Refers to #67.

With this argument the tool generates a Kconfig fragment with the security
hardening options for the selected microarchitecture.

Refers to #67.

This Kconfig fragment can be merged with the existing Linux kernel config:

$ ./bin/kconfig-hardened-check -g X86_64 > /tmp/fragment
$ cd ~/linux-src/
$ ./scripts/kconfig/merge_config.sh .config /tmp/fragment
Using .config as base
Merging /tmp/fragment
Value of CONFIG_BUG_ON_DATA_CORRUPTION is redefined by fragment /tmp/fragment:
Previous value: # CONFIG_BUG_ON_DATA_CORRUPTION is not set
New value: CONFIG_BUG_ON_DATA_CORRUPTION=y
...

See vdso32_setup() in arch/x86/entry/vdso/vdso32-setup.c

See vsyscall_setup() in arch/x86/entry/vsyscall/vsyscall_64.c

See iommu_setup() in arch/x86/kernel/pci-dma.c

See setup_slub_debug() in mm/slub.c

Also fix the rodata check (change '1' to 'on').

See set_debug_rodata() in init/main.c.

See parse_spectre_v4_param() in arch/arm64/kernel/proton-pack.c

Now it's enabled by default for X86_64.

Now functional_test.sh is a common script used both in GitHub Actions
and Woodpecker-CI.

And also test the forgotten .gz kernel config.

We need to check them because these kernel cmdline parameters can
override the COMPAT_VDSO kconfig option.

CONFIG_COMPAT_VDSO disabled ASLR of vDSO only on X86_64 and X86_32.
On ARM64 this option has different meaning (see the mainline commit
7c4791c9efca8c105a86022f7d5532aeaa819125).

Thanks to @izh1979 for the idea

Disabling X86_VSYSCALL_EMULATION turns vsyscall off completely, and
LEGACY_VSYSCALL_NONE can be changed at boot time via the cmdline parameter.

Thanks to @izh1979 for the idea

Use new override_expected_value() for that.

This is needed to avoid wrong recommendations for ARM64 and ARM, where
CONFIG_ARCH_MMAP_RND_BITS_MAX depends on the paging configuration.

SELinux, Smack, Tomoyo, and AppArmor implement Mandatory Access Control (MAC).

Thanks to @izh1979 for the idea

Thanks to @izh1979 for the idea

The CONFIG_CORESIGHT framework provides a kernel interface for the
CoreSight debug and trace drivers for ARM/ARM64. It's better to have it
disabled to cut attack surface.

CONFIG_INTEGRITY is useless without enabling IMA/EVM.
We can't require enabling IMA/EVM because there are other
file system integrity mechanisms like DM_VERITY, FS_VERITY, etc.
So there is no reason to check CONFIG_INTEGRITY.

Refers to #75

Also rename old Android configs