1 # kconfig-hardened-check
3 
4 [](https://codecov.io/gh/a13xp0p0v/kconfig-hardened-check)
8 There are plenty of security hardening options in the Linux kernel. A lot of them are
9 not enabled by the major distros. We have to enable these options ourselves to
10 make our systems more secure.
12 But nobody likes checking configs manually. So let the computers do their job!
14 __kconfig-hardened-check.py__ helps me to check the Linux kernel Kconfig option list
15 against my security hardening preferences, which are based on the
17 - [KSPP recommended settings][1],
18 - [CLIP OS kernel configuration][2],
19 - Last public [grsecurity][3] patch (options which they disable),
20 - [SECURITY_LOCKDOWN_LSM][5] patchset,
21 - Direct feedback from Linux kernel maintainers (see [#38][6], [#53][15], [#54][16]).
23 I also created [__Linux Kernel Defence Map__][4] that is a graphical representation of the
24 relationships between security hardening features and the corresponding vulnerability classes
25 or exploitation techniques.
27 ## Supported microarchitectures
38 You can install the package:
41 pip install git+https://github.com/a13xp0p0v/kconfig-hardened-check
44 or simply run `./bin/kconfig-hardened-check` from the cloned repository.
46 Some Linux distributions also provide `kconfig-hardened-check` as a package.
50 usage: kconfig-hardened-check [-h] [--version] [-p {X86_64,X86_32,ARM64,ARM}]
52 [-m {verbose,json,show_ok,show_fail}]
54 A tool for checking the security hardening options of the Linux kernel
57 -h, --help show this help message and exit
58 --version show program's version number and exit
59 -p {X86_64,X86_32,ARM64,ARM}, --print {X86_64,X86_32,ARM64,ARM}
60 print security hardening preferences for the selected architecture
61 -c CONFIG, --config CONFIG
62 check the kernel config file against these preferences
63 -m {verbose,json,show_ok,show_fail}, --mode {verbose,json,show_ok,show_fail}
64 choose the report mode
69 - no `-m` argument for the default output mode (see the example below)
70 - `-m verbose` for printing additional info:
71 - config options without a corresponding check
72 - internals of complex checks with AND/OR, like this:
74 -------------------------------------------------------------------------------------------
76 CONFIG_STRICT_DEVMEM | y |defconfig | cut_attack_surface
77 CONFIG_DEVMEM | is not set | kspp | cut_attack_surface
78 -------------------------------------------------------------------------------------------
80 - `-m show_fail` for showing only the failed checks
81 - `-m show_ok` for showing only the successful checks
82 - `-m json` for printing the results in JSON format (for combining `kconfig-hardened-check` with other tools)
84 ## Example output for `Ubuntu 20.04 LTS (Focal Fossa)` kernel config
86 $ ./bin/kconfig-hardened-check -c kconfig_hardened_check/config_files/distros/ubuntu-focal.config
87 [+] Kconfig file to check: kconfig_hardened_check/config_files/distros/ubuntu-focal.config
88 [+] Detected architecture: X86_64
89 [+] Detected kernel version: 5.4
90 =========================================================================================================================
91 option name | type |desired val | decision | reason | check result
92 =========================================================================================================================
93 CONFIG_BUG |kconfig| y |defconfig | self_protection | OK
94 CONFIG_SLUB_DEBUG |kconfig| y |defconfig | self_protection | OK
95 CONFIG_GCC_PLUGINS |kconfig| y |defconfig | self_protection | FAIL: not found
96 CONFIG_STACKPROTECTOR |kconfig| y |defconfig | self_protection | OK
97 CONFIG_STACKPROTECTOR_STRONG |kconfig| y |defconfig | self_protection | OK
98 CONFIG_STRICT_KERNEL_RWX |kconfig| y |defconfig | self_protection | OK
99 CONFIG_STRICT_MODULE_RWX |kconfig| y |defconfig | self_protection | OK
100 CONFIG_REFCOUNT_FULL |kconfig| y |defconfig | self_protection | FAIL: "is not set"
101 CONFIG_THREAD_INFO_IN_TASK |kconfig| y |defconfig | self_protection | OK
102 CONFIG_IOMMU_SUPPORT |kconfig| y |defconfig | self_protection | OK
103 CONFIG_RANDOMIZE_BASE |kconfig| y |defconfig | self_protection | OK
104 CONFIG_VMAP_STACK |kconfig| y |defconfig | self_protection | OK
105 CONFIG_MICROCODE |kconfig| y |defconfig | self_protection | OK
106 CONFIG_RETPOLINE |kconfig| y |defconfig | self_protection | OK
107 CONFIG_X86_SMAP |kconfig| y |defconfig | self_protection | OK
108 CONFIG_SYN_COOKIES |kconfig| y |defconfig | self_protection | OK
109 CONFIG_X86_UMIP |kconfig| y |defconfig | self_protection | OK: CONFIG_X86_INTEL_UMIP "y"
110 CONFIG_PAGE_TABLE_ISOLATION |kconfig| y |defconfig | self_protection | OK
111 CONFIG_RANDOMIZE_MEMORY |kconfig| y |defconfig | self_protection | OK
112 CONFIG_INTEL_IOMMU |kconfig| y |defconfig | self_protection | OK
113 CONFIG_AMD_IOMMU |kconfig| y |defconfig | self_protection | OK
114 CONFIG_SECURITY_DMESG_RESTRICT |kconfig| y | kspp | self_protection | FAIL: "is not set"
115 CONFIG_BUG_ON_DATA_CORRUPTION |kconfig| y | kspp | self_protection | FAIL: "is not set"
116 CONFIG_DEBUG_WX |kconfig| y | kspp | self_protection | OK
117 CONFIG_SCHED_STACK_END_CHECK |kconfig| y | kspp | self_protection | OK
118 CONFIG_SLAB_FREELIST_HARDENED |kconfig| y | kspp | self_protection | OK
119 CONFIG_SLAB_FREELIST_RANDOM |kconfig| y | kspp | self_protection | OK
120 CONFIG_SHUFFLE_PAGE_ALLOCATOR |kconfig| y | kspp | self_protection | OK
121 CONFIG_FORTIFY_SOURCE |kconfig| y | kspp | self_protection | OK
122 CONFIG_DEBUG_LIST |kconfig| y | kspp | self_protection | FAIL: "is not set"
123 CONFIG_DEBUG_SG |kconfig| y | kspp | self_protection | FAIL: "is not set"
124 CONFIG_DEBUG_CREDENTIALS |kconfig| y | kspp | self_protection | FAIL: "is not set"
125 CONFIG_DEBUG_NOTIFIERS |kconfig| y | kspp | self_protection | FAIL: "is not set"
126 CONFIG_INIT_ON_ALLOC_DEFAULT_ON |kconfig| y | kspp | self_protection | OK
127 CONFIG_GCC_PLUGIN_LATENT_ENTROPY |kconfig| y | kspp | self_protection | FAIL: not found
128 CONFIG_KFENCE |kconfig| y | kspp | self_protection | FAIL: not found
129 CONFIG_WERROR |kconfig| y | kspp | self_protection | FAIL: not found
130 CONFIG_IOMMU_DEFAULT_DMA_STRICT |kconfig| y | kspp | self_protection | FAIL: not found
131 CONFIG_ZERO_CALL_USED_REGS |kconfig| y | kspp | self_protection | FAIL: not found
132 CONFIG_GCC_PLUGIN_RANDSTRUCT |kconfig| y | kspp | self_protection | FAIL: not found
133 CONFIG_HARDENED_USERCOPY |kconfig| y | kspp | self_protection | OK
134 CONFIG_HARDENED_USERCOPY_FALLBACK |kconfig| is not set | kspp | self_protection | FAIL: "y"
135 CONFIG_HARDENED_USERCOPY_PAGESPAN |kconfig| is not set | kspp | self_protection | OK
136 CONFIG_MODULE_SIG |kconfig| y | kspp | self_protection | OK
137 CONFIG_MODULE_SIG_ALL |kconfig| y | kspp | self_protection | OK
138 CONFIG_MODULE_SIG_SHA512 |kconfig| y | kspp | self_protection | OK
139 CONFIG_MODULE_SIG_FORCE |kconfig| y | kspp | self_protection | FAIL: "is not set"
140 CONFIG_INIT_STACK_ALL_ZERO |kconfig| y | kspp | self_protection | FAIL: not found
141 CONFIG_INIT_ON_FREE_DEFAULT_ON |kconfig| y | kspp | self_protection | OK: CONFIG_PAGE_POISONING_ZERO "y"
142 CONFIG_GCC_PLUGIN_STACKLEAK |kconfig| y | kspp | self_protection | FAIL: not found
143 CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT |kconfig| y | kspp | self_protection | FAIL: not found
144 CONFIG_SCHED_CORE |kconfig| y | kspp | self_protection | FAIL: not found
145 CONFIG_DEFAULT_MMAP_MIN_ADDR |kconfig| 65536 | kspp | self_protection | OK
146 CONFIG_UBSAN_BOUNDS |kconfig| y |maintainer| self_protection | FAIL: not found
147 CONFIG_UBSAN_SANITIZE_ALL |kconfig| y |maintainer| self_protection | FAIL: CONFIG_UBSAN_BOUNDS not "y"
148 CONFIG_UBSAN_TRAP |kconfig| y |maintainer| self_protection | FAIL: CONFIG_UBSAN_BOUNDS not "y"
149 CONFIG_DEBUG_VIRTUAL |kconfig| y | clipos | self_protection | FAIL: "is not set"
150 CONFIG_STATIC_USERMODEHELPER |kconfig| y | clipos | self_protection | FAIL: "is not set"
151 CONFIG_EFI_DISABLE_PCI_DMA |kconfig| y | clipos | self_protection | FAIL: not found
152 CONFIG_SLAB_MERGE_DEFAULT |kconfig| is not set | clipos | self_protection | FAIL: "y"
153 CONFIG_RANDOM_TRUST_BOOTLOADER |kconfig| is not set | clipos | self_protection | FAIL: "y"
154 CONFIG_RANDOM_TRUST_CPU |kconfig| is not set | clipos | self_protection | FAIL: "y"
155 CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE|kconfig| is not set | clipos | self_protection | FAIL: CONFIG_GCC_PLUGIN_RANDSTRUCT not "y"
156 CONFIG_STACKLEAK_METRICS |kconfig| is not set | clipos | self_protection | FAIL: CONFIG_GCC_PLUGIN_STACKLEAK not "y"
157 CONFIG_STACKLEAK_RUNTIME_DISABLE |kconfig| is not set | clipos | self_protection | FAIL: CONFIG_GCC_PLUGIN_STACKLEAK not "y"
158 CONFIG_INTEL_IOMMU_DEFAULT_ON |kconfig| y | clipos | self_protection | FAIL: "is not set"
159 CONFIG_INTEL_IOMMU_SVM |kconfig| y | clipos | self_protection | OK
160 CONFIG_RESET_ATTACK_MITIGATION |kconfig| y | my | self_protection | OK
161 CONFIG_SLS |kconfig| y | my | self_protection | FAIL: not found
162 CONFIG_AMD_IOMMU_V2 |kconfig| y | my | self_protection | FAIL: "m"
163 CONFIG_SECURITY |kconfig| y |defconfig | security_policy | OK
164 CONFIG_SECURITY_YAMA |kconfig| y | kspp | security_policy | OK
165 CONFIG_SECURITY_SELINUX_DISABLE |kconfig| is not set | kspp | security_policy | OK
166 CONFIG_SECURITY_LOCKDOWN_LSM |kconfig| y | clipos | security_policy | OK
167 CONFIG_SECURITY_LOCKDOWN_LSM_EARLY |kconfig| y | clipos | security_policy | OK
168 CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY|kconfig| y | clipos | security_policy | FAIL: "is not set"
169 CONFIG_SECURITY_WRITABLE_HOOKS |kconfig| is not set | my | security_policy | OK: not found
170 CONFIG_SECURITY_SAFESETID |kconfig| y | my | security_policy | OK
171 CONFIG_SECURITY_LOADPIN |kconfig| y | my | security_policy | FAIL: "is not set"
172 CONFIG_SECURITY_LOADPIN_ENFORCE |kconfig| y | my | security_policy | FAIL: CONFIG_SECURITY_LOADPIN not "y"
173 CONFIG_BPF_UNPRIV_DEFAULT_OFF |kconfig| y |defconfig |cut_attack_surface| FAIL: not found
174 CONFIG_SECCOMP |kconfig| y |defconfig |cut_attack_surface| OK
175 CONFIG_SECCOMP_FILTER |kconfig| y |defconfig |cut_attack_surface| OK
176 CONFIG_STRICT_DEVMEM |kconfig| y |defconfig |cut_attack_surface| OK
177 CONFIG_ACPI_CUSTOM_METHOD |kconfig| is not set | kspp |cut_attack_surface| OK
178 CONFIG_COMPAT_BRK |kconfig| is not set | kspp |cut_attack_surface| OK
179 CONFIG_DEVKMEM |kconfig| is not set | kspp |cut_attack_surface| OK
180 CONFIG_COMPAT_VDSO |kconfig| is not set | kspp |cut_attack_surface| OK
181 CONFIG_BINFMT_MISC |kconfig| is not set | kspp |cut_attack_surface| FAIL: "m"
182 CONFIG_INET_DIAG |kconfig| is not set | kspp |cut_attack_surface| FAIL: "m"
183 CONFIG_KEXEC |kconfig| is not set | kspp |cut_attack_surface| FAIL: "y"
184 CONFIG_PROC_KCORE |kconfig| is not set | kspp |cut_attack_surface| FAIL: "y"
185 CONFIG_LEGACY_PTYS |kconfig| is not set | kspp |cut_attack_surface| FAIL: "y"
186 CONFIG_HIBERNATION |kconfig| is not set | kspp |cut_attack_surface| FAIL: "y"
187 CONFIG_IA32_EMULATION |kconfig| is not set | kspp |cut_attack_surface| FAIL: "y"
188 CONFIG_X86_X32 |kconfig| is not set | kspp |cut_attack_surface| FAIL: "y"
189 CONFIG_MODIFY_LDT_SYSCALL |kconfig| is not set | kspp |cut_attack_surface| FAIL: "y"
190 CONFIG_OABI_COMPAT |kconfig| is not set | kspp |cut_attack_surface| OK: not found
191 CONFIG_X86_MSR |kconfig| is not set | kspp |cut_attack_surface| FAIL: "m"
192 CONFIG_MODULES |kconfig| is not set | kspp |cut_attack_surface| FAIL: "y"
193 CONFIG_DEVMEM |kconfig| is not set | kspp |cut_attack_surface| FAIL: "y"
194 CONFIG_IO_STRICT_DEVMEM |kconfig| y | kspp |cut_attack_surface| FAIL: "is not set"
195 CONFIG_LEGACY_VSYSCALL_NONE |kconfig| y | kspp |cut_attack_surface| FAIL: "is not set"
196 CONFIG_ZSMALLOC_STAT |kconfig| is not set | grsec |cut_attack_surface| OK
197 CONFIG_PAGE_OWNER |kconfig| is not set | grsec |cut_attack_surface| OK
198 CONFIG_DEBUG_KMEMLEAK |kconfig| is not set | grsec |cut_attack_surface| OK
199 CONFIG_BINFMT_AOUT |kconfig| is not set | grsec |cut_attack_surface| OK: not found
200 CONFIG_KPROBE_EVENTS |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
201 CONFIG_UPROBE_EVENTS |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
202 CONFIG_GENERIC_TRACER |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
203 CONFIG_FUNCTION_TRACER |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
204 CONFIG_STACK_TRACER |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
205 CONFIG_HIST_TRIGGERS |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
206 CONFIG_BLK_DEV_IO_TRACE |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
207 CONFIG_PROC_VMCORE |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
208 CONFIG_PROC_PAGE_MONITOR |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
209 CONFIG_USELIB |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
210 CONFIG_CHECKPOINT_RESTORE |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
211 CONFIG_USERFAULTFD |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
212 CONFIG_HWPOISON_INJECT |kconfig| is not set | grsec |cut_attack_surface| FAIL: "m"
213 CONFIG_MEM_SOFT_DIRTY |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
214 CONFIG_DEVPORT |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
215 CONFIG_DEBUG_FS |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
216 CONFIG_NOTIFIER_ERROR_INJECTION |kconfig| is not set | grsec |cut_attack_surface| FAIL: "m"
217 CONFIG_FAIL_FUTEX |kconfig| is not set | grsec |cut_attack_surface| OK: not found
218 CONFIG_PUNIT_ATOM_DEBUG |kconfig| is not set | grsec |cut_attack_surface| FAIL: "m"
219 CONFIG_ACPI_CONFIGFS |kconfig| is not set | grsec |cut_attack_surface| FAIL: "m"
220 CONFIG_EDAC_DEBUG |kconfig| is not set | grsec |cut_attack_surface| OK
221 CONFIG_DRM_I915_DEBUG |kconfig| is not set | grsec |cut_attack_surface| OK
222 CONFIG_BCACHE_CLOSURES_DEBUG |kconfig| is not set | grsec |cut_attack_surface| OK
223 CONFIG_DVB_C8SECTPFE |kconfig| is not set | grsec |cut_attack_surface| OK: not found
224 CONFIG_MTD_SLRAM |kconfig| is not set | grsec |cut_attack_surface| FAIL: "m"
225 CONFIG_MTD_PHRAM |kconfig| is not set | grsec |cut_attack_surface| FAIL: "m"
226 CONFIG_IO_URING |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
227 CONFIG_KCMP |kconfig| is not set | grsec |cut_attack_surface| OK: not found
228 CONFIG_RSEQ |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
229 CONFIG_LATENCYTOP |kconfig| is not set | grsec |cut_attack_surface| OK
230 CONFIG_KCOV |kconfig| is not set | grsec |cut_attack_surface| OK
231 CONFIG_PROVIDE_OHCI1394_DMA_INIT |kconfig| is not set | grsec |cut_attack_surface| OK
232 CONFIG_SUNRPC_DEBUG |kconfig| is not set | grsec |cut_attack_surface| FAIL: "y"
233 CONFIG_PTDUMP_DEBUGFS |kconfig| is not set | grsec |cut_attack_surface| OK: not found
234 CONFIG_DRM_LEGACY |kconfig| is not set |maintainer|cut_attack_surface| OK
235 CONFIG_FB |kconfig| is not set |maintainer|cut_attack_surface| FAIL: "y"
236 CONFIG_VT |kconfig| is not set |maintainer|cut_attack_surface| FAIL: "y"
237 CONFIG_BLK_DEV_FD |kconfig| is not set |maintainer|cut_attack_surface| FAIL: "m"
238 CONFIG_BLK_DEV_FD_RAWCMD |kconfig| is not set |maintainer|cut_attack_surface| OK: not found
239 CONFIG_AIO |kconfig| is not set |grapheneos|cut_attack_surface| FAIL: "y"
240 CONFIG_STAGING |kconfig| is not set | clipos |cut_attack_surface| FAIL: "y"
241 CONFIG_KSM |kconfig| is not set | clipos |cut_attack_surface| FAIL: "y"
242 CONFIG_KALLSYMS |kconfig| is not set | clipos |cut_attack_surface| FAIL: "y"
243 CONFIG_X86_VSYSCALL_EMULATION |kconfig| is not set | clipos |cut_attack_surface| FAIL: "y"
244 CONFIG_MAGIC_SYSRQ |kconfig| is not set | clipos |cut_attack_surface| FAIL: "y"
245 CONFIG_KEXEC_FILE |kconfig| is not set | clipos |cut_attack_surface| FAIL: "y"
246 CONFIG_USER_NS |kconfig| is not set | clipos |cut_attack_surface| FAIL: "y"
247 CONFIG_X86_CPUID |kconfig| is not set | clipos |cut_attack_surface| FAIL: "m"
248 CONFIG_X86_IOPL_IOPERM |kconfig| is not set | clipos |cut_attack_surface| OK: not found
249 CONFIG_ACPI_TABLE_UPGRADE |kconfig| is not set | clipos |cut_attack_surface| FAIL: "y"
250 CONFIG_EFI_CUSTOM_SSDT_OVERLAYS |kconfig| is not set | clipos |cut_attack_surface| OK: not found
251 CONFIG_LDISC_AUTOLOAD |kconfig| is not set | clipos |cut_attack_surface| FAIL: "y"
252 CONFIG_X86_INTEL_TSX_MODE_OFF |kconfig| y | clipos |cut_attack_surface| OK
253 CONFIG_BPF_SYSCALL |kconfig| is not set | lockdown |cut_attack_surface| FAIL: "y"
254 CONFIG_EFI_TEST |kconfig| is not set | lockdown |cut_attack_surface| FAIL: "m"
255 CONFIG_MMIOTRACE_TEST |kconfig| is not set | lockdown |cut_attack_surface| OK
256 CONFIG_KPROBES |kconfig| is not set | lockdown |cut_attack_surface| FAIL: "y"
257 CONFIG_TRIM_UNUSED_KSYMS |kconfig| y | my |cut_attack_surface| FAIL: not found
258 CONFIG_MMIOTRACE |kconfig| is not set | my |cut_attack_surface| FAIL: "y"
259 CONFIG_LIVEPATCH |kconfig| is not set | my |cut_attack_surface| FAIL: "y"
260 CONFIG_IP_DCCP |kconfig| is not set | my |cut_attack_surface| FAIL: "m"
261 CONFIG_IP_SCTP |kconfig| is not set | my |cut_attack_surface| FAIL: "m"
262 CONFIG_FTRACE |kconfig| is not set | my |cut_attack_surface| FAIL: "y"
263 CONFIG_VIDEO_VIVID |kconfig| is not set | my |cut_attack_surface| FAIL: "m"
264 CONFIG_INPUT_EVBUG |kconfig| is not set | my |cut_attack_surface| FAIL: "m"
265 CONFIG_INTEGRITY |kconfig| y |defconfig | harden_userspace | OK
266 CONFIG_ARCH_MMAP_RND_BITS |kconfig| 32 | clipos | harden_userspace | FAIL: "28"
268 [+] Config check is finished: 'OK' - 71 / 'FAIL' - 103
271 ## kconfig-hardened-check versioning
273 I usually update the kernel security hardening recommendations after each Linux kernel release.
275 So the version of `kconfig-hardened-check` is associated with the corresponding version of the kernel.
277 The version format is: __[major_number].[kernel_version].[kernel_patchlevel]__
280 ## Questions and answers
282 __Q:__ How disabling `CONFIG_USER_NS` cuts the attack surface? It's needed for containers!
284 __A:__ Yes, the `CONFIG_USER_NS` option provides some isolation between the userspace programs,
285 but the tool recommends disabling it to cut the attack surface __of the kernel__.
289 - A nice LWN article about the corresponding LKML discussion: https://lwn.net/Articles/673597/
291 - A twitter thread about `CONFIG_USER_NS` and security: https://twitter.com/robertswiecki/status/1095447678949953541
293 - A good overview of the trade-off between having user namespaces enabled, disabled and available only for root: https://github.com/NixOS/nixpkgs/pull/84522#issuecomment-614640601
297 __Q:__ Why `CONFIG_GCC_PLUGINS` is automatically disabled during the kernel compilation?
299 __A:__ It means that your gcc doesn't support plugins. For example, if you have `gcc-7` on Ubuntu,
300 try to install `gcc-7-plugin-dev` package, it should help.
304 __Q:__ KSPP and CLIP OS recommend `CONFIG_PANIC_ON_OOPS=y`. Why doesn't this tool do the same?
306 __A:__ I personally don't support this recommendation because it provides easy denial-of-service
307 attacks for the whole system (kernel oops is not a rare situation). I think having `CONFIG_BUG` is enough here --
308 if we have a kernel oops in the process context, the offending/attacking process is killed.
312 __Q:__ What about performance impact of these security hardening options?
314 __A:__ Ike Devolder [@BlackIkeEagle][7] made some performance tests and described the results in [this article][8].
318 __Q:__ Why enabling `CONFIG_STATIC_USERMODEHELPER` breaks various things in my GNU/Linux system?
319 Do I really need that feature?
321 __A:__ Linux kernel usermode helpers can be used for privilege escalation in kernel exploits
322 ([example 1][9], [example 2][10]). `CONFIG_STATIC_USERMODEHELPER` prevents that method. But it
323 requires the corresponding support in the userspace: see the [example implementation][11] by
324 Tycho Andersen [@tych0][12].
328 __Q:__ Does my kernel have all those mitigations of Transient Execution Vulnerabilities in my hardware?
330 __A:__ Checking the kernel config is not enough to answer this question.
331 I highly recommend using [spectre-meltdown-checker][13] tool maintained by Stéphane Lesimple [@speed47][14].
334 [1]: http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings
335 [2]: https://docs.clip-os.org/clipos/kernel.html#configuration
336 [3]: https://grsecurity.net/
337 [4]: https://github.com/a13xp0p0v/linux-kernel-defence-map
338 [5]: https://lwn.net/Articles/791863/
339 [6]: https://github.com/a13xp0p0v/kconfig-hardened-check/issues/38
340 [7]: https://github.com/BlackIkeEagle
341 [8]: https://blog.herecura.eu/blog/2020-05-30-kconfig-hardening-tests/
342 [9]: https://googleprojectzero.blogspot.com/2018/09/a-cache-invalidation-bug-in-linux.html
343 [10]: https://a13xp0p0v.github.io/2020/02/15/CVE-2019-18683.html
344 [11]: https://github.com/tych0/huldufolk
345 [12]: https://github.com/tych0
346 [13]: https://github.com/speed47/spectre-meltdown-checker
347 [14]: https://github.com/speed47
348 [15]: https://github.com/a13xp0p0v/kconfig-hardened-check/issues/53
349 [16]: https://github.com/a13xp0p0v/kconfig-hardened-check/pull/54
projects / kconfig-hardened-check.git / blob