projects
/
kconfig-hardened-check.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
|
inline
| side by side (from parent 1:
f83f122
)
Update KSPP recommendations
author
Alexander Popov
<alex.popov@linux.com>
Fri, 20 Mar 2020 19:48:15 +0000
(22:48 +0300)
committer
Alexander Popov
<alex.popov@linux.com>
Fri, 20 Mar 2020 19:48:15 +0000
(22:48 +0300)
config_files/kspp-recommendations/kspp-recommendations-arm.config
patch
|
blob
|
history
config_files/kspp-recommendations/kspp-recommendations-arm64.config
patch
|
blob
|
history
config_files/kspp-recommendations/kspp-recommendations-x86-32.config
patch
|
blob
|
history
config_files/kspp-recommendations/kspp-recommendations-x86-64.config
patch
|
blob
|
history
diff --git
a/config_files/kspp-recommendations/kspp-recommendations-arm.config
b/config_files/kspp-recommendations/kspp-recommendations-arm.config
index 9aaceb9b1e053bbefd2c9b957c19a2a4f6cb4e18..3c6c0375e0b86b63e68b9d4f5e99b8b621c60ac1 100644
(file)
--- a/
config_files/kspp-recommendations/kspp-recommendations-arm.config
+++ b/
config_files/kspp-recommendations/kspp-recommendations-arm.config
@@
-1,5
+1,5
@@
# CONFIGs
# CONFIGs
-# Linux/arm
4.20
.0 Kernel Configuration
+# Linux/arm
5.4
.0 Kernel Configuration
# Report BUG() conditions and kill the offending process.
CONFIG_BUG=y
# Report BUG() conditions and kill the offending process.
CONFIG_BUG=y
diff --git
a/config_files/kspp-recommendations/kspp-recommendations-arm64.config
b/config_files/kspp-recommendations/kspp-recommendations-arm64.config
index b3976733bb94c8df1c2fd831591f167d0f1ed80f..013263c978684c47f2a2d35c9e342ce99d1d9b7e 100644
(file)
--- a/
config_files/kspp-recommendations/kspp-recommendations-arm64.config
+++ b/
config_files/kspp-recommendations/kspp-recommendations-arm64.config
@@
-1,5
+1,5
@@
# CONFIGs
# CONFIGs
-# Linux/arm64
4.20
.0 Kernel Configuration
+# Linux/arm64
5.4
.0 Kernel Configuration
# Report BUG() conditions and kill the offending process.
CONFIG_BUG=y
# Report BUG() conditions and kill the offending process.
CONFIG_BUG=y
diff --git
a/config_files/kspp-recommendations/kspp-recommendations-x86-32.config
b/config_files/kspp-recommendations/kspp-recommendations-x86-32.config
index 04bdced02a9fdf93fc7ff456cfcd583c3cb6a29e..477d75c1dd1608cdc313bb723986657518df10fd 100644
(file)
--- a/
config_files/kspp-recommendations/kspp-recommendations-x86-32.config
+++ b/
config_files/kspp-recommendations/kspp-recommendations-x86-32.config
@@
-1,5
+1,5
@@
# CONFIGs
# CONFIGs
-# Linux/i386
4.20
.0 Kernel Configuration
+# Linux/i386
5.4
.0 Kernel Configuration
# Report BUG() conditions and kill the offending process.
CONFIG_BUG=y
# Report BUG() conditions and kill the offending process.
CONFIG_BUG=y
@@
-165,3
+165,10
@@
CONFIG_DEFAULT_MMAP_MIN_ADDR=65536
# Randomize position of kernel.
CONFIG_RANDOMIZE_BASE=y
# Randomize position of kernel.
CONFIG_RANDOMIZE_BASE=y
+# Enable Kernel Page Table Isolation to remove an entire class of cache timing side-channels.
+CONFIG_PAGE_TABLE_ISOLATION=y
+
+# Don't allow for 16-bit program emulation and associated LDT tricks.
+# CONFIG_MODIFY_LDT_SYSCALL is not set
+
+
diff --git
a/config_files/kspp-recommendations/kspp-recommendations-x86-64.config
b/config_files/kspp-recommendations/kspp-recommendations-x86-64.config
index a0ba8822ee28a94a1c59e7beeb617efa8d647344..de19f33027526b6f7d305c23d97fd82b17f16146 100644
(file)
--- a/
config_files/kspp-recommendations/kspp-recommendations-x86-64.config
+++ b/
config_files/kspp-recommendations/kspp-recommendations-x86-64.config
@@
-1,5
+1,5
@@
# CONFIGs
# CONFIGs
-# Linux/x86_64
4.20
.0 Kernel Configuration
+# Linux/x86_64
5.4
.0 Kernel Configuration
# Report BUG() conditions and kill the offending process.
CONFIG_BUG=y
# Report BUG() conditions and kill the offending process.
CONFIG_BUG=y
@@
-149,8
+149,7
@@
CONFIG_GCC_PLUGIN_STACKLEAK=y
# use with caution or also use CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE=y
CONFIG_GCC_PLUGIN_RANDSTRUCT=y
# use with caution or also use CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE=y
CONFIG_GCC_PLUGIN_RANDSTRUCT=y
-
-#x86_64
+# x86_64
# Full 64-bit means PAE and NX bit.
CONFIG_X86_64=y
# Full 64-bit means PAE and NX bit.
CONFIG_X86_64=y