Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
K
kernel-hardening-checker
Overview
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
fact-depend
kernel-hardening-checker
Commits
5e4fba66
Commit
5e4fba66
authored
Jul 02, 2021
by
Alexander Popov
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Improve wording
parent
f5277e58
Hide whitespace changes
Inline
Side-by-side
Showing
3 changed files
with
12 additions
and
12 deletions
+12
-12
README.md
README.md
+7
-7
__init__.py
kconfig_hardened_check/__init__.py
+4
-4
setup.cfg
setup.cfg
+1
-1
No files found.
README.md
View file @
5e4fba66
...
...
@@ -5,14 +5,14 @@
## Motivation
There are plenty of
Linux kernel hardening config options
. A lot of them are
There are plenty of
security hardening options in the Linux kernel
. A lot of them are
not enabled by the major distros. We have to enable these options ourselves to
make our systems more secure.
But nobody likes checking configs manually. So let the computers do their job!
__kconfig-hardened-check.py__
helps me to check the Linux kernel Kconfig option list
against my hardening preferences, which are based on the
against my
security
hardening preferences, which are based on the
-
[
KSPP recommended settings
][
1
]
,
-
[
CLIP OS kernel configuration
][
2
]
,
...
...
@@ -21,7 +21,7 @@ against my hardening preferences, which are based on the
-
direct feedback from Linux kernel maintainers (Daniel Vetter in
[
issue #38
][
6
]
).
I also created
[
__Linux Kernel Defence Map__
][
4
]
that is a graphical representation of the
relationships between
these
hardening features and the corresponding vulnerability classes
relationships between
security
hardening features and the corresponding vulnerability classes
or exploitation techniques.
## Supported microarchitectures
...
...
@@ -47,13 +47,13 @@ usage: kconfig-hardened-check [-h] [--version] [-p {X86_64,X86_32,ARM64,ARM}]
[-c CONFIG]
[-m {verbose,json,show_ok,show_fail}]
Checks the hardening options in the Linux kernel config
A tool for checking the security hardening options of the Linux kernel
optional arguments:
-h, --help show this help message and exit
--version show program's version number and exit
-p {X86_64,X86_32,ARM64,ARM}, --print {X86_64,X86_32,ARM64,ARM}
print
hardening preferences for
selected architecture
print
security hardening preferences for the
selected architecture
-c CONFIG, --config CONFIG
check the kernel config file against these preferences
-m {verbose,json,show_ok,show_fail}, --mode {verbose,json,show_ok,show_fail}
...
...
@@ -214,7 +214,7 @@ CONFIG_ARCH_MMAP_RND_BITS | 32 | clipos |userspace
## kconfig-hardened-check versioning
I usually update the kernel hardening recommendations after each Linux kernel release.
I usually update the kernel
security
hardening recommendations after each Linux kernel release.
So the version of
`kconfig-hardened-check`
is associated with the corresponding version of the kernel.
...
...
@@ -253,7 +253,7 @@ if we have a kernel oops in the process context, the offending/attacking process
<br
/>
__Q:__
What about performance impact of these
kernel
hardening options?
__Q:__
What about performance impact of these
security
hardening options?
__A:__
Ike Devolder
[
@BlackIkeEagle
][
7
]
made some performance tests and described the results in
[
this article
][
8
]
.
...
...
kconfig_hardened_check/__init__.py
View file @
5e4fba66
...
...
@@ -2,7 +2,7 @@
#
# This tool helps me to check the Linux kernel Kconfig option list
# against my hardening preferences for X86_64, ARM64, X86_32, and ARM.
# against my
security
hardening preferences for X86_64, ARM64, X86_32, and ARM.
# Let the computers do their job!
#
# Author: Alexander Popov <alex.popov@linux.com>
...
...
@@ -663,10 +663,10 @@ def main():
report_modes
=
[
'verbose'
,
'json'
,
'show_ok'
,
'show_fail'
]
supported_archs
=
[
'X86_64'
,
'X86_32'
,
'ARM64'
,
'ARM'
]
parser
=
ArgumentParser
(
prog
=
'kconfig-hardened-check'
,
description
=
'
Checks the hardening options in the Linux kernel config
'
)
description
=
'
A tool for checking the security hardening options of the Linux kernel
'
)
parser
.
add_argument
(
'--version'
,
action
=
'version'
,
version
=
'
%(prog)
s '
+
__version__
)
parser
.
add_argument
(
'-p'
,
'--print'
,
choices
=
supported_archs
,
help
=
'print
hardening preferences for
selected architecture'
)
help
=
'print
security hardening preferences for the
selected architecture'
)
parser
.
add_argument
(
'-c'
,
'--config'
,
help
=
'check the kernel config file against these preferences'
)
parser
.
add_argument
(
'-m'
,
'--mode'
,
choices
=
report_modes
,
...
...
@@ -714,7 +714,7 @@ def main():
arch
=
args
.
print
construct_checklist
(
config_checklist
,
arch
)
if
mode
!=
'json'
:
print
(
'[+] Printing kernel hardening preferences for {}...'
.
format
(
arch
))
print
(
'[+] Printing kernel
security
hardening preferences for {}...'
.
format
(
arch
))
print_checklist
(
mode
,
config_checklist
,
False
)
sys
.
exit
(
0
)
...
...
setup.cfg
View file @
5e4fba66
...
...
@@ -3,7 +3,7 @@ name = kconfig-hardened-check
author = Alexander Popov
author_email = alex.popov@linux.com
home-page = https://github.com/a13xp0p0v/kconfig-hardened-check
description = A tool for checking the
hardening options in the Linux kernel config
description = A tool for checking the
security hardening options of the Linux kernel
long-description = file: README.md
license = GNU General Public License v3 (GPLv3)
license-file = LICENSE.txt
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment