kconfig-hardened-check.git
4 years agoRename some workflow steps
Alexander Popov [Tue, 31 Mar 2020 11:34:38 +0000 (14:34 +0300)]
Rename some workflow steps

4 years agoAdd more tests to increase coverage - III
Alexander Popov [Mon, 30 Mar 2020 20:29:42 +0000 (23:29 +0300)]
Add more tests to increase coverage - III

4 years agoAdd more tests to increase coverage - II
Alexander Popov [Mon, 30 Mar 2020 17:11:00 +0000 (20:11 +0300)]
Add more tests to increase coverage - II

4 years agoAdd more tests to increase coverage - I
Alexander Popov [Mon, 30 Mar 2020 17:06:09 +0000 (20:06 +0300)]
Add more tests to increase coverage - I

4 years agoCollect coverage
Alexander Popov [Mon, 30 Mar 2020 16:08:29 +0000 (19:08 +0300)]
Collect coverage

4 years agoCount checked configs
Alexander Popov [Mon, 30 Mar 2020 13:36:14 +0000 (16:36 +0300)]
Count checked configs

4 years agoCheck all configs automatically
Alexander Popov [Mon, 30 Mar 2020 12:04:26 +0000 (15:04 +0300)]
Check all configs automatically

4 years agoRevisit return values
Alexander Popov [Mon, 30 Mar 2020 11:53:55 +0000 (14:53 +0300)]
Revisit return values

4 years agoCreate the github workflow for functional tests
Alexander Popov [Mon, 30 Mar 2020 09:51:26 +0000 (12:51 +0300)]
Create the github workflow for functional tests

4 years agoFix the shebang to allow `./get-nix-kconfig.py`
Alexander Popov [Sat, 28 Mar 2020 20:58:29 +0000 (23:58 +0300)]
Fix the shebang to allow `./get-nix-kconfig.py`

Thanks to @Mic92

Refers to #27

4 years agoAdd NixOS hardened kernel config
Alexander Popov [Fri, 27 Mar 2020 20:25:02 +0000 (23:25 +0300)]
Add NixOS hardened kernel config

4 years agoFix typo in README
Alexander Popov [Thu, 26 Mar 2020 14:55:56 +0000 (17:55 +0300)]
Fix typo in README

4 years agoAdd vim swp files to gitignore
Alexander Popov [Thu, 26 Mar 2020 13:57:54 +0000 (16:57 +0300)]
Add vim swp files to gitignore

4 years agoMerge branch 'nix'
Alexander Popov [Thu, 26 Mar 2020 13:55:00 +0000 (16:55 +0300)]
Merge branch 'nix'

Refers to #27

4 years agoadd script to download linux kernel configs from nix
Jörg Thalheim [Thu, 2 Jan 2020 10:38:24 +0000 (10:38 +0000)]
add script to download linux kernel configs from nix

4 years agoadd gitignore
Jörg Thalheim [Thu, 2 Jan 2020 08:59:33 +0000 (08:59 +0000)]
add gitignore

4 years agoadd default.nix for installation via nix
Jörg Thalheim [Thu, 2 Jan 2020 08:53:41 +0000 (08:53 +0000)]
add default.nix for installation via nix

Allows installation via nix from the repository itself
on NixOS and other Linux distribution that have Nix (i.e. Archlinux/Debian).

```
$ nix-build
$ ./result/bin/kconfig-hardened-check
$ nix-env -f . -i
```

It also provides an development environment for `nix-shell` with setuptools and
python in path

```
$ nix-shell
```

4 years agoUpdate the README (describing installation)
Alexander Popov [Thu, 26 Mar 2020 12:58:17 +0000 (15:58 +0300)]
Update the README (describing installation)

4 years agoAdd a wrapper for using the tool without installation via setuptools
Alexander Popov [Thu, 26 Mar 2020 12:45:24 +0000 (15:45 +0300)]
Add a wrapper for using the tool without installation via setuptools

4 years agoEnable distribution via pip/setuptools
Alexander Popov [Thu, 26 Mar 2020 12:15:24 +0000 (15:15 +0300)]
Enable distribution via pip/setuptools

Thanks to @Mic92 for the proof-of-concept

Refers to #26

4 years agoCall it a tool
Alexander Popov [Thu, 26 Mar 2020 12:10:50 +0000 (15:10 +0300)]
Call it a tool

4 years agoUh, setuptools doesn't like package names that contain dash
Alexander Popov [Thu, 26 Mar 2020 10:59:26 +0000 (13:59 +0300)]
Uh, setuptools doesn't like package names that contain dash

4 years agoAdd main() and clean up working with globals
Alexander Popov [Wed, 25 Mar 2020 23:13:36 +0000 (02:13 +0300)]
Add main() and clean up working with globals

4 years agoRename to kconfig-hardened-check/__init__.py
Alexander Popov [Wed, 25 Mar 2020 23:10:05 +0000 (02:10 +0300)]
Rename to kconfig-hardened-check/__init__.py

4 years agoMove files to kconfig-hardened-check folder
Alexander Popov [Wed, 25 Mar 2020 22:00:27 +0000 (01:00 +0300)]
Move files to kconfig-hardened-check folder

4 years agoRename LICENSE file
Alexander Popov [Wed, 25 Mar 2020 21:56:54 +0000 (00:56 +0300)]
Rename LICENSE file

4 years agoVersion 0.5.5 (supports Linux kernel v5.5) v0.5.5
Alexander Popov [Tue, 24 Mar 2020 12:54:18 +0000 (15:54 +0300)]
Version 0.5.5 (supports Linux kernel v5.5)

4 years agoUpdate the README
Alexander Popov [Tue, 24 Mar 2020 12:44:49 +0000 (15:44 +0300)]
Update the README

4 years agoCLIP OS recommends disabling Intel TSX
Alexander Popov [Tue, 24 Mar 2020 12:10:37 +0000 (15:10 +0300)]
CLIP OS recommends disabling Intel TSX

4 years agoSmall syctl cleanup
Alexander Popov [Tue, 24 Mar 2020 11:14:20 +0000 (14:14 +0300)]
Small syctl cleanup

4 years agoMerge pull request #34 from madaidan/grapheneos
Alexander Popov [Mon, 23 Mar 2020 15:25:28 +0000 (18:25 +0300)]
Merge pull request #34 from madaidan/grapheneos

GrapheneOS is the continuation of CopperheadOS

4 years agoGrapheneOS is the continuation of CopperheadOS 34/head
madaidan [Sun, 22 Mar 2020 19:34:23 +0000 (19:34 +0000)]
GrapheneOS is the continuation of CopperheadOS

4 years agoCopperheadOS disables the kernel's CONFIG_AIO feature
Alexander Popov [Fri, 20 Mar 2020 20:24:03 +0000 (23:24 +0300)]
CopperheadOS disables the kernel's CONFIG_AIO feature

It isn't used or exposed by the base system and is a dubious feature.
It performs no better than thread pools and it can still block, along
with having coverage of only a tiny portion of blocking system calls
even when considering only commonly used system calls for IO.
There are no known compatibility issues caused by having this disabled.
Since this is such a dubious niche feature, it's also very poorly tested
and it doesn't get much attention. Proposed improvements have been blocked
based on the concern that POSIX AIO is such a bad interface that trying
to improve/extend it would be harmful. Following the lead of CopperheadOS
on this front has been proposed and accepted upstream for the recommended
Android kernel configuration used to derive device specific configurations.

https://github.com/AndroidHardeningArchive/documentation/blob/master/technical_overview.md#attack-surface-reduction

4 years agoKSPP now recommends PAGE_TABLE_ISOLATION for X86_32
Alexander Popov [Fri, 20 Mar 2020 19:56:22 +0000 (22:56 +0300)]
KSPP now recommends PAGE_TABLE_ISOLATION for X86_32

4 years agoUpdate KSPP recommendations
Alexander Popov [Fri, 20 Mar 2020 19:48:15 +0000 (22:48 +0300)]
Update KSPP recommendations

4 years agoINTEL_IOMMU is available for X86_32
Alexander Popov [Wed, 18 Mar 2020 15:03:56 +0000 (18:03 +0300)]
INTEL_IOMMU is available for X86_32

4 years agoMove VMSPLIT_3G to 'userspace_hardening'
Alexander Popov [Wed, 18 Mar 2020 15:03:20 +0000 (18:03 +0300)]
Move VMSPLIT_3G to 'userspace_hardening'

CONFIG_VMSPLIT_3G=y is for maximal userspace memory area and maximal ASLR.

It works both for ARM and X86_32.

4 years agoStyle fix
Alexander Popov [Wed, 18 Mar 2020 11:27:45 +0000 (14:27 +0300)]
Style fix

4 years agoIOMMU_SUPPORT is needed for all architectures
Alexander Popov [Wed, 18 Mar 2020 11:27:17 +0000 (14:27 +0300)]
IOMMU_SUPPORT is needed for all architectures

4 years agoSECURITY_WRITABLE_HOOKS and SECURITY_SELINUX_DISABLE mean the same
Alexander Popov [Wed, 18 Mar 2020 11:06:50 +0000 (14:06 +0300)]
SECURITY_WRITABLE_HOOKS and SECURITY_SELINUX_DISABLE mean the same

4 years agoAdd CLIP OS recommendation about X86_CPUID
Alexander Popov [Wed, 18 Mar 2020 09:18:31 +0000 (12:18 +0300)]
Add CLIP OS recommendation about X86_CPUID

4 years agoFix RANDOM_TRUST_BOOTLOADER check
Alexander Popov [Wed, 18 Mar 2020 09:17:55 +0000 (12:17 +0300)]
Fix RANDOM_TRUST_BOOTLOADER check

4 years agoLOCKDOWN update - part II
Alexander Popov [Wed, 18 Mar 2020 09:16:09 +0000 (12:16 +0300)]
LOCKDOWN update - part II

That commit contains changes in the checks that I made after learning
the upstreamed LOCKDOWN

4 years agoLOCKDOWN update - part I
Alexander Popov [Wed, 18 Mar 2020 09:10:10 +0000 (12:10 +0300)]
LOCKDOWN update - part I

That features didn't change in the upstreamed version of LOCKDOWN

4 years agoDon't restrict arch for "is not set" checks
Alexander Popov [Wed, 18 Mar 2020 08:12:13 +0000 (11:12 +0300)]
Don't restrict arch for "is not set" checks

That would simplify things

4 years agoSECURITY_LOCKDOWN_LSM is recommended by CLIP OS
Alexander Popov [Tue, 17 Mar 2020 17:41:26 +0000 (20:41 +0300)]
SECURITY_LOCKDOWN_LSM is recommended by CLIP OS

4 years agoAdd CONFIG_INTEGRITY for userspace hardening
Alexander Popov [Sun, 8 Mar 2020 21:47:18 +0000 (00:47 +0300)]
Add CONFIG_INTEGRITY for userspace hardening

4 years agoFix the comments
Alexander Popov [Sun, 8 Mar 2020 20:53:52 +0000 (23:53 +0300)]
Fix the comments

4 years agoDon't show all checks from all supported platforms in debug_mode
Alexander Popov [Sun, 8 Mar 2020 20:53:34 +0000 (23:53 +0300)]
Don't show all checks from all supported platforms in debug_mode

4 years agoImprove 'dunno' report in debug_mode
Alexander Popov [Sat, 7 Mar 2020 20:39:23 +0000 (23:39 +0300)]
Improve 'dunno' report in debug_mode

4 years agoAdd SECURITY_LOADPIN_ENFORCE check
Alexander Popov [Fri, 6 Mar 2020 22:15:42 +0000 (01:15 +0300)]
Add SECURITY_LOADPIN_ENFORCE check

4 years agoUpdate CLIP OS kernel security documentation
Alexander Popov [Fri, 6 Mar 2020 22:15:04 +0000 (01:15 +0300)]
Update CLIP OS kernel security documentation

4 years agoAdd CLIP OS recommendation about CONFIG_STAGING
Alexander Popov [Fri, 6 Mar 2020 21:53:06 +0000 (00:53 +0300)]
Add CLIP OS recommendation about CONFIG_STAGING

4 years agoAdd CLIP OS recommendation about CONFIG_RANDOM_TRUST_BOOTLOADER
Alexander Popov [Fri, 6 Mar 2020 21:50:08 +0000 (00:50 +0300)]
Add CLIP OS recommendation about CONFIG_RANDOM_TRUST_BOOTLOADER

4 years agoUpdate the README
Alexander Popov [Fri, 6 Mar 2020 21:37:33 +0000 (00:37 +0300)]
Update the README

4 years agoImprove debug_mode a lot
Alexander Popov [Fri, 6 Mar 2020 21:35:22 +0000 (00:35 +0300)]
Improve debug_mode a lot

The debug_mode enables:
 - reporting about unknown kernel options in the config,
 - showing all checks from all supported platforms,
 - verbose printing of ComplexOptChecks (OR, AND).

4 years agoImprove the table header
Alexander Popov [Fri, 6 Mar 2020 21:31:50 +0000 (00:31 +0300)]
Improve the table header

4 years agoDrop unused OptCheck printing
Alexander Popov [Fri, 6 Mar 2020 21:24:38 +0000 (00:24 +0300)]
Drop unused OptCheck printing

4 years agoUpdate 'decision' for new KSPP recommendations
Alexander Popov [Thu, 5 Mar 2020 20:21:13 +0000 (23:21 +0300)]
Update 'decision' for new KSPP recommendations

4 years agoUpdate KSPP recommendations
Alexander Popov [Thu, 5 Mar 2020 20:11:55 +0000 (23:11 +0300)]
Update KSPP recommendations

4 years agoUpdate the README
Alexander Popov [Thu, 5 Mar 2020 11:07:24 +0000 (14:07 +0300)]
Update the README

4 years agoLDISC_AUTOLOAD can be disabled since v5.1
Alexander Popov [Thu, 5 Mar 2020 10:39:15 +0000 (13:39 +0300)]
LDISC_AUTOLOAD can be disabled since v5.1

This fixes the false positive report about LDISC_AUTOLOAD for old kernels

4 years agoREFCOUNT_FULL is enabled by default since v5.5
Alexander Popov [Thu, 5 Mar 2020 10:38:02 +0000 (13:38 +0300)]
REFCOUNT_FULL is enabled by default since v5.5

4 years agoAdd kernel version checks for complex checks with logical operations
Alexander Popov [Thu, 5 Mar 2020 10:37:32 +0000 (13:37 +0300)]
Add kernel version checks for complex checks with logical operations

Nice, like it :)

And move config_checklist to other globals by the way.

4 years agoAdd kernel version detection
Alexander Popov [Thu, 5 Mar 2020 10:32:43 +0000 (13:32 +0300)]
Add kernel version detection

4 years agoSimplify perform_checks()
Alexander Popov [Thu, 5 Mar 2020 09:07:33 +0000 (12:07 +0300)]
Simplify perform_checks()

4 years agoFix versions in KSPP recommendations
Alexander Popov [Wed, 4 Mar 2020 20:20:19 +0000 (23:20 +0300)]
Fix versions in KSPP recommendations

4 years agoFix the name for ClearLinux config
Alexander Popov [Wed, 4 Mar 2020 14:47:10 +0000 (17:47 +0300)]
Fix the name for ClearLinux config

4 years agoSTACKPROTECTOR_PER_TASK is now default for ARM
Alexander Popov [Wed, 4 Mar 2020 12:38:13 +0000 (15:38 +0300)]
STACKPROTECTOR_PER_TASK is now default for ARM

4 years agoSECURITY_WRITABLE_HOOKS is not disabled by default
Alexander Popov [Wed, 4 Mar 2020 12:29:34 +0000 (15:29 +0300)]
SECURITY_WRITABLE_HOOKS is not disabled by default

4 years agoInclude GCC_PLUGINS to defconfig
Alexander Popov [Wed, 4 Mar 2020 12:26:40 +0000 (15:26 +0300)]
Include GCC_PLUGINS to defconfig

This option is now enabled by default in case of compiler support.

4 years agoUpdate defconfigs (v5.5)
Alexander Popov [Wed, 4 Mar 2020 12:16:47 +0000 (15:16 +0300)]
Update defconfigs (v5.5)

4 years agoMerge branch 'config-updates-from-hackurx'
Alexander Popov [Thu, 27 Feb 2020 17:29:59 +0000 (20:29 +0300)]
Merge branch 'config-updates-from-hackurx'

Refers to PR #31.

Thanks to @HacKurx for his work.

4 years agoUpdate of the kconfig-hardened-check.py part 31/head
Loïc [Wed, 26 Feb 2020 10:10:21 +0000 (11:10 +0100)]
Update of the kconfig-hardened-check.py part

4 years agoAdd link for clearlinux
Loïc [Wed, 26 Feb 2020 09:55:46 +0000 (10:55 +0100)]
Add link for clearlinux

4 years agoAdd clearlinux-master
Loïc [Wed, 26 Feb 2020 09:53:04 +0000 (10:53 +0100)]
Add clearlinux-master

config check is finished: 'OK' - 74 / 'FAIL' - 49

4 years agoUpdate to 5.3.0-28-generic (LTS HWE)
Loïc [Mon, 24 Feb 2020 20:07:51 +0000 (21:07 +0100)]
Update to 5.3.0-28-generic (LTS HWE)

config check is finished: 'OK' - 50 / 'FAIL' - 73

4 years agoRemove debian-stretch.config
Loïc [Mon, 24 Feb 2020 17:41:04 +0000 (18:41 +0100)]
Remove debian-stretch.config

No need to support old stable versions

4 years agoAdd link for amazonlinux2
Loïc [Mon, 24 Feb 2020 17:38:36 +0000 (18:38 +0100)]
Add link for amazonlinux2

4 years agoUpdate to 4.14.165-133.209.amzn2.x86_64
Loïc [Mon, 24 Feb 2020 17:36:23 +0000 (18:36 +0100)]
Update to 4.14.165-133.209.amzn2.x86_64

config check is finished: 'OK' - 44 / 'FAIL' - 79

4 years agoUpdate to 5.4.21
Loïc [Mon, 24 Feb 2020 17:18:48 +0000 (18:18 +0100)]
Update to 5.4.21

config check is finished: 'OK' - 55 / 'FAIL' - 68

4 years agoUpdate to openSUSE-15.1
Loïc [Mon, 24 Feb 2020 17:16:20 +0000 (18:16 +0100)]
Update to openSUSE-15.1

config check is finished: 'OK' - 36 / 'FAIL' - 87

4 years agoUpdate to 5.3.16 (SLE15-SP2)
Loïc [Mon, 24 Feb 2020 17:14:18 +0000 (18:14 +0100)]
Update to 5.3.16 (SLE15-SP2)

config check is finished: 'OK' - 47 / 'FAIL' - 76

4 years agoUpdate to SLE15-SP2 and openSUSE-15.1
Loïc [Mon, 24 Feb 2020 17:12:12 +0000 (18:12 +0100)]
Update to SLE15-SP2 and openSUSE-15.1

4 years agoUpdate to 5.4.21
Loïc [Mon, 24 Feb 2020 17:08:01 +0000 (18:08 +0100)]
Update to 5.4.21

config check is finished: 'OK' - 87 / 'FAIL' - 36

4 years agoUpdate to 5.5.5-pentoo
Loïc [Mon, 24 Feb 2020 17:04:23 +0000 (18:04 +0100)]
Update to 5.5.5-pentoo

config check is finished: 'OK' - 84 / 'FAIL' - 39

4 years agoUpdate of some links
Loïc [Mon, 24 Feb 2020 17:02:25 +0000 (18:02 +0100)]
Update of some links

4 years agoUpdate to 5.4.1 (uek6)
Loïc [Mon, 24 Feb 2020 16:53:48 +0000 (17:53 +0100)]
Update to 5.4.1 (uek6)

config check is finished: 'OK' - 52 / 'FAIL' - 71

4 years agoUpdate to 4.18.0-147.5.1.el8_1.x86_64
Loïc [Mon, 24 Feb 2020 16:47:31 +0000 (17:47 +0100)]
Update to 4.18.0-147.5.1.el8_1.x86_64

config check is finished: 'OK' - 47 / 'FAIL' - 76

4 years agoUpdate to config-4.19.0-8-amd64
Loïc [Mon, 24 Feb 2020 16:43:54 +0000 (17:43 +0100)]
Update to config-4.19.0-8-amd64

config check is finished: 'OK' - 54 / 'FAIL' - 69

4 years agoFix INIT_ON_FREE_DEFAULT_ON vs PAGE_POISONING issue #28
Alexander Popov [Tue, 14 Jan 2020 10:28:25 +0000 (13:28 +0300)]
Fix INIT_ON_FREE_DEFAULT_ON vs PAGE_POISONING issue #28

PAGE_POISONING is a debugging feature.
It provides less erasing than INIT_ON_FREE_DEFAULT_ON.
Join these checks with OR giving preference to INIT_ON_FREE_DEFAULT_ON.

Thanks to @madaidan for the details.

Also drop my previous recommendations about CONFIG_PAGE_POISONING_NO_SANITY
and CONFIG_PAGE_POISONING_ZERO.

4 years agoAnswer the question about CONFIG_PANIC_ON_OOPS
Alexander Popov [Tue, 14 Jan 2020 09:35:38 +0000 (12:35 +0300)]
Answer the question about CONFIG_PANIC_ON_OOPS

Thanks to @madaidan
Refers to #29

4 years agoRecommend disabling VIDEO_VIVID
Alexander Popov [Sat, 11 Jan 2020 12:05:11 +0000 (15:05 +0300)]
Recommend disabling VIDEO_VIVID

The vivid driver is for testing. It doesn't require any special hardware.
It is shipped in Ubuntu, Debian, Arch Linux, SUSE Linux Enterprise and openSUSE.
On Ubuntu the devices created by this driver are available to the normal user,
since Ubuntu applies RW ACL when the user is logged in.

See the disclosure of CVE-2019-18683 which I've found and fixed in vivid driver:
https://www.openwall.com/lists/oss-security/2019/11/02/1

4 years agoTake some ideas from NixOS/nixpkgs hardened kernel config
Alexander Popov [Fri, 10 Jan 2020 14:41:14 +0000 (17:41 +0300)]
Take some ideas from NixOS/nixpkgs hardened kernel config

Add CONFIG_SECURITY_SAFESETID (y) and CONFIG_SECURITY_WRITABLE_HOOKS (n).

Refers to the pull request #27.

4 years agoPretty printing
Alexander Popov [Mon, 2 Dec 2019 14:23:57 +0000 (17:23 +0300)]
Pretty printing

4 years agoVersion 0.5.3 (supports Linux kernel v5.3) v0.5.3
Alexander Popov [Fri, 29 Nov 2019 13:56:32 +0000 (16:56 +0300)]
Version 0.5.3 (supports Linux kernel v5.3)

4 years agoAdd the link to Linux Kernel Defence Map
Alexander Popov [Fri, 29 Nov 2019 13:53:29 +0000 (16:53 +0300)]
Add the link to Linux Kernel Defence Map

4 years agoUpdate the README
Alexander Popov [Fri, 29 Nov 2019 13:25:59 +0000 (16:25 +0300)]
Update the README

4 years agoUpdate defconfigs
Alexander Popov [Fri, 29 Nov 2019 13:22:43 +0000 (16:22 +0300)]
Update defconfigs

4 years agoRANDOMIZE_BASE is now enabled by default on arm64
Alexander Popov [Fri, 29 Nov 2019 13:21:42 +0000 (16:21 +0300)]
RANDOMIZE_BASE is now enabled by default on arm64