Pretty printing

diff --git a/README.md b/README.md
index 2780cf3a54a55dacca436c053807ff0e57e71b9f..b0074b691d3d9d58af15254ca39a6d9c72d187e3 100644 (file)
--- a/README.md
+++ b/README.md
@@ -52,131 +52,131 @@ optional arguments:
 [+] Trying to detect architecture in "config_files/distros/ubuntu-bionic-generic.config"...
 [+] Detected architecture: X86_64
 [+] Checking "config_files/distros/ubuntu-bionic-generic.config" against hardening preferences...
-                 option name                 | desired val | decision |       reason       ||        check result        
+                 option name                 | desired val | decision |       reason       |   check result
 =========================================================================================================================
-CONFIG_BUG                                   |      y      |defconfig |  self_protection   ||             OK             
-CONFIG_STRICT_KERNEL_RWX                     |      y      |defconfig |  self_protection   ||             OK             
-CONFIG_STACKPROTECTOR_STRONG                 |      y      |defconfig |  self_protection   ||OK: CONFIG_CC_STACKPROTECTOR_STRONG "y"
-CONFIG_SLUB_DEBUG                            |      y      |defconfig |  self_protection   ||             OK             
-CONFIG_STRICT_MODULE_RWX                     |      y      |defconfig |  self_protection   ||             OK             
-CONFIG_MICROCODE                             |      y      |defconfig |  self_protection   ||             OK             
-CONFIG_RETPOLINE                             |      y      |defconfig |  self_protection   ||             OK             
-CONFIG_X86_SMAP                              |      y      |defconfig |  self_protection   ||             OK             
-CONFIG_X86_UMIP                              |      y      |defconfig |  self_protection   ||OK: CONFIG_X86_INTEL_UMIP "y"
-CONFIG_IOMMU_SUPPORT                         |      y      |defconfig |  self_protection   ||             OK             
-CONFIG_SYN_COOKIES                           |      y      |defconfig |  self_protection   ||             OK             
-CONFIG_PAGE_TABLE_ISOLATION                  |      y      |defconfig |  self_protection   ||             OK             
-CONFIG_RANDOMIZE_MEMORY                      |      y      |defconfig |  self_protection   ||             OK             
-CONFIG_INTEL_IOMMU                           |      y      |defconfig |  self_protection   ||             OK             
-CONFIG_AMD_IOMMU                             |      y      |defconfig |  self_protection   ||             OK             
-CONFIG_VMAP_STACK                            |      y      |defconfig |  self_protection   ||             OK             
-CONFIG_RANDOMIZE_BASE                        |      y      |defconfig |  self_protection   ||             OK             
-CONFIG_THREAD_INFO_IN_TASK                   |      y      |defconfig |  self_protection   ||             OK             
-CONFIG_BUG_ON_DATA_CORRUPTION                |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"     
-CONFIG_DEBUG_WX                              |      y      |   kspp   |  self_protection   ||             OK             
-CONFIG_SCHED_STACK_END_CHECK                 |      y      |   kspp   |  self_protection   ||             OK             
-CONFIG_SLAB_FREELIST_HARDENED                |      y      |   kspp   |  self_protection   ||             OK             
-CONFIG_SLAB_FREELIST_RANDOM                  |      y      |   kspp   |  self_protection   ||             OK             
-CONFIG_SHUFFLE_PAGE_ALLOCATOR                |      y      |   kspp   |  self_protection   ||      FAIL: not found       
-CONFIG_FORTIFY_SOURCE                        |      y      |   kspp   |  self_protection   ||             OK             
-CONFIG_GCC_PLUGINS                           |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"     
-CONFIG_GCC_PLUGIN_RANDSTRUCT                 |      y      |   kspp   |  self_protection   ||      FAIL: not found       
-CONFIG_GCC_PLUGIN_LATENT_ENTROPY             |      y      |   kspp   |  self_protection   ||      FAIL: not found       
-CONFIG_DEBUG_LIST                            |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"     
-CONFIG_DEBUG_SG                              |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"     
-CONFIG_DEBUG_CREDENTIALS                     |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"     
-CONFIG_DEBUG_NOTIFIERS                       |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"     
-CONFIG_PAGE_POISONING                        |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"     
-CONFIG_HARDENED_USERCOPY                     |      y      |   kspp   |  self_protection   ||             OK             
-CONFIG_HARDENED_USERCOPY_FALLBACK            | is not set  |   kspp   |  self_protection   ||       OK: not found        
-CONFIG_MODULE_SIG                            |      y      |   kspp   |  self_protection   ||             OK             
-CONFIG_MODULE_SIG_ALL                        |      y      |   kspp   |  self_protection   ||             OK             
-CONFIG_MODULE_SIG_SHA512                     |      y      |   kspp   |  self_protection   ||             OK             
-CONFIG_MODULE_SIG_FORCE                      |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"     
-CONFIG_DEFAULT_MMAP_MIN_ADDR                 |    65536    |   kspp   |  self_protection   ||             OK             
-CONFIG_REFCOUNT_FULL                         |      y      |   kspp   |  self_protection   ||     FAIL: "is not set"     
-CONFIG_INIT_STACK_ALL                        |      y      |  clipos  |  self_protection   ||      FAIL: not found       
-CONFIG_INIT_ON_ALLOC_DEFAULT_ON              |      y      |  clipos  |  self_protection   ||      FAIL: not found       
-CONFIG_INIT_ON_FREE_DEFAULT_ON               |      y      |  clipos  |  self_protection   ||      FAIL: not found       
-CONFIG_SECURITY_DMESG_RESTRICT               |      y      |  clipos  |  self_protection   ||     FAIL: "is not set"     
-CONFIG_DEBUG_VIRTUAL                         |      y      |  clipos  |  self_protection   ||     FAIL: "is not set"     
-CONFIG_STATIC_USERMODEHELPER                 |      y      |  clipos  |  self_protection   ||     FAIL: "is not set"     
-CONFIG_SLAB_MERGE_DEFAULT                    | is not set  |  clipos  |  self_protection   ||         FAIL: "y"          
-CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE     | is not set  |  clipos  |  self_protection   ||FAIL: CONFIG_GCC_PLUGIN_RANDSTRUCT is needed
-CONFIG_GCC_PLUGIN_STACKLEAK                  |      y      |  clipos  |  self_protection   ||      FAIL: not found       
-CONFIG_STACKLEAK_METRICS                     | is not set  |  clipos  |  self_protection   ||FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is needed
-CONFIG_STACKLEAK_RUNTIME_DISABLE             | is not set  |  clipos  |  self_protection   ||FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is needed
-CONFIG_RANDOM_TRUST_CPU                      | is not set  |  clipos  |  self_protection   ||       OK: not found        
-CONFIG_INTEL_IOMMU_SVM                       |      y      |  clipos  |  self_protection   ||             OK             
-CONFIG_INTEL_IOMMU_DEFAULT_ON                |      y      |  clipos  |  self_protection   ||     FAIL: "is not set"     
-CONFIG_SLUB_DEBUG_ON                         |      y      |    my    |  self_protection   ||     FAIL: "is not set"     
-CONFIG_RESET_ATTACK_MITIGATION               |      y      |    my    |  self_protection   ||             OK             
-CONFIG_PAGE_POISONING_NO_SANITY              | is not set  |    my    |  self_protection   ||FAIL: CONFIG_PAGE_POISONING is needed
-CONFIG_PAGE_POISONING_ZERO                   | is not set  |    my    |  self_protection   ||FAIL: CONFIG_PAGE_POISONING is needed
-CONFIG_AMD_IOMMU_V2                          |      y      |    my    |  self_protection   ||         FAIL: "m"          
-CONFIG_SECURITY                              |      y      |defconfig |  security_policy   ||             OK             
-CONFIG_SECURITY_YAMA                         |      y      |   kspp   |  security_policy   ||             OK             
-CONFIG_SECURITY_LOADPIN                      |      y      |    my    |  security_policy   ||     FAIL: "is not set"     
-CONFIG_SECURITY_LOCKDOWN_LSM                 |      y      |    my    |  security_policy   ||      FAIL: not found       
-CONFIG_SECURITY_LOCKDOWN_LSM_EARLY           |      y      |    my    |  security_policy   ||      FAIL: not found       
-CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY|      y      |    my    |  security_policy   ||      FAIL: not found       
-CONFIG_SECCOMP                               |      y      |defconfig | cut_attack_surface ||             OK             
-CONFIG_SECCOMP_FILTER                        |      y      |defconfig | cut_attack_surface ||             OK             
-CONFIG_STRICT_DEVMEM                         |      y      |defconfig | cut_attack_surface ||             OK             
-CONFIG_MODULES                               | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
-CONFIG_DEVMEM                                | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
-CONFIG_IO_STRICT_DEVMEM                      |      y      |   kspp   | cut_attack_surface ||     FAIL: "is not set"     
-CONFIG_ACPI_CUSTOM_METHOD                    | is not set  |   kspp   | cut_attack_surface ||             OK             
-CONFIG_COMPAT_BRK                            | is not set  |   kspp   | cut_attack_surface ||             OK             
-CONFIG_DEVKMEM                               | is not set  |   kspp   | cut_attack_surface ||             OK             
-CONFIG_COMPAT_VDSO                           | is not set  |   kspp   | cut_attack_surface ||             OK             
-CONFIG_BINFMT_MISC                           | is not set  |   kspp   | cut_attack_surface ||         FAIL: "m"          
-CONFIG_INET_DIAG                             | is not set  |   kspp   | cut_attack_surface ||         FAIL: "m"          
-CONFIG_KEXEC                                 | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
-CONFIG_PROC_KCORE                            | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
-CONFIG_LEGACY_PTYS                           | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
-CONFIG_HIBERNATION                           | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
-CONFIG_LEGACY_VSYSCALL_NONE                  |      y      |   kspp   | cut_attack_surface ||     FAIL: "is not set"     
-CONFIG_IA32_EMULATION                        | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
-CONFIG_X86_X32                               | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
-CONFIG_MODIFY_LDT_SYSCALL                    | is not set  |   kspp   | cut_attack_surface ||         FAIL: "y"          
-CONFIG_X86_PTDUMP                            | is not set  |grsecurity| cut_attack_surface ||             OK             
-CONFIG_ZSMALLOC_STAT                         | is not set  |grsecurity| cut_attack_surface ||             OK             
-CONFIG_PAGE_OWNER                            | is not set  |grsecurity| cut_attack_surface ||             OK             
-CONFIG_DEBUG_KMEMLEAK                        | is not set  |grsecurity| cut_attack_surface ||             OK             
-CONFIG_BINFMT_AOUT                           | is not set  |grsecurity| cut_attack_surface ||       OK: not found        
-CONFIG_KPROBES                               | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
-CONFIG_UPROBES                               | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
-CONFIG_GENERIC_TRACER                        | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
-CONFIG_PROC_VMCORE                           | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
-CONFIG_PROC_PAGE_MONITOR                     | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
-CONFIG_USELIB                                | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
-CONFIG_CHECKPOINT_RESTORE                    | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
-CONFIG_USERFAULTFD                           | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
-CONFIG_HWPOISON_INJECT                       | is not set  |grsecurity| cut_attack_surface ||         FAIL: "m"          
-CONFIG_MEM_SOFT_DIRTY                        | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
-CONFIG_DEVPORT                               | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
-CONFIG_DEBUG_FS                              | is not set  |grsecurity| cut_attack_surface ||         FAIL: "y"          
-CONFIG_NOTIFIER_ERROR_INJECTION              | is not set  |grsecurity| cut_attack_surface ||         FAIL: "m"          
-CONFIG_ACPI_TABLE_UPGRADE                    | is not set  | lockdown | cut_attack_surface ||         FAIL: "y"          
-CONFIG_ACPI_APEI_EINJ                        | is not set  | lockdown | cut_attack_surface ||         FAIL: "m"          
-CONFIG_PROFILING                             | is not set  | lockdown | cut_attack_surface ||         FAIL: "y"          
-CONFIG_BPF_SYSCALL                           | is not set  | lockdown | cut_attack_surface ||         FAIL: "y"          
-CONFIG_MMIOTRACE_TEST                        | is not set  | lockdown | cut_attack_surface ||             OK             
-CONFIG_KSM                                   | is not set  |  clipos  | cut_attack_surface ||         FAIL: "y"          
-CONFIG_KALLSYMS                              | is not set  |  clipos  | cut_attack_surface ||         FAIL: "y"          
-CONFIG_X86_VSYSCALL_EMULATION                | is not set  |  clipos  | cut_attack_surface ||         FAIL: "y"          
-CONFIG_MAGIC_SYSRQ                           | is not set  |  clipos  | cut_attack_surface ||         FAIL: "y"          
-CONFIG_KEXEC_FILE                            | is not set  |  clipos  | cut_attack_surface ||         FAIL: "y"          
-CONFIG_USER_NS                               | is not set  |  clipos  | cut_attack_surface ||         FAIL: "y"          
-CONFIG_LDISC_AUTOLOAD                        | is not set  |  clipos  | cut_attack_surface ||       OK: not found        
-CONFIG_MMIOTRACE                             | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
-CONFIG_LIVEPATCH                             | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
-CONFIG_IP_DCCP                               | is not set  |    my    | cut_attack_surface ||         FAIL: "m"          
-CONFIG_IP_SCTP                               | is not set  |    my    | cut_attack_surface ||         FAIL: "m"          
-CONFIG_FTRACE                                | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
-CONFIG_BPF_JIT                               | is not set  |    my    | cut_attack_surface ||         FAIL: "y"          
-CONFIG_ARCH_MMAP_RND_BITS                    |     32      |  clipos  |userspace_protection||         FAIL: "28"         
+CONFIG_BUG                                   |      y      |defconfig |  self_protection   |   OK
+CONFIG_STRICT_KERNEL_RWX                     |      y      |defconfig |  self_protection   |   OK
+CONFIG_STACKPROTECTOR_STRONG                 |      y      |defconfig |  self_protection   |   OK: CONFIG_CC_STACKPROTECTOR_STRONG "y"
+CONFIG_SLUB_DEBUG                            |      y      |defconfig |  self_protection   |   OK
+CONFIG_STRICT_MODULE_RWX                     |      y      |defconfig |  self_protection   |   OK
+CONFIG_MICROCODE                             |      y      |defconfig |  self_protection   |   OK
+CONFIG_RETPOLINE                             |      y      |defconfig |  self_protection   |   OK
+CONFIG_X86_SMAP                              |      y      |defconfig |  self_protection   |   OK
+CONFIG_X86_UMIP                              |      y      |defconfig |  self_protection   |   OK: CONFIG_X86_INTEL_UMIP "y"
+CONFIG_IOMMU_SUPPORT                         |      y      |defconfig |  self_protection   |   OK
+CONFIG_SYN_COOKIES                           |      y      |defconfig |  self_protection   |   OK
+CONFIG_PAGE_TABLE_ISOLATION                  |      y      |defconfig |  self_protection   |   OK
+CONFIG_RANDOMIZE_MEMORY                      |      y      |defconfig |  self_protection   |   OK
+CONFIG_INTEL_IOMMU                           |      y      |defconfig |  self_protection   |   OK
+CONFIG_AMD_IOMMU                             |      y      |defconfig |  self_protection   |   OK
+CONFIG_VMAP_STACK                            |      y      |defconfig |  self_protection   |   OK
+CONFIG_RANDOMIZE_BASE                        |      y      |defconfig |  self_protection   |   OK
+CONFIG_THREAD_INFO_IN_TASK                   |      y      |defconfig |  self_protection   |   OK
+CONFIG_BUG_ON_DATA_CORRUPTION                |      y      |   kspp   |  self_protection   |   FAIL: "is not set"
+CONFIG_DEBUG_WX                              |      y      |   kspp   |  self_protection   |   OK
+CONFIG_SCHED_STACK_END_CHECK                 |      y      |   kspp   |  self_protection   |   OK
+CONFIG_SLAB_FREELIST_HARDENED                |      y      |   kspp   |  self_protection   |   OK
+CONFIG_SLAB_FREELIST_RANDOM                  |      y      |   kspp   |  self_protection   |   OK
+CONFIG_SHUFFLE_PAGE_ALLOCATOR                |      y      |   kspp   |  self_protection   |   FAIL: not found
+CONFIG_FORTIFY_SOURCE                        |      y      |   kspp   |  self_protection   |   OK
+CONFIG_GCC_PLUGINS                           |      y      |   kspp   |  self_protection   |   FAIL: "is not set"
+CONFIG_GCC_PLUGIN_RANDSTRUCT                 |      y      |   kspp   |  self_protection   |   FAIL: not found
+CONFIG_GCC_PLUGIN_LATENT_ENTROPY             |      y      |   kspp   |  self_protection   |   FAIL: not found
+CONFIG_DEBUG_LIST                            |      y      |   kspp   |  self_protection   |   FAIL: "is not set"
+CONFIG_DEBUG_SG                              |      y      |   kspp   |  self_protection   |   FAIL: "is not set"
+CONFIG_DEBUG_CREDENTIALS                     |      y      |   kspp   |  self_protection   |   FAIL: "is not set"
+CONFIG_DEBUG_NOTIFIERS                       |      y      |   kspp   |  self_protection   |   FAIL: "is not set"
+CONFIG_PAGE_POISONING                        |      y      |   kspp   |  self_protection   |   FAIL: "is not set"
+CONFIG_HARDENED_USERCOPY                     |      y      |   kspp   |  self_protection   |   OK
+CONFIG_HARDENED_USERCOPY_FALLBACK            | is not set  |   kspp   |  self_protection   |   OK: not found
+CONFIG_MODULE_SIG                            |      y      |   kspp   |  self_protection   |   OK
+CONFIG_MODULE_SIG_ALL                        |      y      |   kspp   |  self_protection   |   OK
+CONFIG_MODULE_SIG_SHA512                     |      y      |   kspp   |  self_protection   |   OK
+CONFIG_MODULE_SIG_FORCE                      |      y      |   kspp   |  self_protection   |   FAIL: "is not set"
+CONFIG_DEFAULT_MMAP_MIN_ADDR                 |    65536    |   kspp   |  self_protection   |   OK
+CONFIG_REFCOUNT_FULL                         |      y      |   kspp   |  self_protection   |   FAIL: "is not set"
+CONFIG_INIT_STACK_ALL                        |      y      |  clipos  |  self_protection   |   FAIL: not found
+CONFIG_INIT_ON_ALLOC_DEFAULT_ON              |      y      |  clipos  |  self_protection   |   FAIL: not found
+CONFIG_INIT_ON_FREE_DEFAULT_ON               |      y      |  clipos  |  self_protection   |   FAIL: not found
+CONFIG_SECURITY_DMESG_RESTRICT               |      y      |  clipos  |  self_protection   |   FAIL: "is not set"
+CONFIG_DEBUG_VIRTUAL                         |      y      |  clipos  |  self_protection   |   FAIL: "is not set"
+CONFIG_STATIC_USERMODEHELPER                 |      y      |  clipos  |  self_protection   |   FAIL: "is not set"
+CONFIG_SLAB_MERGE_DEFAULT                    | is not set  |  clipos  |  self_protection   |   FAIL: "y"
+CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE     | is not set  |  clipos  |  self_protection   |   FAIL: CONFIG_GCC_PLUGIN_RANDSTRUCT is needed
+CONFIG_GCC_PLUGIN_STACKLEAK                  |      y      |  clipos  |  self_protection   |   FAIL: not found
+CONFIG_STACKLEAK_METRICS                     | is not set  |  clipos  |  self_protection   |   FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is needed
+CONFIG_STACKLEAK_RUNTIME_DISABLE             | is not set  |  clipos  |  self_protection   |   FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is needed
+CONFIG_RANDOM_TRUST_CPU                      | is not set  |  clipos  |  self_protection   |   OK: not found
+CONFIG_INTEL_IOMMU_SVM                       |      y      |  clipos  |  self_protection   |   OK
+CONFIG_INTEL_IOMMU_DEFAULT_ON                |      y      |  clipos  |  self_protection   |   FAIL: "is not set"
+CONFIG_SLUB_DEBUG_ON                         |      y      |    my    |  self_protection   |   FAIL: "is not set"
+CONFIG_RESET_ATTACK_MITIGATION               |      y      |    my    |  self_protection   |   OK
+CONFIG_PAGE_POISONING_NO_SANITY              | is not set  |    my    |  self_protection   |   FAIL: CONFIG_PAGE_POISONING is needed
+CONFIG_PAGE_POISONING_ZERO                   | is not set  |    my    |  self_protection   |   FAIL: CONFIG_PAGE_POISONING is needed
+CONFIG_AMD_IOMMU_V2                          |      y      |    my    |  self_protection   |   FAIL: "m"
+CONFIG_SECURITY                              |      y      |defconfig |  security_policy   |   OK
+CONFIG_SECURITY_YAMA                         |      y      |   kspp   |  security_policy   |   OK
+CONFIG_SECURITY_LOADPIN                      |      y      |    my    |  security_policy   |   FAIL: "is not set"
+CONFIG_SECURITY_LOCKDOWN_LSM                 |      y      |    my    |  security_policy   |   FAIL: not found
+CONFIG_SECURITY_LOCKDOWN_LSM_EARLY           |      y      |    my    |  security_policy   |   FAIL: not found
+CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY|      y      |    my    |  security_policy   |   FAIL: not found
+CONFIG_SECCOMP                               |      y      |defconfig | cut_attack_surface |   OK
+CONFIG_SECCOMP_FILTER                        |      y      |defconfig | cut_attack_surface |   OK
+CONFIG_STRICT_DEVMEM                         |      y      |defconfig | cut_attack_surface |   OK
+CONFIG_MODULES                               | is not set  |   kspp   | cut_attack_surface |   FAIL: "y"
+CONFIG_DEVMEM                                | is not set  |   kspp   | cut_attack_surface |   FAIL: "y"
+CONFIG_IO_STRICT_DEVMEM                      |      y      |   kspp   | cut_attack_surface |   FAIL: "is not set"
+CONFIG_ACPI_CUSTOM_METHOD                    | is not set  |   kspp   | cut_attack_surface |   OK
+CONFIG_COMPAT_BRK                            | is not set  |   kspp   | cut_attack_surface |   OK
+CONFIG_DEVKMEM                               | is not set  |   kspp   | cut_attack_surface |   OK
+CONFIG_COMPAT_VDSO                           | is not set  |   kspp   | cut_attack_surface |   OK
+CONFIG_BINFMT_MISC                           | is not set  |   kspp   | cut_attack_surface |   FAIL: "m"
+CONFIG_INET_DIAG                             | is not set  |   kspp   | cut_attack_surface |   FAIL: "m"
+CONFIG_KEXEC                                 | is not set  |   kspp   | cut_attack_surface |   FAIL: "y"
+CONFIG_PROC_KCORE                            | is not set  |   kspp   | cut_attack_surface |   FAIL: "y"
+CONFIG_LEGACY_PTYS                           | is not set  |   kspp   | cut_attack_surface |   FAIL: "y"
+CONFIG_HIBERNATION                           | is not set  |   kspp   | cut_attack_surface |   FAIL: "y"
+CONFIG_LEGACY_VSYSCALL_NONE                  |      y      |   kspp   | cut_attack_surface |   FAIL: "is not set"
+CONFIG_IA32_EMULATION                        | is not set  |   kspp   | cut_attack_surface |   FAIL: "y"
+CONFIG_X86_X32                               | is not set  |   kspp   | cut_attack_surface |   FAIL: "y"
+CONFIG_MODIFY_LDT_SYSCALL                    | is not set  |   kspp   | cut_attack_surface |   FAIL: "y"
+CONFIG_X86_PTDUMP                            | is not set  |grsecurity| cut_attack_surface |   OK
+CONFIG_ZSMALLOC_STAT                         | is not set  |grsecurity| cut_attack_surface |   OK
+CONFIG_PAGE_OWNER                            | is not set  |grsecurity| cut_attack_surface |   OK
+CONFIG_DEBUG_KMEMLEAK                        | is not set  |grsecurity| cut_attack_surface |   OK
+CONFIG_BINFMT_AOUT                           | is not set  |grsecurity| cut_attack_surface |   OK: not found
+CONFIG_KPROBES                               | is not set  |grsecurity| cut_attack_surface |   FAIL: "y"
+CONFIG_UPROBES                               | is not set  |grsecurity| cut_attack_surface |   FAIL: "y"
+CONFIG_GENERIC_TRACER                        | is not set  |grsecurity| cut_attack_surface |   FAIL: "y"
+CONFIG_PROC_VMCORE                           | is not set  |grsecurity| cut_attack_surface |   FAIL: "y"
+CONFIG_PROC_PAGE_MONITOR                     | is not set  |grsecurity| cut_attack_surface |   FAIL: "y"
+CONFIG_USELIB                                | is not set  |grsecurity| cut_attack_surface |   FAIL: "y"
+CONFIG_CHECKPOINT_RESTORE                    | is not set  |grsecurity| cut_attack_surface |   FAIL: "y"
+CONFIG_USERFAULTFD                           | is not set  |grsecurity| cut_attack_surface |   FAIL: "y"
+CONFIG_HWPOISON_INJECT                       | is not set  |grsecurity| cut_attack_surface |   FAIL: "m"
+CONFIG_MEM_SOFT_DIRTY                        | is not set  |grsecurity| cut_attack_surface |   FAIL: "y"
+CONFIG_DEVPORT                               | is not set  |grsecurity| cut_attack_surface |   FAIL: "y"
+CONFIG_DEBUG_FS                              | is not set  |grsecurity| cut_attack_surface |   FAIL: "y"
+CONFIG_NOTIFIER_ERROR_INJECTION              | is not set  |grsecurity| cut_attack_surface |   FAIL: "m"
+CONFIG_ACPI_TABLE_UPGRADE                    | is not set  | lockdown | cut_attack_surface |   FAIL: "y"
+CONFIG_ACPI_APEI_EINJ                        | is not set  | lockdown | cut_attack_surface |   FAIL: "m"
+CONFIG_PROFILING                             | is not set  | lockdown | cut_attack_surface |   FAIL: "y"
+CONFIG_BPF_SYSCALL                           | is not set  | lockdown | cut_attack_surface |   FAIL: "y"
+CONFIG_MMIOTRACE_TEST                        | is not set  | lockdown | cut_attack_surface |   OK
+CONFIG_KSM                                   | is not set  |  clipos  | cut_attack_surface |   FAIL: "y"
+CONFIG_KALLSYMS                              | is not set  |  clipos  | cut_attack_surface |   FAIL: "y"
+CONFIG_X86_VSYSCALL_EMULATION                | is not set  |  clipos  | cut_attack_surface |   FAIL: "y"
+CONFIG_MAGIC_SYSRQ                           | is not set  |  clipos  | cut_attack_surface |   FAIL: "y"
+CONFIG_KEXEC_FILE                            | is not set  |  clipos  | cut_attack_surface |   FAIL: "y"
+CONFIG_USER_NS                               | is not set  |  clipos  | cut_attack_surface |   FAIL: "y"
+CONFIG_LDISC_AUTOLOAD                        | is not set  |  clipos  | cut_attack_surface |   OK: not found
+CONFIG_MMIOTRACE                             | is not set  |    my    | cut_attack_surface |   FAIL: "y"
+CONFIG_LIVEPATCH                             | is not set  |    my    | cut_attack_surface |   FAIL: "y"
+CONFIG_IP_DCCP                               | is not set  |    my    | cut_attack_surface |   FAIL: "m"
+CONFIG_IP_SCTP                               | is not set  |    my    | cut_attack_surface |   FAIL: "m"
+CONFIG_FTRACE                                | is not set  |    my    | cut_attack_surface |   FAIL: "y"
+CONFIG_BPF_JIT                               | is not set  |    my    | cut_attack_surface |   FAIL: "y"
+CONFIG_ARCH_MMAP_RND_BITS                    |     32      |  clipos  |userspace_hardening |   FAIL: "28"
 
 [+] config check is finished: 'OK' - 48 / 'FAIL' - 75
 ```

diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py
index 975c87446ff764b0059a1bb02c0445cc591b2866..f9f412ec0dfd3def104b258350e99341c75ed771 100755 (executable)
--- a/kconfig-hardened-check.py
+++ b/kconfig-hardened-check.py
@@ -382,11 +382,11 @@ def construct_checklist(checklist, arch):
         checklist.append(OptCheck('MODIFY_LDT_SYSCALL',   'is not set', 'my', 'cut_attack_surface'))
 
     if debug_mode or arch == 'ARM64':
-        checklist.append(OptCheck('ARM64_PTR_AUTH',       'y', 'defconfig', 'userspace_protection'))
+        checklist.append(OptCheck('ARM64_PTR_AUTH',       'y', 'defconfig', 'userspace_hardening'))
     if debug_mode or arch == 'X86_64' or arch == 'ARM64':
-        checklist.append(OptCheck('ARCH_MMAP_RND_BITS',   '32', 'clipos', 'userspace_protection'))
+        checklist.append(OptCheck('ARCH_MMAP_RND_BITS',   '32', 'clipos', 'userspace_hardening'))
     if debug_mode or arch == 'X86_32' or arch == 'ARM':
-        checklist.append(OptCheck('ARCH_MMAP_RND_BITS',   '16', 'my', 'userspace_protection'))
+        checklist.append(OptCheck('ARCH_MMAP_RND_BITS',   '16', 'my', 'userspace_hardening'))
 
 #   checklist.append(OptCheck('LKDTM',    'm', 'my', 'feature_test'))
 
@@ -406,7 +406,7 @@ def print_checklist(checklist, with_results):
     print('{:^45}|{:^13}|{:^10}|{:^20}'.format('option name', 'desired val', 'decision', 'reason'), end='')
     sep_line_len = 91
     if with_results:
-        print('||{:^28}'.format('check result'), end='')
+        print('|   {}'.format('check result'), end='')
         sep_line_len += 30
     print()
 
@@ -415,7 +415,7 @@ def print_checklist(checklist, with_results):
     for opt in checklist:
         print('CONFIG_{:<38}|{:^13}|{:^10}|{:^20}'.format(opt.name, opt.expected, opt.decision, opt.reason), end='')
         if with_results:
-            print('||{:^28}'.format(opt.result), end='')
+            print('|   {}'.format(opt.result), end='')
         print()
     print()