Alexander Popov [Tue, 31 Mar 2020 11:34:38 +0000 (14:34 +0300)]
Rename some workflow steps
Alexander Popov [Mon, 30 Mar 2020 20:29:42 +0000 (23:29 +0300)]
Add more tests to increase coverage - III
Alexander Popov [Mon, 30 Mar 2020 17:11:00 +0000 (20:11 +0300)]
Add more tests to increase coverage - II
Alexander Popov [Mon, 30 Mar 2020 17:06:09 +0000 (20:06 +0300)]
Add more tests to increase coverage - I
Alexander Popov [Mon, 30 Mar 2020 16:08:29 +0000 (19:08 +0300)]
Collect coverage
Alexander Popov [Mon, 30 Mar 2020 13:36:14 +0000 (16:36 +0300)]
Count checked configs
Alexander Popov [Mon, 30 Mar 2020 12:04:26 +0000 (15:04 +0300)]
Check all configs automatically
Alexander Popov [Mon, 30 Mar 2020 11:53:55 +0000 (14:53 +0300)]
Revisit return values
Alexander Popov [Mon, 30 Mar 2020 09:51:26 +0000 (12:51 +0300)]
Create the github workflow for functional tests
Alexander Popov [Sat, 28 Mar 2020 20:58:29 +0000 (23:58 +0300)]
Fix the shebang to allow `./get-nix-kconfig.py`
Thanks to @Mic92
Refers to #27
Alexander Popov [Fri, 27 Mar 2020 20:25:02 +0000 (23:25 +0300)]
Add NixOS hardened kernel config
Alexander Popov [Thu, 26 Mar 2020 14:55:56 +0000 (17:55 +0300)]
Fix typo in README
Alexander Popov [Thu, 26 Mar 2020 13:57:54 +0000 (16:57 +0300)]
Add vim swp files to gitignore
Alexander Popov [Thu, 26 Mar 2020 13:55:00 +0000 (16:55 +0300)]
Merge branch 'nix'
Refers to #27
Jörg Thalheim [Thu, 2 Jan 2020 10:38:24 +0000 (10:38 +0000)]
add script to download linux kernel configs from nix
Jörg Thalheim [Thu, 2 Jan 2020 08:59:33 +0000 (08:59 +0000)]
add gitignore
Jörg Thalheim [Thu, 2 Jan 2020 08:53:41 +0000 (08:53 +0000)]
add default.nix for installation via nix
Allows installation via nix from the repository itself
on NixOS and other Linux distribution that have Nix (i.e. Archlinux/Debian).
```
$ nix-build
$ ./result/bin/kconfig-hardened-check
$ nix-env -f . -i
```
It also provides an development environment for `nix-shell` with setuptools and
python in path
```
$ nix-shell
```
Alexander Popov [Thu, 26 Mar 2020 12:58:17 +0000 (15:58 +0300)]
Update the README (describing installation)
Alexander Popov [Thu, 26 Mar 2020 12:45:24 +0000 (15:45 +0300)]
Add a wrapper for using the tool without installation via setuptools
Alexander Popov [Thu, 26 Mar 2020 12:15:24 +0000 (15:15 +0300)]
Enable distribution via pip/setuptools
Thanks to @Mic92 for the proof-of-concept
Refers to #26
Alexander Popov [Thu, 26 Mar 2020 12:10:50 +0000 (15:10 +0300)]
Call it a tool
Alexander Popov [Thu, 26 Mar 2020 10:59:26 +0000 (13:59 +0300)]
Uh, setuptools doesn't like package names that contain dash
Alexander Popov [Wed, 25 Mar 2020 23:13:36 +0000 (02:13 +0300)]
Add main() and clean up working with globals
Alexander Popov [Wed, 25 Mar 2020 23:10:05 +0000 (02:10 +0300)]
Rename to kconfig-hardened-check/__init__.py
Alexander Popov [Wed, 25 Mar 2020 22:00:27 +0000 (01:00 +0300)]
Move files to kconfig-hardened-check folder
Alexander Popov [Wed, 25 Mar 2020 21:56:54 +0000 (00:56 +0300)]
Rename LICENSE file
Alexander Popov [Tue, 24 Mar 2020 12:54:18 +0000 (15:54 +0300)]
Version 0.5.5 (supports Linux kernel v5.5)
Alexander Popov [Tue, 24 Mar 2020 12:44:49 +0000 (15:44 +0300)]
Update the README
Alexander Popov [Tue, 24 Mar 2020 12:10:37 +0000 (15:10 +0300)]
CLIP OS recommends disabling Intel TSX
Alexander Popov [Tue, 24 Mar 2020 11:14:20 +0000 (14:14 +0300)]
Small syctl cleanup
Alexander Popov [Mon, 23 Mar 2020 15:25:28 +0000 (18:25 +0300)]
Merge pull request #34 from madaidan/grapheneos
GrapheneOS is the continuation of CopperheadOS
madaidan [Sun, 22 Mar 2020 19:34:23 +0000 (19:34 +0000)]
GrapheneOS is the continuation of CopperheadOS
Alexander Popov [Fri, 20 Mar 2020 20:24:03 +0000 (23:24 +0300)]
CopperheadOS disables the kernel's CONFIG_AIO feature
It isn't used or exposed by the base system and is a dubious feature.
It performs no better than thread pools and it can still block, along
with having coverage of only a tiny portion of blocking system calls
even when considering only commonly used system calls for IO.
There are no known compatibility issues caused by having this disabled.
Since this is such a dubious niche feature, it's also very poorly tested
and it doesn't get much attention. Proposed improvements have been blocked
based on the concern that POSIX AIO is such a bad interface that trying
to improve/extend it would be harmful. Following the lead of CopperheadOS
on this front has been proposed and accepted upstream for the recommended
Android kernel configuration used to derive device specific configurations.
https://github.com/AndroidHardeningArchive/documentation/blob/master/technical_overview.md#attack-surface-reduction
Alexander Popov [Fri, 20 Mar 2020 19:56:22 +0000 (22:56 +0300)]
KSPP now recommends PAGE_TABLE_ISOLATION for X86_32
Alexander Popov [Fri, 20 Mar 2020 19:48:15 +0000 (22:48 +0300)]
Update KSPP recommendations
Alexander Popov [Wed, 18 Mar 2020 15:03:56 +0000 (18:03 +0300)]
INTEL_IOMMU is available for X86_32
Alexander Popov [Wed, 18 Mar 2020 15:03:20 +0000 (18:03 +0300)]
Move VMSPLIT_3G to 'userspace_hardening'
CONFIG_VMSPLIT_3G=y is for maximal userspace memory area and maximal ASLR.
It works both for ARM and X86_32.
Alexander Popov [Wed, 18 Mar 2020 11:27:45 +0000 (14:27 +0300)]
Style fix
Alexander Popov [Wed, 18 Mar 2020 11:27:17 +0000 (14:27 +0300)]
IOMMU_SUPPORT is needed for all architectures
Alexander Popov [Wed, 18 Mar 2020 11:06:50 +0000 (14:06 +0300)]
SECURITY_WRITABLE_HOOKS and SECURITY_SELINUX_DISABLE mean the same
Alexander Popov [Wed, 18 Mar 2020 09:18:31 +0000 (12:18 +0300)]
Add CLIP OS recommendation about X86_CPUID
Alexander Popov [Wed, 18 Mar 2020 09:17:55 +0000 (12:17 +0300)]
Fix RANDOM_TRUST_BOOTLOADER check
Alexander Popov [Wed, 18 Mar 2020 09:16:09 +0000 (12:16 +0300)]
LOCKDOWN update - part II
That commit contains changes in the checks that I made after learning
the upstreamed LOCKDOWN
Alexander Popov [Wed, 18 Mar 2020 09:10:10 +0000 (12:10 +0300)]
LOCKDOWN update - part I
That features didn't change in the upstreamed version of LOCKDOWN
Alexander Popov [Wed, 18 Mar 2020 08:12:13 +0000 (11:12 +0300)]
Don't restrict arch for "is not set" checks
That would simplify things
Alexander Popov [Tue, 17 Mar 2020 17:41:26 +0000 (20:41 +0300)]
SECURITY_LOCKDOWN_LSM is recommended by CLIP OS
Alexander Popov [Sun, 8 Mar 2020 21:47:18 +0000 (00:47 +0300)]
Add CONFIG_INTEGRITY for userspace hardening
Alexander Popov [Sun, 8 Mar 2020 20:53:52 +0000 (23:53 +0300)]
Fix the comments
Alexander Popov [Sun, 8 Mar 2020 20:53:34 +0000 (23:53 +0300)]
Don't show all checks from all supported platforms in debug_mode
Alexander Popov [Sat, 7 Mar 2020 20:39:23 +0000 (23:39 +0300)]
Improve 'dunno' report in debug_mode
Alexander Popov [Fri, 6 Mar 2020 22:15:42 +0000 (01:15 +0300)]
Add SECURITY_LOADPIN_ENFORCE check
Alexander Popov [Fri, 6 Mar 2020 22:15:04 +0000 (01:15 +0300)]
Update CLIP OS kernel security documentation
Alexander Popov [Fri, 6 Mar 2020 21:53:06 +0000 (00:53 +0300)]
Add CLIP OS recommendation about CONFIG_STAGING
Alexander Popov [Fri, 6 Mar 2020 21:50:08 +0000 (00:50 +0300)]
Add CLIP OS recommendation about CONFIG_RANDOM_TRUST_BOOTLOADER
Alexander Popov [Fri, 6 Mar 2020 21:37:33 +0000 (00:37 +0300)]
Update the README
Alexander Popov [Fri, 6 Mar 2020 21:35:22 +0000 (00:35 +0300)]
Improve debug_mode a lot
The debug_mode enables:
- reporting about unknown kernel options in the config,
- showing all checks from all supported platforms,
- verbose printing of ComplexOptChecks (OR, AND).
Alexander Popov [Fri, 6 Mar 2020 21:31:50 +0000 (00:31 +0300)]
Improve the table header
Alexander Popov [Fri, 6 Mar 2020 21:24:38 +0000 (00:24 +0300)]
Drop unused OptCheck printing
Alexander Popov [Thu, 5 Mar 2020 20:21:13 +0000 (23:21 +0300)]
Update 'decision' for new KSPP recommendations
Alexander Popov [Thu, 5 Mar 2020 20:11:55 +0000 (23:11 +0300)]
Update KSPP recommendations
Alexander Popov [Thu, 5 Mar 2020 11:07:24 +0000 (14:07 +0300)]
Update the README
Alexander Popov [Thu, 5 Mar 2020 10:39:15 +0000 (13:39 +0300)]
LDISC_AUTOLOAD can be disabled since v5.1
This fixes the false positive report about LDISC_AUTOLOAD for old kernels
Alexander Popov [Thu, 5 Mar 2020 10:38:02 +0000 (13:38 +0300)]
REFCOUNT_FULL is enabled by default since v5.5
Alexander Popov [Thu, 5 Mar 2020 10:37:32 +0000 (13:37 +0300)]
Add kernel version checks for complex checks with logical operations
Nice, like it :)
And move config_checklist to other globals by the way.
Alexander Popov [Thu, 5 Mar 2020 10:32:43 +0000 (13:32 +0300)]
Add kernel version detection
Alexander Popov [Thu, 5 Mar 2020 09:07:33 +0000 (12:07 +0300)]
Simplify perform_checks()
Alexander Popov [Wed, 4 Mar 2020 20:20:19 +0000 (23:20 +0300)]
Fix versions in KSPP recommendations
Alexander Popov [Wed, 4 Mar 2020 14:47:10 +0000 (17:47 +0300)]
Fix the name for ClearLinux config
Alexander Popov [Wed, 4 Mar 2020 12:38:13 +0000 (15:38 +0300)]
STACKPROTECTOR_PER_TASK is now default for ARM
Alexander Popov [Wed, 4 Mar 2020 12:29:34 +0000 (15:29 +0300)]
SECURITY_WRITABLE_HOOKS is not disabled by default
Alexander Popov [Wed, 4 Mar 2020 12:26:40 +0000 (15:26 +0300)]
Include GCC_PLUGINS to defconfig
This option is now enabled by default in case of compiler support.
Alexander Popov [Wed, 4 Mar 2020 12:16:47 +0000 (15:16 +0300)]
Update defconfigs (v5.5)
Alexander Popov [Thu, 27 Feb 2020 17:29:59 +0000 (20:29 +0300)]
Merge branch 'config-updates-from-hackurx'
Refers to PR #31.
Thanks to @HacKurx for his work.
Loïc [Wed, 26 Feb 2020 10:10:21 +0000 (11:10 +0100)]
Update of the kconfig-hardened-check.py part
Loïc [Wed, 26 Feb 2020 09:55:46 +0000 (10:55 +0100)]
Add link for clearlinux
Loïc [Wed, 26 Feb 2020 09:53:04 +0000 (10:53 +0100)]
Add clearlinux-master
config check is finished: 'OK' - 74 / 'FAIL' - 49
Loïc [Mon, 24 Feb 2020 20:07:51 +0000 (21:07 +0100)]
Update to 5.3.0-28-generic (LTS HWE)
config check is finished: 'OK' - 50 / 'FAIL' - 73
Loïc [Mon, 24 Feb 2020 17:41:04 +0000 (18:41 +0100)]
Remove debian-stretch.config
No need to support old stable versions
Loïc [Mon, 24 Feb 2020 17:38:36 +0000 (18:38 +0100)]
Add link for amazonlinux2
Loïc [Mon, 24 Feb 2020 17:36:23 +0000 (18:36 +0100)]
Update to 4.14.165-133.209.amzn2.x86_64
config check is finished: 'OK' - 44 / 'FAIL' - 79
Loïc [Mon, 24 Feb 2020 17:18:48 +0000 (18:18 +0100)]
Update to 5.4.21
config check is finished: 'OK' - 55 / 'FAIL' - 68
Loïc [Mon, 24 Feb 2020 17:16:20 +0000 (18:16 +0100)]
Update to openSUSE-15.1
config check is finished: 'OK' - 36 / 'FAIL' - 87
Loïc [Mon, 24 Feb 2020 17:14:18 +0000 (18:14 +0100)]
Update to 5.3.16 (SLE15-SP2)
config check is finished: 'OK' - 47 / 'FAIL' - 76
Loïc [Mon, 24 Feb 2020 17:12:12 +0000 (18:12 +0100)]
Update to SLE15-SP2 and openSUSE-15.1
Loïc [Mon, 24 Feb 2020 17:08:01 +0000 (18:08 +0100)]
Update to 5.4.21
config check is finished: 'OK' - 87 / 'FAIL' - 36
Loïc [Mon, 24 Feb 2020 17:04:23 +0000 (18:04 +0100)]
Update to 5.5.5-pentoo
config check is finished: 'OK' - 84 / 'FAIL' - 39
Loïc [Mon, 24 Feb 2020 17:02:25 +0000 (18:02 +0100)]
Update of some links
Loïc [Mon, 24 Feb 2020 16:53:48 +0000 (17:53 +0100)]
Update to 5.4.1 (uek6)
config check is finished: 'OK' - 52 / 'FAIL' - 71
Loïc [Mon, 24 Feb 2020 16:47:31 +0000 (17:47 +0100)]
Update to 4.18.0-147.5.1.el8_1.x86_64
config check is finished: 'OK' - 47 / 'FAIL' - 76
Loïc [Mon, 24 Feb 2020 16:43:54 +0000 (17:43 +0100)]
Update to config-4.19.0-8-amd64
config check is finished: 'OK' - 54 / 'FAIL' - 69
Alexander Popov [Tue, 14 Jan 2020 10:28:25 +0000 (13:28 +0300)]
Fix INIT_ON_FREE_DEFAULT_ON vs PAGE_POISONING issue #28
PAGE_POISONING is a debugging feature.
It provides less erasing than INIT_ON_FREE_DEFAULT_ON.
Join these checks with OR giving preference to INIT_ON_FREE_DEFAULT_ON.
Thanks to @madaidan for the details.
Also drop my previous recommendations about CONFIG_PAGE_POISONING_NO_SANITY
and CONFIG_PAGE_POISONING_ZERO.
Alexander Popov [Tue, 14 Jan 2020 09:35:38 +0000 (12:35 +0300)]
Answer the question about CONFIG_PANIC_ON_OOPS
Thanks to @madaidan
Refers to #29
Alexander Popov [Sat, 11 Jan 2020 12:05:11 +0000 (15:05 +0300)]
Recommend disabling VIDEO_VIVID
The vivid driver is for testing. It doesn't require any special hardware.
It is shipped in Ubuntu, Debian, Arch Linux, SUSE Linux Enterprise and openSUSE.
On Ubuntu the devices created by this driver are available to the normal user,
since Ubuntu applies RW ACL when the user is logged in.
See the disclosure of CVE-2019-18683 which I've found and fixed in vivid driver:
https://www.openwall.com/lists/oss-security/2019/11/02/1
Alexander Popov [Fri, 10 Jan 2020 14:41:14 +0000 (17:41 +0300)]
Take some ideas from NixOS/nixpkgs hardened kernel config
Add CONFIG_SECURITY_SAFESETID (y) and CONFIG_SECURITY_WRITABLE_HOOKS (n).
Refers to the pull request #27.
Alexander Popov [Mon, 2 Dec 2019 14:23:57 +0000 (17:23 +0300)]
Pretty printing
Alexander Popov [Fri, 29 Nov 2019 13:56:32 +0000 (16:56 +0300)]
Version 0.5.3 (supports Linux kernel v5.3)
Alexander Popov [Fri, 29 Nov 2019 13:53:29 +0000 (16:53 +0300)]
Add the link to Linux Kernel Defence Map
Alexander Popov [Fri, 29 Nov 2019 13:25:59 +0000 (16:25 +0300)]
Update the README
Alexander Popov [Fri, 29 Nov 2019 13:22:43 +0000 (16:22 +0300)]
Update defconfigs
Alexander Popov [Fri, 29 Nov 2019 13:21:42 +0000 (16:21 +0300)]
RANDOMIZE_BASE is now enabled by default on arm64