kconfig-hardened-check.git
33 hours agoFix the CONFIG_DEFAULT_MMAP_MIN_ADDR recommendation for arm64 master
Alexander Popov [Mon, 2 Dec 2024 08:11:36 +0000 (11:11 +0300)]
Fix the CONFIG_DEFAULT_MMAP_MIN_ADDR recommendation for arm64

Quote from kernel sources:
```
For most arm64, ppc64 and x86 users with lots of address space
a value of 65536 is reasonable and should cause no problems.
On arm and other archs it should not be higher than 32768.
```
https://elixir.bootlin.com/linux/v6.12.1/source/mm/Kconfig#L743

Also see https://github.com/KSPP/kspp.github.io/pull/5

9 days agoCI: Print info for debugging autodetection (II)
Alexander Popov [Sat, 23 Nov 2024 22:38:26 +0000 (01:38 +0300)]
CI: Print info for debugging autodetection (II)

9 days agoCI: Print info for debugging autodetection
Alexander Popov [Sat, 23 Nov 2024 22:33:36 +0000 (01:33 +0300)]
CI: Print info for debugging autodetection

9 days agoFix pylint warning
Alexander Popov [Sat, 23 Nov 2024 22:13:15 +0000 (01:13 +0300)]
Fix pylint warning

9 days agoengine: Consider 'is not set' as off
Alexander Popov [Sat, 23 Nov 2024 21:33:31 +0000 (00:33 +0300)]
engine: Consider 'is not set' as off

9 days agoCI: Add a kernel version parsing test
Alexander Popov [Sat, 23 Nov 2024 21:16:27 +0000 (00:16 +0300)]
CI: Add a kernel version parsing test

9 days agoMerge branch 'config-collection-2'
Alexander Popov [Sat, 23 Nov 2024 20:05:39 +0000 (23:05 +0300)]
Merge branch 'config-collection-2'

9 days agoCI: Simplify the functional test a bit 165/head
Alexander Popov [Sat, 23 Nov 2024 19:47:48 +0000 (22:47 +0300)]
CI: Simplify the functional test a bit

9 days agodistros: Add CentOS configs
Alexander Popov [Sat, 23 Nov 2024 19:16:45 +0000 (22:16 +0300)]
distros: Add CentOS configs

9 days agodistros: Update Ubuntu configs
Alexander Popov [Sat, 23 Nov 2024 19:16:08 +0000 (22:16 +0300)]
distros: Update Ubuntu configs

9 days agodistros: Update Oracle Linux configs
Alexander Popov [Sat, 23 Nov 2024 19:12:41 +0000 (22:12 +0300)]
distros: Update Oracle Linux configs

9 days agodistros: Update SUSE configs
Alexander Popov [Sat, 23 Nov 2024 19:11:50 +0000 (22:11 +0300)]
distros: Update SUSE configs

9 days agodistros: Update Debian configs
Alexander Popov [Sat, 23 Nov 2024 19:06:30 +0000 (22:06 +0300)]
distros: Update Debian configs

9 days agodistros: Update Fedora configs
Alexander Popov [Sat, 23 Nov 2024 19:05:21 +0000 (22:05 +0300)]
distros: Update Fedora configs

9 days agoUse ArchLinux kconfig in the functional test
Alexander Popov [Sat, 23 Nov 2024 19:03:29 +0000 (22:03 +0300)]
Use ArchLinux kconfig in the functional test

9 days agoDrop ClipOS doc
Alexander Popov [Sat, 23 Nov 2024 18:44:35 +0000 (21:44 +0300)]
Drop ClipOS doc

9 days agodistros: Update Azure Linux (CBL-Mariner) configs
Alexander Popov [Sat, 23 Nov 2024 18:40:50 +0000 (21:40 +0300)]
distros: Update Azure Linux (CBL-Mariner) configs

9 days agodistros: Update ArchLinux configs
Alexander Popov [Sat, 23 Nov 2024 18:38:37 +0000 (21:38 +0300)]
distros: Update ArchLinux configs

9 days agodistros: Update Android configs
Alexander Popov [Sat, 23 Nov 2024 18:35:02 +0000 (21:35 +0300)]
distros: Update Android configs

Going to use android_pixel-3a.config as an old example.

9 days agodistros: Remove ClearLinux
Alexander Popov [Sat, 23 Nov 2024 18:32:12 +0000 (21:32 +0300)]
distros: Remove ClearLinux

9 days agodistros: Remove Pentoo
Alexander Popov [Sat, 23 Nov 2024 18:30:49 +0000 (21:30 +0300)]
distros: Remove Pentoo

9 days agodistros: Remove AmazonLinux2
Alexander Popov [Sat, 23 Nov 2024 18:30:08 +0000 (21:30 +0300)]
distros: Remove AmazonLinux2

9 days agodistros: Remove Alpinelinux
Alexander Popov [Sat, 23 Nov 2024 18:29:16 +0000 (21:29 +0300)]
distros: Remove Alpinelinux

9 days agoget_kconfigs.sh: Stop on failure
Alexander Popov [Sat, 23 Nov 2024 18:05:22 +0000 (21:05 +0300)]
get_kconfigs.sh: Stop on failure

9 days agoget_kconfigs.sh: Make it verbose
Alexander Popov [Sat, 23 Nov 2024 18:04:39 +0000 (21:04 +0300)]
get_kconfigs.sh: Make it verbose

9 days agoget_kconfigs.sh: Simplify the code
Alexander Popov [Sat, 23 Nov 2024 17:28:13 +0000 (20:28 +0300)]
get_kconfigs.sh: Simplify the code

9 days agoget_kconfigs.sh: Rename distro variable
Alexander Popov [Sat, 23 Nov 2024 17:26:49 +0000 (20:26 +0300)]
get_kconfigs.sh: Rename distro variable

9 days agoget_kconfigs.sh: Fix the Azure Linux link (use v3.0)
Alexander Popov [Sat, 23 Nov 2024 18:21:44 +0000 (21:21 +0300)]
get_kconfigs.sh: Fix the Azure Linux link (use v3.0)

9 days agoget_kconfigs.sh: Improve Arch kconfig naming
Alexander Popov [Sat, 23 Nov 2024 16:23:04 +0000 (19:23 +0300)]
get_kconfigs.sh: Improve Arch kconfig naming

9 days agoget_kconfigs.sh: Drop Clearlinux (looks like it's not actively maintained)
Alexander Popov [Sat, 23 Nov 2024 16:16:20 +0000 (19:16 +0300)]
get_kconfigs.sh: Drop Clearlinux (looks like it's not actively maintained)

9 days agoget_kconfigs.sh: Use Fedora 41 Updates and drop Fedora 39 (not old enough)
Alexander Popov [Sat, 23 Nov 2024 16:10:23 +0000 (19:10 +0300)]
get_kconfigs.sh: Use Fedora 41 Updates and drop Fedora 39 (not old enough)

9 days agoget_kconfigs.sh: Use CentOS Stream (more popular than Hyperscale)
Alexander Popov [Sat, 23 Nov 2024 16:09:42 +0000 (19:09 +0300)]
get_kconfigs.sh: Use CentOS Stream (more popular than Hyperscale)

9 days agoAdd script to update kconfigs
Willenst [Sat, 23 Nov 2024 17:46:18 +0000 (19:46 +0200)]
Add script to update kconfigs

2 weeks agoUpdate README
Alexander Popov [Sat, 16 Nov 2024 18:12:51 +0000 (21:12 +0300)]
Update README

2 weeks agoAdd some cases to improve CI test coverage
Alexander Popov [Sat, 16 Nov 2024 17:13:53 +0000 (20:13 +0300)]
Add some cases to improve CI test coverage

2 weeks agoMerge branch 'autodetect2'
Alexander Popov [Sat, 16 Nov 2024 15:26:37 +0000 (18:26 +0300)]
Merge branch 'autodetect2'

Refers to #163, #129

2 weeks agoTest the autodetection 163/head
Alexander Popov [Sat, 16 Nov 2024 15:03:22 +0000 (18:03 +0300)]
Test the autodetection

2 weeks agoDon't exit from perform_checking()
Alexander Popov [Sat, 16 Nov 2024 15:01:47 +0000 (18:01 +0300)]
Don't exit from perform_checking()

We do it from main()

2 weeks agoAdd the mprint() wrapper
Alexander Popov [Sat, 16 Nov 2024 13:50:06 +0000 (16:50 +0300)]
Add the mprint() wrapper

2 weeks agoHandle the case of denied permission in the autodetect mode
Alexander Popov [Sat, 16 Nov 2024 13:12:17 +0000 (16:12 +0300)]
Handle the case of denied permission in the autodetect mode

3 weeks agoRework the prototype
Alexander Popov [Sat, 9 Nov 2024 20:49:36 +0000 (23:49 +0300)]
Rework the prototype

3 weeks agoMinor renaming
Alexander Popov [Sat, 9 Nov 2024 19:14:28 +0000 (22:14 +0300)]
Minor renaming

3 weeks agoImprove the help message and arguments handling
Alexander Popov [Mon, 21 Oct 2024 10:54:00 +0000 (13:54 +0300)]
Improve the help message and arguments handling

3 weeks agoAdd an --autodetect option
jvoisin [Tue, 8 Oct 2024 20:32:45 +0000 (22:32 +0200)]
Add an --autodetect option

Instead of having to specify Kconfig file and /proc/cmdline, --autodetect will try to infer them.

This is related to #129, and replaces #130.

3 weeks agoCheck either CONFIG_LIST_HARDENED or CONFIG_DEBUG_LIST
Alexander Popov [Sat, 9 Nov 2024 17:43:57 +0000 (20:43 +0300)]
Check either CONFIG_LIST_HARDENED or CONFIG_DEBUG_LIST

Refers to #166.

Thanks to @thestinger.

3 weeks agoMerge branch 'arch_mmap_rnd'
Alexander Popov [Sat, 9 Nov 2024 17:21:32 +0000 (20:21 +0300)]
Merge branch 'arch_mmap_rnd'

Refers to #164, #146

3 weeks agoSkip the `CONFIG_ARCH_MMAP_RND_COMPAT_BITS` option in the `--generate` mode 164/head
Alexander Popov [Sat, 9 Nov 2024 17:03:57 +0000 (20:03 +0300)]
Skip the `CONFIG_ARCH_MMAP_RND_COMPAT_BITS` option in the `--generate` mode

3 weeks agoStyle fixes
Alexander Popov [Sat, 9 Nov 2024 16:45:05 +0000 (19:45 +0300)]
Style fixes

3 weeks agoClever trick to drop some code
Alexander Popov [Sat, 9 Nov 2024 16:40:16 +0000 (19:40 +0300)]
Clever trick to drop some code

5 weeks agoimplementation of arch_mmap_rnd checks
valera disgrace [Sun, 27 Oct 2024 23:24:28 +0000 (09:24 +1000)]
implementation of arch_mmap_rnd checks

6 weeks agoDon't crash if `sysctl.conf` has no options for parsing
Alexander Popov [Wed, 16 Oct 2024 13:45:25 +0000 (16:45 +0300)]
Don't crash if `sysctl.conf` has no options for parsing

This fixes the broken Codeberg CI.

7 weeks agoUpdate python versions in CI
Alexander Popov [Sat, 12 Oct 2024 21:24:43 +0000 (00:24 +0300)]
Update python versions in CI

7 weeks agoAdd the SECCOMP_CACHE_DEBUG check
Alexander Popov [Sat, 12 Oct 2024 21:12:11 +0000 (00:12 +0300)]
Add the SECCOMP_CACHE_DEBUG check

Thanks to @izh1979 for the idea.

8 weeks agoMerge branch 'from-flipthewho'
Alexander Popov [Tue, 8 Oct 2024 17:20:44 +0000 (20:20 +0300)]
Merge branch 'from-flipthewho'

Refers to #153, #157

8 weeks agoimplementation of vm.mmap_min_addr check 157/head
flipthewho [Sun, 6 Oct 2024 21:39:05 +0000 (07:39 +1000)]
implementation of vm.mmap_min_addr check

8 weeks agoImprove the output
Alexander Popov [Sun, 6 Oct 2024 23:03:22 +0000 (02:03 +0300)]
Improve the output

8 weeks agoDrop some unneeded assertions
Alexander Popov [Sun, 6 Oct 2024 23:01:52 +0000 (02:01 +0300)]
Drop some unneeded assertions

8 weeks agoUse perform_checking() for separate sysctl checking
Alexander Popov [Sun, 6 Oct 2024 21:59:05 +0000 (00:59 +0300)]
Use perform_checking() for separate sysctl checking

There should be no functional changes.

8 weeks agoAdd perform_checking()
Alexander Popov [Sun, 6 Oct 2024 20:23:38 +0000 (23:23 +0300)]
Add perform_checking()

There should be no functional changes.

8 weeks agoReorder populating the checklist with data
Alexander Popov [Sun, 6 Oct 2024 22:25:11 +0000 (01:25 +0300)]
Reorder populating the checklist with data

First, we should add the version data.

Then we should populate the checklist with the parsed Kconfig data
and do the kconfig refinement.

8 weeks agoDetect the kernel version before the arch
Alexander Popov [Sun, 6 Oct 2024 21:02:23 +0000 (00:02 +0300)]
Detect the kernel version before the arch

8 weeks agoAdd thanks!
Alexander Popov [Sun, 6 Oct 2024 19:20:18 +0000 (22:20 +0300)]
Add thanks!

8 weeks agoImprove the functional test coverage
Alexander Popov [Sun, 6 Oct 2024 19:15:21 +0000 (22:15 +0300)]
Improve the functional test coverage

8 weeks agoFix the sysctl.conf test at github
Alexander Popov [Sun, 6 Oct 2024 18:36:55 +0000 (21:36 +0300)]
Fix the sysctl.conf test at github

8 weeks agoImprove and reorder the functional tests
Alexander Popov [Sun, 6 Oct 2024 17:46:16 +0000 (20:46 +0300)]
Improve and reorder the functional tests

8 weeks agoDrop some duplicated code (thanks to the coverage report)
Alexander Popov [Sun, 6 Oct 2024 17:42:32 +0000 (20:42 +0300)]
Drop some duplicated code (thanks to the coverage report)

8 weeks agoHandle empty files properly
Alexander Popov [Sun, 6 Oct 2024 17:29:22 +0000 (20:29 +0300)]
Handle empty files properly

8 weeks agoengine: Improve the object oriented model
Alexander Popov [Sun, 6 Oct 2024 17:09:42 +0000 (20:09 +0300)]
engine: Improve the object oriented model

2 months agoMerge branch 'from-flipthewho'
Alexander Popov [Thu, 3 Oct 2024 08:53:14 +0000 (11:53 +0300)]
Merge branch 'from-flipthewho'

Refers to #158, #161

2 months agostyle fix
Alexander Popov [Thu, 3 Oct 2024 08:52:43 +0000 (11:52 +0300)]
style fix

2 months agoimplementation of detect_arch_sysctl() 161/head
flipthewho [Thu, 26 Sep 2024 07:59:15 +0000 (17:59 +1000)]
implementation of detect_arch_sysctl()

2 months agoMerge branch 'from-flipthewho-1'
Alexander Popov [Tue, 10 Sep 2024 19:23:19 +0000 (22:23 +0300)]
Merge branch 'from-flipthewho-1'

Refers to #149, #156

2 months agoStyle fixes 156/head
Alexander Popov [Tue, 10 Sep 2024 16:32:55 +0000 (19:32 +0300)]
Style fixes

2 months agoimplementation of `CONFIG_CFI_AUTO_DEFAULT`
flipthewho [Mon, 9 Sep 2024 05:58:15 +0000 (15:58 +1000)]
implementation of `CONFIG_CFI_AUTO_DEFAULT`

2 months agoMerge branch 'sysctl-fixes'
Alexander Popov [Wed, 4 Sep 2024 14:26:23 +0000 (17:26 +0300)]
Merge branch 'sysctl-fixes'

Refers to #159, #160.

2 months agosysctl parsing: change parsing errors to warnings and improve the messages sysctl-fixes 160/head
Alexander Popov [Wed, 4 Sep 2024 13:38:06 +0000 (16:38 +0300)]
sysctl parsing: change parsing errors to warnings and improve the messages

2 months agosysctl parsing: Allow comments (they usually exist in sysctl.conf)
Alexander Popov [Wed, 4 Sep 2024 13:21:31 +0000 (16:21 +0300)]
sysctl parsing: Allow comments (they usually exist in sysctl.conf)

2 months agosysctl parsing: Allow missing space before '='
Alexander Popov [Wed, 4 Sep 2024 13:20:15 +0000 (16:20 +0300)]
sysctl parsing: Allow missing space before '='

2 months agoDrop the UNWIND_PATCH_PAC_INTO_SCS recommendation for now
Alexander Popov [Wed, 4 Sep 2024 12:28:05 +0000 (15:28 +0300)]
Drop the UNWIND_PATCH_PAC_INTO_SCS recommendation for now

Currently, there is no consensus about this feature:
https://github.com/KSPP/kspp.github.io/issues/2

Refers to #105

3 months agoReady for the release 0.6.10 v0.6.10
Alexander Popov [Sun, 1 Sep 2024 19:38:21 +0000 (22:38 +0300)]
Ready for the release 0.6.10

3 months agoUpdate issues.md
Alexander Popov [Sun, 1 Sep 2024 19:33:30 +0000 (22:33 +0300)]
Update issues.md

3 months agoUpdate the README
Alexander Popov [Sun, 1 Sep 2024 19:14:27 +0000 (22:14 +0300)]
Update the README

3 months agoFix style (quotation marks)
Alexander Popov [Sun, 1 Sep 2024 18:56:46 +0000 (21:56 +0300)]
Fix style (quotation marks)

3 months agoUpdate the NixOS kernel configs
Alexander Popov [Sun, 1 Sep 2024 18:37:20 +0000 (21:37 +0300)]
Update the NixOS kernel configs

3 months agoDon't normalize the `cfi` cmdline parameter
Alexander Popov [Sun, 1 Sep 2024 21:36:18 +0000 (00:36 +0300)]
Don't normalize the `cfi` cmdline parameter

3 months agoSplit the cut_attack_surface checks that contain the renamed options
Alexander Popov [Sun, 1 Sep 2024 17:24:02 +0000 (20:24 +0300)]
Split the cut_attack_surface checks that contain the renamed options

3 months agoUpdate the BCACHE_CLOSURES_DEBUG check
Alexander Popov [Sun, 1 Sep 2024 16:19:42 +0000 (19:19 +0300)]
Update the BCACHE_CLOSURES_DEBUG check

It has been renamed to DEBUG_CLOSURES.

3 months agoFix `if arch` for the 'mitigations' cmdline check
Alexander Popov [Sun, 1 Sep 2024 15:17:22 +0000 (18:17 +0300)]
Fix `if arch` for the 'mitigations' cmdline check

3 months agoRemove `if arch` for the CPU_MITIGATIONS check
Alexander Popov [Sun, 1 Sep 2024 14:55:05 +0000 (17:55 +0300)]
Remove `if arch` for the CPU_MITIGATIONS check

It exists on all the platforms now.

3 months agoRemove `if arch` for the X86_VSYSCALL_EMULATION check
Alexander Popov [Sun, 1 Sep 2024 14:52:00 +0000 (17:52 +0300)]
Remove `if arch` for the X86_VSYSCALL_EMULATION check

It requires 'is not set' anyway.

3 months agoAdd the ARM_SMMU* kconfig checks for ARM
Alexander Popov [Sun, 1 Sep 2024 12:52:15 +0000 (15:52 +0300)]
Add the ARM_SMMU* kconfig checks for ARM

3 months agoUpdate the DEBUG_WX check for ARM64 and ARM
Alexander Popov [Sun, 1 Sep 2024 21:33:21 +0000 (00:33 +0300)]
Update the DEBUG_WX check for ARM64 and ARM

It was renamed for ARM in the commit a90f0a02f139a13d3c26dd20644b50fc731f17da.

3 months agoAdd `if arch` for PAGE_TABLE_CHECK*
Alexander Popov [Sun, 1 Sep 2024 11:37:09 +0000 (14:37 +0300)]
Add `if arch` for PAGE_TABLE_CHECK*

3 months agoUpdate the AMD_IOMMU_V2 kconfig check
Alexander Popov [Sun, 1 Sep 2024 11:02:26 +0000 (14:02 +0300)]
Update the AMD_IOMMU_V2 kconfig check

AMD_IOMMU_V2 was dropped in v6.7 in the commit
5a0b11a180a9b82b4437a4be1cf73530053f139b

3 months agoUpdate the UBSAN_SANITIZE_ALL kconfig check
Alexander Popov [Sun, 1 Sep 2024 10:40:16 +0000 (13:40 +0300)]
Update the UBSAN_SANITIZE_ALL kconfig check

It was enabled by default in UBSAN and removed in the commit
918327e9b7ffb45321cbb4b9b86b58ec555fe6b3 in Linux v6.9.

3 months agoMerge branch 'from-willenst-1'
Alexander Popov [Thu, 29 Aug 2024 06:25:26 +0000 (09:25 +0300)]
Merge branch 'from-willenst-1'

Refers to #152

3 months agounittest: test VersionCheck.table_print() to hit the coverage
Alexander Popov [Wed, 28 Aug 2024 18:20:01 +0000 (21:20 +0300)]
unittest: test VersionCheck.table_print() to hit the coverage

Refers to #145, #155

3 months agoMerge branch 'from-willenst-2'
Alexander Popov [Wed, 28 Aug 2024 18:01:12 +0000 (21:01 +0300)]
Merge branch 'from-willenst-2'

Refers to #145, #155

3 months agoremove engine debug output 155/head
Willenst [Tue, 27 Aug 2024 11:32:03 +0000 (13:32 +0200)]
remove engine debug output

remove unused libs

Remove engine debug output

3 months agoAdd test for `colorize_result`
Willenst [Thu, 22 Aug 2024 18:56:41 +0000 (20:56 +0200)]
Add test for `colorize_result`