From: Alexander Popov Date: Mon, 14 Jan 2019 22:19:44 +0000 (+0300) Subject: Change 'decision' to 'grsecurity' for their additional 'cut_attack_surface' recommend... X-Git-Tag: v0.5.2~61^2~2 X-Git-Url: https://jxself.org/git/?a=commitdiff_plain;h=654b737565cf3d87b759660dba1a5dd725bc2961;p=kconfig-hardened-check.git Change 'decision' to 'grsecurity' for their additional 'cut_attack_surface' recommendations --- diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py index c7b156f..49d5edd 100755 --- a/kconfig-hardened-check.py +++ b/kconfig-hardened-check.py @@ -186,11 +186,6 @@ def construct_checklist(): checklist.append(OptCheck('COMPAT_BRK', 'is not set', 'kspp', 'cut_attack_surface')) checklist.append(OptCheck('DEVKMEM', 'is not set', 'kspp', 'cut_attack_surface')) checklist.append(OptCheck('COMPAT_VDSO', 'is not set', 'kspp', 'cut_attack_surface')) - checklist.append(OptCheck('X86_PTDUMP', 'is not set', 'ubuntu18', 'cut_attack_surface')) - checklist.append(OptCheck('ZSMALLOC_STAT', 'is not set', 'ubuntu18', 'cut_attack_surface')) - checklist.append(OptCheck('PAGE_OWNER', 'is not set', 'ubuntu18', 'cut_attack_surface')) - checklist.append(OptCheck('DEBUG_KMEMLEAK', 'is not set', 'ubuntu18', 'cut_attack_surface')) - checklist.append(OptCheck('BINFMT_AOUT', 'is not set', 'ubuntu18', 'cut_attack_surface')) checklist.append(OptCheck('MMIOTRACE_TEST', 'is not set', 'ubuntu18', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL checklist.append(OptCheck('BINFMT_MISC', 'is not set', 'kspp', 'cut_attack_surface')) checklist.append(OptCheck('INET_DIAG', 'is not set', 'kspp', 'cut_attack_surface')) @@ -202,6 +197,11 @@ def construct_checklist(): checklist.append(OptCheck('MODIFY_LDT_SYSCALL', 'is not set', 'kspp', 'cut_attack_surface')) checklist.append(OptCheck('HIBERNATION', 'is not set', 'kspp', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL + checklist.append(OptCheck('X86_PTDUMP', 'is not set', 'grsecurity', 'cut_attack_surface')) + checklist.append(OptCheck('ZSMALLOC_STAT', 'is not set', 'grsecurity', 'cut_attack_surface')) + checklist.append(OptCheck('PAGE_OWNER', 'is not set', 'grsecurity', 'cut_attack_surface')) + checklist.append(OptCheck('DEBUG_KMEMLEAK', 'is not set', 'grsecurity', 'cut_attack_surface')) + checklist.append(OptCheck('BINFMT_AOUT', 'is not set', 'grsecurity', 'cut_attack_surface')) checklist.append(OptCheck('KPROBES', 'is not set', 'grsecurity', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL checklist.append(OptCheck('UPROBES', 'is not set', 'grsecurity', 'cut_attack_surface')) checklist.append(OptCheck('GENERIC_TRACER', 'is not set', 'grsecurity', 'cut_attack_surface'))