Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
K
kernel-hardening-checker
Overview
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
fact-depend
kernel-hardening-checker
Graph
bbfddf66cbbc57edda6d130e6e9b7c676f58d09a
Switch branch/tag
You can move around the graph by using the arrow keys.
Begin with the selected commit
Created with Raphaël 2.2.0
14
Aug
9
8
2
Jul
19
Jun
18
30
Oct
29
23
22
21
19
16
14
16
Jul
15
13
10
9
7
3
30
May
7
5
9
Apr
8
6
3
31
Mar
30
29
27
26
24
23
22
20
18
17
9
8
7
5
4
27
Feb
26
24
14
Jan
11
10
2
Dec
29
Nov
28
23
Aug
22
8
Jul
7
24
Jun
5
4
3
1
27
May
17
12
20
Mar
13
12
11
4
24
Jan
23
22
21
15
21
Dec
13
7
6
8
Aug
30
Jul
28
25
24
20
14
5
4
3
22
Jun
21
20
Add the command line parameters that should NOT be set
Document the changes of vm.unprivileged_userfaultfd in v5.11
Add the news about PAGE_POISONING
Improve wording
Update the README.
v0.5.10
v0.5.10
Fix pylint warning
Remember that SHADOW_CALL_STACK depends on clang
STACKPROTECTOR_PER_TASK is also available for ARM64
INTEL_IOMMU_SVM is available only for X86_64
Reorder arch checks
SECURITY_DMESG_RESTRICT is recommended by KSPP now
Think about kptr_restrict later (KSPP recommends to set it to 1)
Mention that nosmt is slow
More info on init_on_free and init_on_alloc
SLUB_DEBUG_ON is very slow, leave it for the kernel command line
Update KSPP recommendations
Add defconfigs for v5.10
HARDEN_BRANCH_PREDICTOR for ARM64 is enabled by default since v5.10
Add ARM64_MTE for userspace
Maybe SHADOW_CALL_STACK should be alternative to STACKPROTECTOR_STRONG
Save 'debugfs=no-mount' for future
Update the README.
v0.5.9
v0.5.9
Fix indentation (thanks to pylint)
Add a Q&A about spectre-meltdown-checker maintained by @speed47
INIT_STACK_ALL -> INIT_STACK_ALL_ZERO (was renamed)
Add SHADOW_CALL_STACK for ARM64
Add the recommendation about TRIM_UNUSED_KSYMS
Add ARM64_BTI_KERNEL
Add the recommendation about UBSAN_BOUNDS
PAGE_POISONING -> PAGE_POISONING_ZERO
Improve AND check reports
Improve HARDEN_EL2_VECTORS check
Merge remote-tracking branch 'pgils/el2_vectors'
Add nested ComplexOptChecks support
Do not check CONFIG_HARDEN_EL2_VECTORS for v5.9+
Add TODO about SLUB_DEBUG_ON
Add CLIP OS recommendation about EFI_CUSTOM_SSDT_OVERLAYS
Disabling ACPI_TABLE_UPGRADE is now recommended by CLIP OS
Withdraw my recommendation about BPF_JIT
Use cross compiler to build defconfigs