{"id":13539037,"url":"https://github.com/a13xp0p0v/linux-kernel-defence-map","last_synced_at":"2025-10-18T21:43:10.165Z","repository":{"id":40591386,"uuid":"128080814","full_name":"a13xp0p0v/linux-kernel-defence-map","owner":"a13xp0p0v","description":"Linux Kernel Defence Map shows the relationships between vulnerability classes, exploitation techniques, bug detection mechanisms, and defence technologies","archived":false,"fork":false,"pushed_at":"2024-12-23T20:24:16.000Z","size":9682,"stargazers_count":2098,"open_issues_count":2,"forks_count":132,"subscribers_count":111,"default_branch":"master","last_synced_at":"2025-04-10T03:49:58.579Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/a13xp0p0v.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-04-04T15:15:50.000Z","updated_at":"2025-04-10T03:03:51.000Z","dependencies_parsed_at":"2024-02-18T18:43:51.381Z","dependency_job_id":"e2803962-350f-4477-b83a-a4ae08ad5e57","html_url":"https://github.com/a13xp0p0v/linux-kernel-defence-map","commit_stats":null,"previous_names":[],"tags_count":10,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/a13xp0p0v%2Flinux-kernel-defence-map","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/a13xp0p0v%2Flinux-kernel-defence-map/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/a13xp0p0v%2Flinux-kernel-defence-map/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/a13xp0p0v%2Flinux-kernel-defence-map/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/a13xp0p0v","download_url":"https://codeload.github.com/a13xp0p0v/linux-kernel-defence-map/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254160555,"owners_count":22024571,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T09:01:19.374Z","updated_at":"2025-10-18T21:43:05.114Z","avatar_url":"https://github.com/a13xp0p0v.png","language":null,"readme":"# Linux Kernel Defence Map\n\n[![GitHub tag (latest by date)](https://img.shields.io/github/v/tag/a13xp0p0v/linux-kernel-defence-map?label=release)](https://github.com/a13xp0p0v/linux-kernel-defence-map/tags)\n[![License: GPL v3](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)\n\nLinux kernel security is a very complex topic.\n\nThere are many concepts that have interesting relationships with each other:\n - Vulnerability classes\n - Exploitation techniques\n - Bug detection mechanisms\n - Defence technologies\n\nSome defence technologies are provided by the Linux kernel mainline.\nOthers are going out‑of‑tree for various reasons (some of them are commercial, for example).\nMoreover, there are kernel defences that depend on special hardware features.\n\nIt would be convenient to have a graphical representation of Linux kernel security.\nThat's why I have created a __Linux Kernel Defence Map__ showing the relationships between all these concepts.\n\nThe node connections don't mean \"full mitigation.\" Rather, each connection represents some kind of relationship.\nSo the Linux Kernel Defence Map should help to navigate the documentation and Linux kernel sources.\nIt also provides the Common Weakness Enumeration (CWE) numbers for vulnerability classes.\n\nThis map describes kernel security hardening. It doesn't cover cutting attack surface, userspace security features\nand policies enforced by various Linux Security Modules (LSM).\n\n## Repositories\n\n - At GitHub \u003chttps://github.com/a13xp0p0v/linux-kernel-defence-map\u003e\n - At Codeberg: \u003chttps://codeberg.org/a13xp0p0v/linux-kernel-defence-map\u003e (go there if something goes wrong with GitHub)\n - At GitFlic: \u003chttps://gitflic.ru/project/a13xp0p0v/linux-kernel-defence-map\u003e\n\n## How this Map is made\n\nThis map is written in the DOT language, which makes maintenance and updating in Git very convenient.\n\nLicense: GPL-3.0.\n\nThe diagram is generated using GraphViz with the following command:\n```\ndot -Tsvg linux-kernel-defence-map.dot -o linux-kernel-defence-map.svg\n```\n\n## Do you want to check your kernel configuration?\n\nSo there are plenty of security hardening options in the Linux kernel. A lot of them are\nnot enabled by the major distros. We have to configure these options ourselves to\nmake our systems more secure.\n\nBut nobody likes verifying configs manually. So I've created the [__kernel-hardening-checker__](https://github.com/a13xp0p0v/kernel-hardening-checker)\nthat checks security hardening options of the Linux kernel.\nYou are welcome to try it.\n\n## References\n\n- [Grsecurity features](https://grsecurity.net/features.php)\n\n- [The State of Kernel Self Protection](https://outflux.net/slides/2021/lss/kspp.pdf) by Kees Cook\n\n- Linux kernel [security documentation](https://www.kernel.org/doc/html/latest/security/self-protection.html)\n\n- Linux kernel [mitigation checklist](https://github.com/hardenedlinux/grsecurity-101-tutorials/blob/master/kernel_mitigation.md) by Shawn C\n\n- [Trends, challenge, and shifts in software vulnerability mitigation](https://github.com/Microsoft/MSRC-Security-Research/tree/master/presentations/2019_02_BlueHatIL) by MSRC\n\n- [Pursuing Durable Safety for Systems Software](https://www.sstic.org/2020/presentation/ouverture_2020/) by Matt Miller\n\n- [A Decade of Linux Kernel Vulnerabilities, their Mitigation and Open Problems](https://github.com/maxking/linux-vulnerabilities-10-years) by Abhilash Raj\n\n- [Spectre \u0026 Meltdown Checker](https://github.com/speed47/spectre-meltdown-checker) by Stéphane Lesimple\n\n## Map for Linux kernel v6.10\n\n![Linux Kernel Defence Map](./linux-kernel-defence-map.svg)\n\n","funding_links":[],"categories":["\u003ca id=\"8c5a692b5d26527ef346687e047c5c21\"\u003e\u003c/a\u003e收集","Others","\u003ca id=\"e97d183e67fa3f530e7d0e7e8c33ee62\"\u003e\u003c/a\u003e未分类","Mobile"],"sub_categories":["\u003ca id=\"f110da0bf67359d3abc62b27d717e55e\"\u003e\u003c/a\u003e新添加的","Linux/ *Nix"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fa13xp0p0v%2Flinux-kernel-defence-map","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fa13xp0p0v%2Flinux-kernel-defence-map","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fa13xp0p0v%2Flinux-kernel-defence-map/lists"}