Commits · 57379d8c851656116e2b149e3f1d4003c17d22d9 · fact-depend / kernel-hardening-checker

20 Aug, 2021 2 commits
- Merge pull request #51 from Hacks4Snacks/master · 57379d8c
```
Added the CBL-Mariner kernel configuration file.
```
  Alexander Popov authored Aug 20, 2021
  57379d8c Browse Files
- Added Linux/x86_64 kernel config link for CBL-Mariner · a5686b11
  Mark D. Gray authored Aug 20, 2021
  
  a5686b11 Browse Files
19 Aug, 2021 1 commit
- Added cbl-mariner kernel configuration file. · fb55e4c8
  Mark D. Gray authored Aug 19, 2021
  
  fb55e4c8 Browse Files
14 Aug, 2021 2 commits
- Add hardware tag-based KASAN with arm64 Memory Tagging Extension · 38bde65d
  Alexander Popov authored Aug 14, 2021
  
  38bde65d Browse Files
- Add the command line parameters that should NOT be set · 2b5bf354
  Alexander Popov authored Aug 14, 2021
  
  2b5bf354 Browse Files
08 Aug, 2021 2 commits

Document the changes of vm.unprivileged_userfaultfd in v5.11 · b7d33ca9

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=37cd0575b8510159992d279c530c05f872990b02
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d0d4730ac2e404a5b0da9a87ef38c73e51cb1664

authored Aug 09, 2021

b7d33ca9 Browse Files

Add the news about PAGE_POISONING · 4f2124b5

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f289041ed4cf9a3f6e8a32068fef9ffb2acc5662
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8f424750baaafcef229791882e879da01c9473b5

authored Aug 08, 2021

4f2124b5 Browse Files

02 Jul, 2021 1 commit
- Improve wording · 5e4fba66
  Alexander Popov authored Jul 02, 2021
  
  5e4fba66 Browse Files
19 Jun, 2021 14 commits
- Update the README. · f5277e58
```
Ready for the release 0.5.10.
```
  Alexander Popov authored Jun 19, 2021
  f5277e58 Browse Files
- Fix pylint warning · 68622ad2
  Alexander Popov authored Jun 19, 2021
  
  68622ad2 Browse Files
- Remember that SHADOW_CALL_STACK depends on clang · 25cb2389
  Alexander Popov authored Jun 19, 2021
  
  25cb2389 Browse Files
- STACKPROTECTOR_PER_TASK is also available for ARM64 · 31767839
  Alexander Popov authored Jun 19, 2021
  
  31767839 Browse Files
- INTEL_IOMMU_SVM is available only for X86_64 · f8b12633
  Alexander Popov authored Jun 19, 2021
  
  f8b12633 Browse Files
- Reorder arch checks · 3b2a9440
  Alexander Popov authored Jun 19, 2021
  
  3b2a9440 Browse Files
- SECURITY_DMESG_RESTRICT is recommended by KSPP now · d1a8bb6a
  Alexander Popov authored Jun 19, 2021
  
  d1a8bb6a Browse Files
- Think about kptr_restrict later (KSPP recommends to set it to 1) · a486a640
  Alexander Popov authored Jun 19, 2021
  
  a486a640 Browse Files
- Mention that nosmt is slow · 361e571e
  Alexander Popov authored Jun 19, 2021
  
  361e571e Browse Files
- More info on init_on_free and init_on_alloc · 495d4374
  Alexander Popov authored Jun 19, 2021
  
  495d4374 Browse Files
- SLUB_DEBUG_ON is very slow, leave it for the kernel command line · 4c4f2527
  Alexander Popov authored Jun 19, 2021
  
  4c4f2527 Browse Files
- Update KSPP recommendations · 29de5cc2
  Alexander Popov authored Jun 19, 2021
  
  29de5cc2 Browse Files
- Add defconfigs for v5.10 · fb4d95bd
```
Made with updated https://github.com/a13xp0p0v/kernel-build-containers

Excellent!
```
  Alexander Popov authored Jun 19, 2021
  fb4d95bd Browse Files
- HARDEN_BRANCH_PREDICTOR for ARM64 is enabled by default since v5.10 · 12d6535d
  Alexander Popov authored Jun 19, 2021
  
  12d6535d Browse Files
18 Jun, 2021 3 commits
- Add ARM64_MTE for userspace · 2bc87b84
  Alexander Popov authored Jun 19, 2021
  
  2bc87b84 Browse Files
- Maybe SHADOW_CALL_STACK should be alternative to STACKPROTECTOR_STRONG · 029bd7f4
  Alexander Popov authored Jun 19, 2021
  
  029bd7f4 Browse Files
- Save 'debugfs=no-mount' for future · ff5a84ba
  Alexander Popov authored Jun 18, 2021
  
  ff5a84ba Browse Files
30 Oct, 2020 2 commits
- Update the README. · 2f8e7a4d
```
Ready for the release 0.5.9.
```
  Alexander Popov authored Oct 30, 2020
  2f8e7a4d Browse Files
- Fix indentation (thanks to pylint) · fbaf5df4
  Alexander Popov authored Oct 30, 2020
  
  fbaf5df4 Browse Files
29 Oct, 2020 1 commit
- Add a Q&A about spectre-meltdown-checker maintained by @speed47 · 6cf7b9be
  Alexander Popov authored Oct 29, 2020
  
  6cf7b9be Browse Files
23 Oct, 2020 2 commits
- INIT_STACK_ALL -> INIT_STACK_ALL_ZERO (was renamed) · 0a728e14
  Alexander Popov authored Oct 23, 2020
  
  0a728e14 Browse Files
- Add SHADOW_CALL_STACK for ARM64 · 29700a52
  Alexander Popov authored Oct 23, 2020
  
  29700a52 Browse Files
22 Oct, 2020 7 commits
- Add the recommendation about TRIM_UNUSED_KSYMS · 1ce2fdcf
  Alexander Popov authored Oct 22, 2020
  
  1ce2fdcf Browse Files
- Add ARM64_BTI_KERNEL · f9438fcc
  Alexander Popov authored Oct 22, 2020
  
  f9438fcc Browse Files
- Add the recommendation about UBSAN_BOUNDS · e1652891
```
Enable UBSAN_BOUNDS and UBSAN_TRAP.
But keep UBSAN_MISC disabled to avoid useless reports.
```
  Alexander Popov authored Oct 22, 2020
  e1652891 Browse Files
- PAGE_POISONING -> PAGE_POISONING_ZERO · 4dcb0cdd
```
In fact, KSPP recommends PAGE_POISONING_ZERO.
```
  Alexander Popov authored Oct 22, 2020
  4dcb0cdd Browse Files
- Improve AND check reports · 1a789f4b
  Alexander Popov authored Oct 22, 2020
  
  1a789f4b Browse Files
- Improve HARDEN_EL2_VECTORS check · 45bb1e8f
```
In fact HARDEN_EL2_VECTORS was included in RANDOMIZE_BASE in v5.9.
Use new nested ComplexOptChecks for this rule.

Refers to #48.
```
  Alexander Popov authored Oct 22, 2020
  45bb1e8f Browse Files
- Merge remote-tracking branch 'pgils/el2_vectors' · 4e739dbf
```
Thanks, @pgils.

Refers to #48.
```
  Alexander Popov authored Oct 22, 2020
  4e739dbf Browse Files
21 Oct, 2020 1 commit
- Add nested ComplexOptChecks support · cbd83d73
```
Now we can do things like OR(opt1, AND(opt2, opt3)).
Cool!

Refers to #48
```
  Alexander Popov authored Oct 21, 2020
  cbd83d73 Browse Files
19 Oct, 2020 1 commit
- Do not check CONFIG_HARDEN_EL2_VECTORS for v5.9+ · 4425d8b2
  Pelle van Gils authored Oct 19, 2020
  
  4425d8b2 Browse Files
16 Oct, 2020 1 commit
- Add TODO about SLUB_DEBUG_ON · 150c5ae7
  Alexander Popov authored Oct 16, 2020
  
  150c5ae7 Browse Files