kconfig-hardened-check.git
4 years agoVersion 0.5.5 (supports Linux kernel v5.5) v0.5.5
Alexander Popov [Tue, 24 Mar 2020 12:54:18 +0000 (15:54 +0300)]
Version 0.5.5 (supports Linux kernel v5.5)

4 years agoUpdate the README
Alexander Popov [Tue, 24 Mar 2020 12:44:49 +0000 (15:44 +0300)]
Update the README

4 years agoCLIP OS recommends disabling Intel TSX
Alexander Popov [Tue, 24 Mar 2020 12:10:37 +0000 (15:10 +0300)]
CLIP OS recommends disabling Intel TSX

4 years agoSmall syctl cleanup
Alexander Popov [Tue, 24 Mar 2020 11:14:20 +0000 (14:14 +0300)]
Small syctl cleanup

4 years agoMerge pull request #34 from madaidan/grapheneos
Alexander Popov [Mon, 23 Mar 2020 15:25:28 +0000 (18:25 +0300)]
Merge pull request #34 from madaidan/grapheneos

GrapheneOS is the continuation of CopperheadOS

4 years agoGrapheneOS is the continuation of CopperheadOS 34/head
madaidan [Sun, 22 Mar 2020 19:34:23 +0000 (19:34 +0000)]
GrapheneOS is the continuation of CopperheadOS

4 years agoCopperheadOS disables the kernel's CONFIG_AIO feature
Alexander Popov [Fri, 20 Mar 2020 20:24:03 +0000 (23:24 +0300)]
CopperheadOS disables the kernel's CONFIG_AIO feature

It isn't used or exposed by the base system and is a dubious feature.
It performs no better than thread pools and it can still block, along
with having coverage of only a tiny portion of blocking system calls
even when considering only commonly used system calls for IO.
There are no known compatibility issues caused by having this disabled.
Since this is such a dubious niche feature, it's also very poorly tested
and it doesn't get much attention. Proposed improvements have been blocked
based on the concern that POSIX AIO is such a bad interface that trying
to improve/extend it would be harmful. Following the lead of CopperheadOS
on this front has been proposed and accepted upstream for the recommended
Android kernel configuration used to derive device specific configurations.

https://github.com/AndroidHardeningArchive/documentation/blob/master/technical_overview.md#attack-surface-reduction

4 years agoKSPP now recommends PAGE_TABLE_ISOLATION for X86_32
Alexander Popov [Fri, 20 Mar 2020 19:56:22 +0000 (22:56 +0300)]
KSPP now recommends PAGE_TABLE_ISOLATION for X86_32

4 years agoUpdate KSPP recommendations
Alexander Popov [Fri, 20 Mar 2020 19:48:15 +0000 (22:48 +0300)]
Update KSPP recommendations

4 years agoINTEL_IOMMU is available for X86_32
Alexander Popov [Wed, 18 Mar 2020 15:03:56 +0000 (18:03 +0300)]
INTEL_IOMMU is available for X86_32

4 years agoMove VMSPLIT_3G to 'userspace_hardening'
Alexander Popov [Wed, 18 Mar 2020 15:03:20 +0000 (18:03 +0300)]
Move VMSPLIT_3G to 'userspace_hardening'

CONFIG_VMSPLIT_3G=y is for maximal userspace memory area and maximal ASLR.

It works both for ARM and X86_32.

4 years agoStyle fix
Alexander Popov [Wed, 18 Mar 2020 11:27:45 +0000 (14:27 +0300)]
Style fix

4 years agoIOMMU_SUPPORT is needed for all architectures
Alexander Popov [Wed, 18 Mar 2020 11:27:17 +0000 (14:27 +0300)]
IOMMU_SUPPORT is needed for all architectures

4 years agoSECURITY_WRITABLE_HOOKS and SECURITY_SELINUX_DISABLE mean the same
Alexander Popov [Wed, 18 Mar 2020 11:06:50 +0000 (14:06 +0300)]
SECURITY_WRITABLE_HOOKS and SECURITY_SELINUX_DISABLE mean the same

4 years agoAdd CLIP OS recommendation about X86_CPUID
Alexander Popov [Wed, 18 Mar 2020 09:18:31 +0000 (12:18 +0300)]
Add CLIP OS recommendation about X86_CPUID

4 years agoFix RANDOM_TRUST_BOOTLOADER check
Alexander Popov [Wed, 18 Mar 2020 09:17:55 +0000 (12:17 +0300)]
Fix RANDOM_TRUST_BOOTLOADER check

4 years agoLOCKDOWN update - part II
Alexander Popov [Wed, 18 Mar 2020 09:16:09 +0000 (12:16 +0300)]
LOCKDOWN update - part II

That commit contains changes in the checks that I made after learning
the upstreamed LOCKDOWN

4 years agoLOCKDOWN update - part I
Alexander Popov [Wed, 18 Mar 2020 09:10:10 +0000 (12:10 +0300)]
LOCKDOWN update - part I

That features didn't change in the upstreamed version of LOCKDOWN

4 years agoDon't restrict arch for "is not set" checks
Alexander Popov [Wed, 18 Mar 2020 08:12:13 +0000 (11:12 +0300)]
Don't restrict arch for "is not set" checks

That would simplify things

4 years agoSECURITY_LOCKDOWN_LSM is recommended by CLIP OS
Alexander Popov [Tue, 17 Mar 2020 17:41:26 +0000 (20:41 +0300)]
SECURITY_LOCKDOWN_LSM is recommended by CLIP OS

4 years agoAdd CONFIG_INTEGRITY for userspace hardening
Alexander Popov [Sun, 8 Mar 2020 21:47:18 +0000 (00:47 +0300)]
Add CONFIG_INTEGRITY for userspace hardening

4 years agoFix the comments
Alexander Popov [Sun, 8 Mar 2020 20:53:52 +0000 (23:53 +0300)]
Fix the comments

4 years agoDon't show all checks from all supported platforms in debug_mode
Alexander Popov [Sun, 8 Mar 2020 20:53:34 +0000 (23:53 +0300)]
Don't show all checks from all supported platforms in debug_mode

4 years agoImprove 'dunno' report in debug_mode
Alexander Popov [Sat, 7 Mar 2020 20:39:23 +0000 (23:39 +0300)]
Improve 'dunno' report in debug_mode

4 years agoAdd SECURITY_LOADPIN_ENFORCE check
Alexander Popov [Fri, 6 Mar 2020 22:15:42 +0000 (01:15 +0300)]
Add SECURITY_LOADPIN_ENFORCE check

4 years agoUpdate CLIP OS kernel security documentation
Alexander Popov [Fri, 6 Mar 2020 22:15:04 +0000 (01:15 +0300)]
Update CLIP OS kernel security documentation

4 years agoAdd CLIP OS recommendation about CONFIG_STAGING
Alexander Popov [Fri, 6 Mar 2020 21:53:06 +0000 (00:53 +0300)]
Add CLIP OS recommendation about CONFIG_STAGING

4 years agoAdd CLIP OS recommendation about CONFIG_RANDOM_TRUST_BOOTLOADER
Alexander Popov [Fri, 6 Mar 2020 21:50:08 +0000 (00:50 +0300)]
Add CLIP OS recommendation about CONFIG_RANDOM_TRUST_BOOTLOADER

4 years agoUpdate the README
Alexander Popov [Fri, 6 Mar 2020 21:37:33 +0000 (00:37 +0300)]
Update the README

4 years agoImprove debug_mode a lot
Alexander Popov [Fri, 6 Mar 2020 21:35:22 +0000 (00:35 +0300)]
Improve debug_mode a lot

The debug_mode enables:
 - reporting about unknown kernel options in the config,
 - showing all checks from all supported platforms,
 - verbose printing of ComplexOptChecks (OR, AND).

4 years agoImprove the table header
Alexander Popov [Fri, 6 Mar 2020 21:31:50 +0000 (00:31 +0300)]
Improve the table header

4 years agoDrop unused OptCheck printing
Alexander Popov [Fri, 6 Mar 2020 21:24:38 +0000 (00:24 +0300)]
Drop unused OptCheck printing

4 years agoUpdate 'decision' for new KSPP recommendations
Alexander Popov [Thu, 5 Mar 2020 20:21:13 +0000 (23:21 +0300)]
Update 'decision' for new KSPP recommendations

4 years agoUpdate KSPP recommendations
Alexander Popov [Thu, 5 Mar 2020 20:11:55 +0000 (23:11 +0300)]
Update KSPP recommendations

4 years agoUpdate the README
Alexander Popov [Thu, 5 Mar 2020 11:07:24 +0000 (14:07 +0300)]
Update the README

4 years agoLDISC_AUTOLOAD can be disabled since v5.1
Alexander Popov [Thu, 5 Mar 2020 10:39:15 +0000 (13:39 +0300)]
LDISC_AUTOLOAD can be disabled since v5.1

This fixes the false positive report about LDISC_AUTOLOAD for old kernels

4 years agoREFCOUNT_FULL is enabled by default since v5.5
Alexander Popov [Thu, 5 Mar 2020 10:38:02 +0000 (13:38 +0300)]
REFCOUNT_FULL is enabled by default since v5.5

4 years agoAdd kernel version checks for complex checks with logical operations
Alexander Popov [Thu, 5 Mar 2020 10:37:32 +0000 (13:37 +0300)]
Add kernel version checks for complex checks with logical operations

Nice, like it :)

And move config_checklist to other globals by the way.

4 years agoAdd kernel version detection
Alexander Popov [Thu, 5 Mar 2020 10:32:43 +0000 (13:32 +0300)]
Add kernel version detection

4 years agoSimplify perform_checks()
Alexander Popov [Thu, 5 Mar 2020 09:07:33 +0000 (12:07 +0300)]
Simplify perform_checks()

4 years agoFix versions in KSPP recommendations
Alexander Popov [Wed, 4 Mar 2020 20:20:19 +0000 (23:20 +0300)]
Fix versions in KSPP recommendations

4 years agoFix the name for ClearLinux config
Alexander Popov [Wed, 4 Mar 2020 14:47:10 +0000 (17:47 +0300)]
Fix the name for ClearLinux config

4 years agoSTACKPROTECTOR_PER_TASK is now default for ARM
Alexander Popov [Wed, 4 Mar 2020 12:38:13 +0000 (15:38 +0300)]
STACKPROTECTOR_PER_TASK is now default for ARM

4 years agoSECURITY_WRITABLE_HOOKS is not disabled by default
Alexander Popov [Wed, 4 Mar 2020 12:29:34 +0000 (15:29 +0300)]
SECURITY_WRITABLE_HOOKS is not disabled by default

4 years agoInclude GCC_PLUGINS to defconfig
Alexander Popov [Wed, 4 Mar 2020 12:26:40 +0000 (15:26 +0300)]
Include GCC_PLUGINS to defconfig

This option is now enabled by default in case of compiler support.

4 years agoUpdate defconfigs (v5.5)
Alexander Popov [Wed, 4 Mar 2020 12:16:47 +0000 (15:16 +0300)]
Update defconfigs (v5.5)

4 years agoMerge branch 'config-updates-from-hackurx'
Alexander Popov [Thu, 27 Feb 2020 17:29:59 +0000 (20:29 +0300)]
Merge branch 'config-updates-from-hackurx'

Refers to PR #31.

Thanks to @HacKurx for his work.

4 years agoUpdate of the kconfig-hardened-check.py part 31/head
Loïc [Wed, 26 Feb 2020 10:10:21 +0000 (11:10 +0100)]
Update of the kconfig-hardened-check.py part

4 years agoAdd link for clearlinux
Loïc [Wed, 26 Feb 2020 09:55:46 +0000 (10:55 +0100)]
Add link for clearlinux

4 years agoAdd clearlinux-master
Loïc [Wed, 26 Feb 2020 09:53:04 +0000 (10:53 +0100)]
Add clearlinux-master

config check is finished: 'OK' - 74 / 'FAIL' - 49

4 years agoUpdate to 5.3.0-28-generic (LTS HWE)
Loïc [Mon, 24 Feb 2020 20:07:51 +0000 (21:07 +0100)]
Update to 5.3.0-28-generic (LTS HWE)

config check is finished: 'OK' - 50 / 'FAIL' - 73

4 years agoRemove debian-stretch.config
Loïc [Mon, 24 Feb 2020 17:41:04 +0000 (18:41 +0100)]
Remove debian-stretch.config

No need to support old stable versions

4 years agoAdd link for amazonlinux2
Loïc [Mon, 24 Feb 2020 17:38:36 +0000 (18:38 +0100)]
Add link for amazonlinux2

4 years agoUpdate to 4.14.165-133.209.amzn2.x86_64
Loïc [Mon, 24 Feb 2020 17:36:23 +0000 (18:36 +0100)]
Update to 4.14.165-133.209.amzn2.x86_64

config check is finished: 'OK' - 44 / 'FAIL' - 79

4 years agoUpdate to 5.4.21
Loïc [Mon, 24 Feb 2020 17:18:48 +0000 (18:18 +0100)]
Update to 5.4.21

config check is finished: 'OK' - 55 / 'FAIL' - 68

4 years agoUpdate to openSUSE-15.1
Loïc [Mon, 24 Feb 2020 17:16:20 +0000 (18:16 +0100)]
Update to openSUSE-15.1

config check is finished: 'OK' - 36 / 'FAIL' - 87

4 years agoUpdate to 5.3.16 (SLE15-SP2)
Loïc [Mon, 24 Feb 2020 17:14:18 +0000 (18:14 +0100)]
Update to 5.3.16 (SLE15-SP2)

config check is finished: 'OK' - 47 / 'FAIL' - 76

4 years agoUpdate to SLE15-SP2 and openSUSE-15.1
Loïc [Mon, 24 Feb 2020 17:12:12 +0000 (18:12 +0100)]
Update to SLE15-SP2 and openSUSE-15.1

4 years agoUpdate to 5.4.21
Loïc [Mon, 24 Feb 2020 17:08:01 +0000 (18:08 +0100)]
Update to 5.4.21

config check is finished: 'OK' - 87 / 'FAIL' - 36

4 years agoUpdate to 5.5.5-pentoo
Loïc [Mon, 24 Feb 2020 17:04:23 +0000 (18:04 +0100)]
Update to 5.5.5-pentoo

config check is finished: 'OK' - 84 / 'FAIL' - 39

4 years agoUpdate of some links
Loïc [Mon, 24 Feb 2020 17:02:25 +0000 (18:02 +0100)]
Update of some links

4 years agoUpdate to 5.4.1 (uek6)
Loïc [Mon, 24 Feb 2020 16:53:48 +0000 (17:53 +0100)]
Update to 5.4.1 (uek6)

config check is finished: 'OK' - 52 / 'FAIL' - 71

4 years agoUpdate to 4.18.0-147.5.1.el8_1.x86_64
Loïc [Mon, 24 Feb 2020 16:47:31 +0000 (17:47 +0100)]
Update to 4.18.0-147.5.1.el8_1.x86_64

config check is finished: 'OK' - 47 / 'FAIL' - 76

4 years agoUpdate to config-4.19.0-8-amd64
Loïc [Mon, 24 Feb 2020 16:43:54 +0000 (17:43 +0100)]
Update to config-4.19.0-8-amd64

config check is finished: 'OK' - 54 / 'FAIL' - 69

4 years agoFix INIT_ON_FREE_DEFAULT_ON vs PAGE_POISONING issue #28
Alexander Popov [Tue, 14 Jan 2020 10:28:25 +0000 (13:28 +0300)]
Fix INIT_ON_FREE_DEFAULT_ON vs PAGE_POISONING issue #28

PAGE_POISONING is a debugging feature.
It provides less erasing than INIT_ON_FREE_DEFAULT_ON.
Join these checks with OR giving preference to INIT_ON_FREE_DEFAULT_ON.

Thanks to @madaidan for the details.

Also drop my previous recommendations about CONFIG_PAGE_POISONING_NO_SANITY
and CONFIG_PAGE_POISONING_ZERO.

4 years agoAnswer the question about CONFIG_PANIC_ON_OOPS
Alexander Popov [Tue, 14 Jan 2020 09:35:38 +0000 (12:35 +0300)]
Answer the question about CONFIG_PANIC_ON_OOPS

Thanks to @madaidan
Refers to #29

4 years agoRecommend disabling VIDEO_VIVID
Alexander Popov [Sat, 11 Jan 2020 12:05:11 +0000 (15:05 +0300)]
Recommend disabling VIDEO_VIVID

The vivid driver is for testing. It doesn't require any special hardware.
It is shipped in Ubuntu, Debian, Arch Linux, SUSE Linux Enterprise and openSUSE.
On Ubuntu the devices created by this driver are available to the normal user,
since Ubuntu applies RW ACL when the user is logged in.

See the disclosure of CVE-2019-18683 which I've found and fixed in vivid driver:
https://www.openwall.com/lists/oss-security/2019/11/02/1

4 years agoTake some ideas from NixOS/nixpkgs hardened kernel config
Alexander Popov [Fri, 10 Jan 2020 14:41:14 +0000 (17:41 +0300)]
Take some ideas from NixOS/nixpkgs hardened kernel config

Add CONFIG_SECURITY_SAFESETID (y) and CONFIG_SECURITY_WRITABLE_HOOKS (n).

Refers to the pull request #27.

4 years agoPretty printing
Alexander Popov [Mon, 2 Dec 2019 14:23:57 +0000 (17:23 +0300)]
Pretty printing

4 years agoVersion 0.5.3 (supports Linux kernel v5.3) v0.5.3
Alexander Popov [Fri, 29 Nov 2019 13:56:32 +0000 (16:56 +0300)]
Version 0.5.3 (supports Linux kernel v5.3)

4 years agoAdd the link to Linux Kernel Defence Map
Alexander Popov [Fri, 29 Nov 2019 13:53:29 +0000 (16:53 +0300)]
Add the link to Linux Kernel Defence Map

4 years agoUpdate the README
Alexander Popov [Fri, 29 Nov 2019 13:25:59 +0000 (16:25 +0300)]
Update the README

4 years agoUpdate defconfigs
Alexander Popov [Fri, 29 Nov 2019 13:22:43 +0000 (16:22 +0300)]
Update defconfigs

4 years agoRANDOMIZE_BASE is now enabled by default on arm64
Alexander Popov [Fri, 29 Nov 2019 13:21:42 +0000 (16:21 +0300)]
RANDOMIZE_BASE is now enabled by default on arm64

4 years agox86_32: INTEL_IOMMU is not enabled by default - fix the reason
Alexander Popov [Thu, 28 Nov 2019 21:11:07 +0000 (00:11 +0300)]
x86_32: INTEL_IOMMU is not enabled by default - fix the reason

4 years agoX86_INTEL_UMIP is now X86_UMIP
Alexander Popov [Thu, 28 Nov 2019 21:07:48 +0000 (00:07 +0300)]
X86_INTEL_UMIP is now X86_UMIP

4 years agox86_64: more hardening options are enabled by default - change the reason
Alexander Popov [Thu, 28 Nov 2019 21:07:21 +0000 (00:07 +0300)]
x86_64: more hardening options are enabled by default - change the reason

4 years agoImprove the list of the kernel parameters in TODO
Alexander Popov [Thu, 28 Nov 2019 17:24:55 +0000 (20:24 +0300)]
Improve the list of the kernel parameters in TODO

4 years agoAdd CLIP OS links
Alexander Popov [Thu, 28 Nov 2019 17:23:04 +0000 (20:23 +0300)]
Add CLIP OS links

4 years agoUpdate the column width
Alexander Popov [Thu, 28 Nov 2019 16:56:13 +0000 (19:56 +0300)]
Update the column width

4 years agoSome of my recommendations are used by CLIP OS, change the `reason` field
Alexander Popov [Thu, 28 Nov 2019 16:54:55 +0000 (19:54 +0300)]
Some of my recommendations are used by CLIP OS, change the `reason` field

4 years agoDon't recommend disabling IKCONFIG anymore
Alexander Popov [Thu, 28 Nov 2019 16:30:01 +0000 (19:30 +0300)]
Don't recommend disabling IKCONFIG anymore

That info is needed for this script :)

4 years agoSave more hardening sysctls for TODO
Alexander Popov [Thu, 28 Nov 2019 16:28:52 +0000 (19:28 +0300)]
Save more hardening sysctls for TODO

4 years agoUpdate CLIP OS doc
Alexander Popov [Thu, 28 Nov 2019 16:27:53 +0000 (19:27 +0300)]
Update CLIP OS doc

4 years agoGroup security policies together
Alexander Popov [Thu, 28 Nov 2019 09:09:36 +0000 (12:09 +0300)]
Group security policies together

Also update the name of the lockdown feature (merged into v5.4).

4 years agoAdd INIT_ON_ALLOC_DEFAULT_ON and INIT_ON_FREE_DEFAULT_ON introduced in v5.3
Alexander Popov [Thu, 28 Nov 2019 09:07:11 +0000 (12:07 +0300)]
Add INIT_ON_ALLOC_DEFAULT_ON and INIT_ON_FREE_DEFAULT_ON introduced in v5.3

4 years agoAdd RODATA_FULL_DEFAULT_ENABLED for ARM64
Alexander Popov [Thu, 28 Nov 2019 09:06:27 +0000 (12:06 +0300)]
Add RODATA_FULL_DEFAULT_ENABLED for ARM64

4 years agoAdd info about Debian and AOSP kernel configs to links.txt
Alexander Popov [Thu, 28 Nov 2019 07:32:49 +0000 (10:32 +0300)]
Add info about Debian and AOSP kernel configs to links.txt

4 years agoAdd Debian Buster kernel config
Alexander Popov [Thu, 28 Nov 2019 07:17:57 +0000 (10:17 +0300)]
Add Debian Buster kernel config

4 years agoAdd AOSP kernel config for Pixel 3a
Alexander Popov [Thu, 28 Nov 2019 07:17:07 +0000 (10:17 +0300)]
Add AOSP kernel config for Pixel 3a

5 years agoIntroduce the versioning v0.5.2
Alexander Popov [Fri, 23 Aug 2019 16:09:36 +0000 (19:09 +0300)]
Introduce the versioning

At the Chaos Communication Camp 2019 @jelly told that it would be nice to add the kconfig-hardened-check to Arch Linux.

So I add versioning to make it happen.

Thanks @jelly, nice to meet you!

5 years agoUpdate the script output in the README
Alexander Popov [Fri, 23 Aug 2019 12:48:43 +0000 (15:48 +0300)]
Update the script output in the README

5 years agoAdd HARDEN_BRANCH_PREDICTOR and HARDEN_EL2_VECTORS
Alexander Popov [Fri, 23 Aug 2019 10:35:53 +0000 (13:35 +0300)]
Add HARDEN_BRANCH_PREDICTOR and HARDEN_EL2_VECTORS

5 years agoBring more order to the offsets (style fix)
Alexander Popov [Fri, 23 Aug 2019 11:40:41 +0000 (14:40 +0300)]
Bring more order to the offsets (style fix)

5 years agoAdd INIT_STACK_ALL as an alternative to GCC_PLUGIN_STRUCTLEAK_BYREF_ALL
Alexander Popov [Thu, 22 Aug 2019 10:43:46 +0000 (13:43 +0300)]
Add INIT_STACK_ALL as an alternative to GCC_PLUGIN_STRUCTLEAK_BYREF_ALL

5 years agoAdd SHUFFLE_PAGE_ALLOCATOR from v5.2
Alexander Popov [Thu, 22 Aug 2019 10:35:32 +0000 (13:35 +0300)]
Add SHUFFLE_PAGE_ALLOCATOR from v5.2

5 years agoAdd some new sysctls (to remember them)
Alexander Popov [Thu, 22 Aug 2019 10:34:49 +0000 (13:34 +0300)]
Add some new sysctls (to remember them)

5 years agoMerge pull request #22 from adrianopol/master
Alexander Popov [Mon, 8 Jul 2019 14:07:18 +0000 (17:07 +0300)]
Merge pull request #22 from adrianopol/master

#20 fix: use right quotes in json output

Thanks @adrianopol

5 years ago#20 fix: use right quotes in json output 22/head
Andrew Petelin [Sun, 7 Jul 2019 19:24:41 +0000 (22:24 +0300)]
#20 fix: use right quotes in json output

5 years agoDo code refactoring without changing the functionality
Alexander Popov [Mon, 24 Jun 2019 12:05:51 +0000 (15:05 +0300)]
Do code refactoring without changing the functionality

Changes:
 - get rid of checklist global variable,
 - improve print_checks().