Skip to content

K
kernel-hardening-checker
Switch branch/tag
You can move around the graph by using the arrow keys.
Created with Raphaël 2.2.013Oct121097225Sep18223Aug201715141321Jul171110920Jun199831May30281587628Apr27222098728Mar272119151413515Feb14121123Jan222124Dec521Nov923Sep222116111030Aug29201914982Jul19Jun1830Oct2923222119161416Jul15131097330May759Apr86331Mar302927262423222018179875427Feb262414Jan11102Dec29Nov2823Aug228Jul724Jun543127May171220Mar131211424Jan2322211521Dec13768Aug30Jul282524201454322Jun2120Update the UBSAN checks according to the KSPP recommendationsUpdate the security policy checks adopted by KSPPUpdate the KSPP recommendationsImprove the READMEUpdate the READMEDrop some of my security policy recommendationsCheck SECURITY_SELINUX_DEVELOP (recommended by Clip OS)Check SECURITY_SELINUX_BOOTPARAM (recommended by Clip OS)Improve the HW_RANDOM_TPM checkCheck COREDUMP (recommended by Clip OS)Check CONFIG_HW_RANDOM_TPM (recommended by Clip OS)Check X86_MCE, X86_MCE_INTEL, X86_MCE_AMD (recommended by Clip OS)Improve the READMEUpdate the READMEAlso check 'nospectre_v2' with 'spectre_v2'Change the reason for the 'nopti' checkChange the reason for the 'nokaslr' checkAdd the 'spectre_v2' checkAdd the 'nospectre_v2' checkChange the reason for the 'nosmep' and 'nosmap' checksAdd the 'nospectre_v1' checkAdd the 'nopti' checkAdd the comments: CC_IS_GCC and CC_IS_CLANG exist since v4.18Add the UBSAN_LOCAL_BOUNDS check for Clang buildUpdate the links to AOSP and GKIUpdate the READMEDetect the compiler used for the kernel compilationDon't use CONFIG_CC_IS_GCC in the checks (it was introduced only in v4.18)Move get-nix-kconfig.py to kconfig_hardened_check/config_files/distrosFix the X86_SMAP check: it is enabled by default since v5.19Check the nosmap and nosmep cmdline parametersAdapt the RANDSTRUCT checks to the changes in Linux 5.19Fix the comment: SHADOW_CALL_STACK is now available for gcc (Linux 5.18)Add the SECURITY_LANDLOCK recommendation by KSPPCheck the nokaslr cmdline parameterRequire GCC for the GCC plugins (part II)Require GCC for the GCC pluginsIntroduce cc_is_gcc and cc_is_clangNo, the 'page_alloc.shuffle' should be set anywayDrop the comment about slub_debug=FZ