Commits · e13e1c6216d05c56cef13930a6c6fd7ab2c1c67b · fact-depend / kernel-hardening-checker

18 Mar, 2022 2 commits
- THREAD_INFO_IN_TASK is available for ARM since v5.16 · e13e1c62
  Alexander Popov authored Mar 19, 2022
  
  e13e1c62 Browse Files
- Merge branch 'from-martin-rowe' · a1ff5941
```
Refers to #59.

Thanks @cyanidium
```
  Alexander Popov authored Mar 19, 2022
  a1ff5941 Browse Files
15 Mar, 2022 1 commit

EFI mitigations can't be enabled if EFI is not set · 5d1fb1f8

Both EFI_DISABLE_PCI_DMA and RESET_ATTACK_MITIGATION depend on EFI, but if EFI is not set, neither config is required.

Useful on embedded devices that use u-boot or similar instead of EFI.

authored Mar 15, 2022

5d1fb1f8 Browse Files

13 Mar, 2022 4 commits
- Fix the BPF_UNPRIV_DEFAULT_OFF check (it is enabled by default) · 860834d9
  Alexander Popov authored Mar 14, 2022
  
  860834d9 Browse Files
- Add CONFIG_SLS vs CVE-2021-26341 in Straight-Line-Speculation · a758ea69
  Alexander Popov authored Mar 13, 2022
  
  a758ea69 Browse Files
- Add the comment that l1d_flush is a part of the l1tf option · 6268a310
  Alexander Popov authored Mar 13, 2022
  
  6268a310 Browse Files
- Add BPF_UNPRIV_DEFAULT_OFF to cut_attack_surface · 1bd5e61d
  Alexander Popov authored Mar 13, 2022
  
  1bd5e61d Browse Files
05 Mar, 2022 2 commits
- Use the option type instead of calling hasattr() · 02497357
  Alexander Popov authored Mar 05, 2022
  
  02497357 Browse Files
- Merge branch 'refactoring' · 03839d42
```
It has more preparations for solving #46.
```
  Alexander Popov authored Mar 05, 2022
  03839d42 Browse Files
14 Feb, 2022 8 commits
- Introduce the json_dump() class method · 38b6bbb2
  Alexander Popov authored Feb 15, 2022
  
  38b6bbb2 Browse Files
- Improve 'type' for ComplexOptCheck and PresenceCheck classes · b68df4d3
  Alexander Popov authored Feb 15, 2022
  
  b68df4d3 Browse Files
- Make populate_with_data() aware of data type · b96571d3
  Alexander Popov authored Feb 15, 2022
  
  b96571d3 Browse Files
- Add 'type' for PresenceCheck and VersionCheck · 79beb2da
  Alexander Popov authored Feb 14, 2022
  
  79beb2da Browse Files
- Rename VerCheck to VersionCheck · 466b9a84
  Alexander Popov authored Feb 14, 2022
  
  466b9a84 Browse Files
- Add more ComplexOptCheck validation · d0b69420
  Alexander Popov authored Feb 14, 2022
  
  d0b69420 Browse Files
- Improve print_unknown_options() · 866d3c07
```
Don't miss options behind the second level of ComplexOptCheck
```
  Alexander Popov authored Feb 14, 2022
  866d3c07 Browse Files
- Remove 'CONFIG_' hardcoding · 70975c39
  Alexander Popov authored Feb 14, 2022
  
  70975c39 Browse Files
11 Feb, 2022 3 commits
- Merge branch 'refactoring' · 66dcf26d
```
It has preparations for solving #46.
```
  Alexander Popov authored Feb 12, 2022
  66dcf26d Browse Files
- Refactor the OR logic code · 3d9f2f8b
  Alexander Popov authored Feb 12, 2022
  
  3d9f2f8b Browse Files
- Rename config to kconfig where needed (part II) · 922ac4d7
  Alexander Popov authored Feb 11, 2022
  
  922ac4d7 Browse Files
22 Jan, 2022 4 commits
- Extract populate_with_data() from perform_checks() · f4ecbe8a
  Alexander Popov authored Jan 23, 2022
  
  f4ecbe8a Browse Files
- Rename config to kconfig where needed · 55690d46
  Alexander Popov authored Jan 23, 2022
  
  55690d46 Browse Files
- Print the type of a check in the json mode · 3b428f9b
  Alexander Popov authored Jan 23, 2022
  
  3b428f9b Browse Files
- ComplexOptCheck type has the type of the first opt in it · 544d7841
  Alexander Popov authored Jan 23, 2022
  
  544d7841 Browse Files
21 Jan, 2022 8 commits
- Update the example output in the README (yes, now I like it!) · b12077a9
  Alexander Popov authored Jan 22, 2022
  
  b12077a9 Browse Files
- Do more output tuning · ad724694
  Alexander Popov authored Jan 22, 2022
  
  ad724694 Browse Files
- Update the example output in the README · 9049d3fa
  Alexander Popov authored Jan 22, 2022
  
  9049d3fa Browse Files
- Add check type · 6bd5fe15
  Alexander Popov authored Jan 22, 2022
  
  6bd5fe15 Browse Files
- Update the example output in the README · 25f10dd0
  Alexander Popov authored Jan 22, 2022
  
  25f10dd0 Browse Files
- Print compactly · 33c6dcbf
  Alexander Popov authored Jan 22, 2022
  
  33c6dcbf Browse Files
- Introduce KconfigCheck class · 5e9f4868
  Alexander Popov authored Jan 22, 2022
  
  5e9f4868 Browse Files
- Fix TRIM_UNUSED_KSYMS check · 7ed482ba
```
TRIM_UNUSED_KSYMS can't be enabled if MODULES are disabled.

Thanks to @Churam for reporting.
Refers to #58.
```
  Alexander Popov authored Jan 21, 2022
  7ed482ba Browse Files
24 Dec, 2021 1 commit
- Add l1d_flush (for future reference) · 1076c7b8
  Alexander Popov authored Dec 24, 2021
  
  1076c7b8 Browse Files
05 Dec, 2021 1 commit
- Add ARM64_PTR_AUTH_KERNEL extracted from ARM64_PTR_AUTH · 3e435f08
  Alexander Popov authored Dec 05, 2021
  
  3e435f08 Browse Files
21 Nov, 2021 2 commits
- Document the output modes specified by the `-m` parameter · 69b66ef3
  Alexander Popov authored Nov 21, 2021
  
  69b66ef3 Browse Files
- TODO: RISC-V · d8d144c1
```
See #56
```
  Alexander Popov authored Nov 21, 2021
  d8d144c1 Browse Files
09 Nov, 2021 4 commits
- Update the README (a lot of new checks appeared) · 7cfd2088
  Alexander Popov authored Nov 09, 2021
  
  7cfd2088 Browse Files
- Keep the old X86_PTDUMP check as a backup · 96770e5b
  Alexander Popov authored Nov 09, 2021
  
  96770e5b Browse Files
- Simplify the check about PTDUMP_DEBUGFS (I was correct) · 406370ec
  Alexander Popov authored Nov 09, 2021
  
  406370ec Browse Files
- Add more checks from grsecurity for cutting attack surface (part II) · 39c7c286
```
This includes:
 - KCMP
 - RSEQ
 - LATENCYTOP
 - KCOV
 - PROVIDE_OHCI1394_DMA_INIT
 - SUNRPC_DEBUG
 - FAIL_FUTEX
 - KPROBE_EVENTS
 - UPROBE_EVENTS
 - FUNCTION_TRACER
 - STACK_TRACER
 - HIST_TRIGGERS
 - BLK_DEV_IO_TRACE
```
  Alexander Popov authored Nov 09, 2021
  39c7c286 Browse Files