Skip to content

K
kernel-hardening-checker
Commit 75cfda0e by Alexander Popov
Options

Merge branch 'from-hackurx-1'

parents 5336858f 6c8d514e
Showing with 3 additions and 1 deletions
README.md
...@@ -29,7 +29,7 @@ Usage: ./kconfig-hardened-check.py [-p | -c <config_file>] ...@@ -29,7 +29,7 @@ Usage: ./kconfig-hardened-check.py [-p | -c <config_file>]
### Script output for `Ubuntu 18.04 (Bionic Beaver)` kernel config ### Script output for `Ubuntu 18.04 (Bionic Beaver)` kernel config
``` ```
./kconfig-hardened-check.py -c ubuntu-bionic-generic.config ./kconfig-hardened-check.py -c config_files/ubuntu-bionic-generic.config
[+] Checking "ubuntu-bionic-generic.config" against hardening preferences... [+] Checking "ubuntu-bionic-generic.config" against hardening preferences...
option name | desired val | decision | reason || check result option name | desired val | decision | reason || check result
=========================================================================================================== ===========================================================================================================
...@@ -91,6 +91,7 @@ Usage: ./kconfig-hardened-check.py [-p | -c <config_file>] ...@@ -91,6 +91,7 @@ Usage: ./kconfig-hardened-check.py [-p | -c <config_file>]
CONFIG_ZSMALLOC_STAT | is not set | ubuntu18 | cut_attack_surface || OK CONFIG_ZSMALLOC_STAT | is not set | ubuntu18 | cut_attack_surface || OK
CONFIG_PAGE_OWNER | is not set | ubuntu18 | cut_attack_surface || OK CONFIG_PAGE_OWNER | is not set | ubuntu18 | cut_attack_surface || OK
CONFIG_DEBUG_KMEMLEAK | is not set | ubuntu18 | cut_attack_surface || OK CONFIG_DEBUG_KMEMLEAK | is not set | ubuntu18 | cut_attack_surface || OK
CONFIG_BINFMT_AOUT | is not set | ubuntu18 | cut_attack_surface || OK: not found
CONFIG_IO_STRICT_DEVMEM | y | kspp | cut_attack_surface || FAIL: "is not set" CONFIG_IO_STRICT_DEVMEM | y | kspp | cut_attack_surface || FAIL: "is not set"
CONFIG_LEGACY_VSYSCALL_NONE | y | kspp | cut_attack_surface || FAIL: "is not set" CONFIG_LEGACY_VSYSCALL_NONE | y | kspp | cut_attack_surface || FAIL: "is not set"
CONFIG_BINFMT_MISC | is not set | kspp | cut_attack_surface || FAIL: "m" CONFIG_BINFMT_MISC | is not set | kspp | cut_attack_surface || FAIL: "m"
......
config_files/Alpinelinux-edge.config 0 → 100644
This source diff could not be displayed because it is too large. You can view the blob instead.
config_files/Archlinux-Testing.config 0 → 100644
This source diff could not be displayed because it is too large. You can view the blob instead.
config_files/Archlinux-hardened.config 0 → 100644
This source diff could not be displayed because it is too large. You can view the blob instead.
config_files/debian-sid-amd64.config 0 → 100644
This source diff could not be displayed because it is too large. You can view the blob instead.
kconfig-hardened-check.py
...@@ -112,6 +112,7 @@ def construct_opt_checks(): ...@@ -112,6 +112,7 @@ def construct_opt_checks():
checklist.append(OptCheck('ZSMALLOC_STAT', 'is not set', 'ubuntu18', 'cut_attack_surface')) checklist.append(OptCheck('ZSMALLOC_STAT', 'is not set', 'ubuntu18', 'cut_attack_surface'))
checklist.append(OptCheck('PAGE_OWNER', 'is not set', 'ubuntu18', 'cut_attack_surface')) checklist.append(OptCheck('PAGE_OWNER', 'is not set', 'ubuntu18', 'cut_attack_surface'))
checklist.append(OptCheck('DEBUG_KMEMLEAK', 'is not set', 'ubuntu18', 'cut_attack_surface')) checklist.append(OptCheck('DEBUG_KMEMLEAK', 'is not set', 'ubuntu18', 'cut_attack_surface'))
checklist.append(OptCheck('BINFMT_AOUT', 'is not set', 'ubuntu18', 'cut_attack_surface'))
checklist.append(OptCheck('IO_STRICT_DEVMEM', 'y', 'kspp', 'cut_attack_surface')) checklist.append(OptCheck('IO_STRICT_DEVMEM', 'y', 'kspp', 'cut_attack_surface'))
checklist.append(OptCheck('LEGACY_VSYSCALL_NONE', 'y', 'kspp', 'cut_attack_surface')) # 'vsyscall=none' checklist.append(OptCheck('LEGACY_VSYSCALL_NONE', 'y', 'kspp', 'cut_attack_surface')) # 'vsyscall=none'
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment