKPROTECTOR_STRONG=y - -# Do not allow direct physical memory access (but if you must have it, at least enable STRICT mode...) -# CONFIG_DEVMEM is not set -CONFIG_STRICT_DEVMEM=y -CONFIG_IO_STRICT_DEVMEM=y - -# Provides some protections against SYN flooding. -CONFIG_SYN_COOKIES=y - -# Perform additional validation of various commonly targeted structures. -CONFIG_DEBUG_CREDENTIALS=y -CONFIG_DEBUG_NOTIFIERS=y -CONFIG_DEBUG_LIST=y -CONFIG_DEBUG_SG=y -CONFIG_DEBUG_VIRTUAL=y -CONFIG_BUG_ON_DATA_CORRUPTION=y -CONFIG_SCHED_STACK_END_CHECK=y - -# Provide userspace with seccomp BPF API for syscall attack surface reduction. -CONFIG_SECCOMP=y -CONFIG_SECCOMP_FILTER=y - -# Make sure line disciplines can't be autoloaded (since v5.1). -# CONFIG_LDISC_AUTOLOAD is not set - -# Provide userspace with ptrace ancestry protections. -# Make sure that "yama" is also present in the "CONFIG_LSM=yama,..." list. -CONFIG_SECURITY=y -CONFIG_SECURITY_YAMA=y - -# Provide userspace with Landlock MAC interface. -# Make sure that "landlock" is also present in the "CONFIG_LSM=landlock,..." list. -CONFIG_SECURITY_LANDLOCK=y - -# Make sure SELinux cannot be disabled trivially. -# CONFIG_SECURITY_SELINUX_BOOTPARAM is not set -# CONFIG_SECURITY_SELINUX_DEVELOP is not set -# CONFIG_SECURITY_WRITABLE_HOOKS is not set - -# Enable "lockdown" LSM for bright line between the root user and kernel memory. -CONFIG_SECURITY_LOCKDOWN_LSM=y -CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y -CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY=y - -# Perform usercopy bounds checking. (And disable fallback to gain full whitelist enforcement.) -CONFIG_HARDENED_USERCOPY=y -# CONFIG_HARDENED_USERCOPY_FALLBACK is not set -# CONFIG_HARDENED_USERCOPY_PAGESPAN is not set - -# Randomize allocator freelists, harden metadata. -CONFIG_SLAB_FREELIST_RANDOM=y -CONFIG_SLAB_FREELIST_HARDENED=y - -# Randomize high-order page allocation freelist. -CONFIG_SHUFFLE_PAGE_ALLOCATOR=y - -# Allow allocator validation checking to be enabled (see "slub_debug=P" below). -CONFIG_SLUB_DEBUG=y - -# Wipe higher-level memory allocations when they are freed (needs "page_poison=1" command line below). -# (If you can afford even more performance penalty, leave CONFIG_PAGE_POISONING_NO_SANITY=n) -CONFIG_PAGE_POISONING=y -CONFIG_PAGE_POISONING_NO_SANITY=y -CONFIG_PAGE_POISONING_ZERO=y - -# Wipe slab and page allocations (since v5.3) -# Instead of "slub_debug=P" and "page_poison=1", a single place can control memory allocation wiping now. -# The init_on_free is only needed if there is concern about minimizing stale data lifetime. -CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y -CONFIG_INIT_ON_FREE_DEFAULT_ON=y - -# Initialize all stack variables on function entry. (Clang and GCC 12+ builds only. For earlier GCC, see CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y below) -CONFIG_INIT_STACK_ALL_ZERO=y - -# Adds guard pages to kernel stacks (not all architectures support this yet). -CONFIG_VMAP_STACK=y - -# Perform extensive checks on reference counting. -CONFIG_REFCOUNT_FULL=y - -# Check for memory copies that might overflow a structure in str*() and mem*() functions both at build-time and run-time. -CONFIG_FORTIFY_SOURCE=y - -# Avoid kernel memory address exposures via dmesg (sets sysctl kernel.dmesg_restrict initial value to 1) -CONFIG_SECURITY_DMESG_RESTRICT=y - -# Enable trapping bounds checking of array indexes (since v5.11). All the other UBSAN checks should be disabled. -CONFIG_UBSAN=y -CONFIG_UBSAN_TRAP=y -CONFIG_UBSAN_BOUNDS=y -CONFIG_UBSAN_SANITIZE_ALL=y -# CONFIG_UBSAN_SHIFT is not set -# CONFIG_UBSAN_DIV_ZERO is not set -# CONFIG_UBSAN_UNREACHABLE is not set -# CONFIG_UBSAN_BOOL is not set -# CONFIG_UBSAN_ENUM is not set -# CONFIG_UBSAN_ALIGNMENT is not set -# This is only available on Clang builds, and is likely already enabled if CONFIG_UBSAN_BOUNDS=y is set: -CONFIG_UBSAN_LOCAL_BOUNDS=y - -# Enable sampling-based overflow detection (since v5.12). This is similar to KASAN coverage, but with almost zero runtime overhead. -CONFIG_KFENCE=y - -# Randomize kernel stack offset on syscall entry (since v5.13). -CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y - -# Do not ignore compile-time warnings (since v5.15) -CONFIG_WERROR=y - -# Disable DMA between EFI hand-off and the kernel's IOMMU setup. -CONFIG_EFI_DISABLE_PCI_DMA=y - -# Force IOMMU TLB invalidation so devices will never be able to access stale data contents (or set "iommu.passthrough=0 iommu.strict=1" at boot) -CONFIG_IOMMU_SUPPORT=y -CONFIG_IOMMU_DEFAULT_DMA_STRICT=y - -# Enable feeding RNG entropy from TPM, if available. -CONFIG_HW_RANDOM_TPM=y - -# Get as much entropy as possible from external sources. The Chacha mixer isn't vulnerable to injected entropy, so even -# malicious sources should not cause problems. -CONFIG_RANDOM_TRUST_BOOTLOADER=y -CONFIG_RANDOM_TRUST_CPU=y - -# Make scheduler aware of SMT Cores. Program needs to opt-in to using this feature with prctl(PR_SCHED_CORE). -CONFIG_SCHED_CORE=y - -# Wipe all caller-used registers on exit from the function (reduces available ROP gadgets and -# minimizes stale data in registers). (Since v5.15) -CONFIG_ZERO_CALL_USED_REGS=y - -# Wipe RAM at reboot via EFI. -# For more details, see: -# https://trustedcomputinggroup.org/resource/pc-client-work-group-platform-reset-attack-mitigation-specification/ -# https://bugzilla.redhat.com/show_bug.cgi?id=1532058 -CONFIG_RESET_ATTACK_MITIGATION=y - -# This needs userspace support, and will break "regular" distros. See: https://github.com/tych0/huldufolk -CONFIG_STATIC_USERMODEHELPER=y - -# Dangerous; enabling this allows direct physical memory writing. -# CONFIG_ACPI_CUSTOM_METHOD is not set - -# Dangerous; enabling this disables brk ASLR. -# CONFIG_COMPAT_BRK is not set - -# Dangerous; enabling this allows direct kernel memory writing. -# CONFIG_DEVKMEM is not set - -# Dangerous; exposes kernel text image layout. -# CONFIG_PROC_KCORE is not set - -# Dangerous; enabling this disables VDSO ASLR. -# CONFIG_COMPAT_VDSO is not set - -# Dangerous; enabling this allows replacement of running kernel. -# CONFIG_KEXEC is not set - -# Dangerous; enabling this allows replacement of running kernel. -# CONFIG_HIBERNATION is not set - -# Prior to v4.1, assists heap memory attacks; best to keep interface disabled. -# CONFIG_INET_DIAG is not set - -# Easily confused by misconfigured userspace, keep off. -# CONFIG_BINFMT_MISC is not set - -# Use the modern PTY interface (devpts) only. -# CONFIG_LEGACY_PTYS is not set - -# If SELinux can be disabled at runtime, the LSM structures cannot be read-only; keep off. -# CONFIG_SECURITY_SELINUX_DISABLE is not set - -# Reboot devices immediately if kernel experiences an Oops. -CONFIG_PANIC_ON_OOPS=y -CONFIG_PANIC_TIMEOUT=-1 - -# Keep root from altering kernel memory via loadable modules. -# CONFIG_MODULES is not set - -# But if CONFIG_MODULE=y is needed, at least they must be signed with a per-build key. -CONFIG_STRICT_MODULE_RWX=y -CONFIG_MODULE_SIG=y -CONFIG_MODULE_SIG_FORCE=y -CONFIG_MODULE_SIG_ALL=y -CONFIG_MODULE_SIG_SHA512=y -CONFIG_MODULE_SIG_HASH="sha512" -CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" - -# GCC plugins - -# Enable GCC Plugins -CONFIG_GCC_PLUGINS=y - -# Gather additional entropy at boot time for systems that may not have appropriate entropy sources. -CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y - -# Force all structures to be initialized before they are passed to other functions. -# When building with GCC: -CONFIG_GCC_PLUGIN_STRUCTLEAK=y -CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y - -# Wipe stack contents on syscall exit (reduces stale data lifetime in stack) -CONFIG_GCC_PLUGIN_STACKLEAK=y -# CONFIG_STACKLEAK_METRICS is not set -# CONFIG_STACKLEAK_RUNTIME_DISABLE is not set - -# Randomize the layout of system structures. This may have dramatic performance impact, so -# use with caution or also use CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE=y -CONFIG_GCC_PLUGIN_RANDSTRUCT=y -# CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE is not set - -# arm - -CONFIG_ARM=y - -# Disallow allocating the first 32k of memory (cannot be 64k due to ARM loader). -CONFIG_DEFAULT_MMAP_MIN_ADDR=32768 - -# For maximal userspace memory area (and maximum ASLR). -CONFIG_VMSPLIT_3G=y - -# Make sure PXN/PAN emulation is enabled. -CONFIG_CPU_SW_DOMAIN_PAN=y - -# Dangerous; old interfaces and needless additional attack surface. -# CONFIG_OABI_COMPAT is not set