From 8be2995ce4e980cd2b1df7c0f32583fd75295a6a Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Mon, 3 Jun 2019 20:02:42 +0300 Subject: [PATCH] Add CLIP OS recommendations for cutting attack surface Refers to the issue #19 by @HacKurx --- kconfig-hardened-check.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py index 26afc40..562dd92 100755 --- a/kconfig-hardened-check.py +++ b/kconfig-hardened-check.py @@ -320,6 +320,12 @@ def construct_checklist(arch): checklist.append(OptCheck('BPF_SYSCALL', 'is not set', 'lockdown', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL checklist.append(OptCheck('MMIOTRACE_TEST', 'is not set', 'lockdown', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL + checklist.append(OptCheck('KSM', 'is not set', 'clipos', 'cut_attack_surface')) # to prevent FLUSH+RELOAD attack + checklist.append(OptCheck('IKCONFIG', 'is not set', 'clipos', 'cut_attack_surface')) + checklist.append(OptCheck('KALLSYMS', 'is not set', 'clipos', 'cut_attack_surface')) + checklist.append(OptCheck('X86_VSYSCALL_EMULATION', 'is not set', 'clipos', 'cut_attack_surface')) + checklist.append(OptCheck('MAGIC_SYSRQ', 'is not set', 'clipos', 'cut_attack_surface')) + checklist.append(OptCheck('MMIOTRACE', 'is not set', 'my', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL (permissive) checklist.append(OptCheck('KEXEC_FILE', 'is not set', 'my', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL (permissive) checklist.append(OptCheck('LIVEPATCH', 'is not set', 'my', 'cut_attack_surface')) -- 2.31.1