Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.
Awesome Lists | Featured Topics | Projects
https://github.com/a13xp0p0v/kernel-hardening-checker

A tool for checking the security hardening options of the Linux kernel
https://github.com/a13xp0p0v/kernel-hardening-checker
Last synced: 5 days ago
JSON representation
A tool for checking the security hardening options of the Linux kernel
Host: GitHub
URL: https://github.com/a13xp0p0v/kernel-hardening-checker
Owner: a13xp0p0v
License: gpl-3.0
Created: 2018-06-19T21:50:16.000Z (over 6 years ago)
Default Branch: master
Last Pushed: 2024-10-21T14:42:59.000Z (3 months ago)
Last Synced: 2024-10-29T15:41:21.380Z (3 months ago)
Language: Python
Homepage:
Size: 2.27 MB
Stars: 1,682
Watchers: 54
Forks: 154
Open Issues: 18
Metadata Files:
- Readme: README.md
- License: LICENSE.txt
Awesome Lists containing this project

awesome-hacking-lists - a13xp0p0v/kernel-hardening-checker - A tool for checking the security hardening options of the Linux kernel (Python)
README

        # kernel-hardening-checker

__(formerly kconfig-hardened-check)__



[![functional test](https://github.com/a13xp0p0v/kernel-hardening-checker/workflows/functional%20test/badge.svg)](https://github.com/a13xp0p0v/kernel-hardening-checker/actions/workflows/functional_test.yml)

[![functional test coverage](https://codecov.io/gh/a13xp0p0v/kernel-hardening-checker/graph/badge.svg?flag=functional_test)](https://app.codecov.io/gh/a13xp0p0v/kernel-hardening-checker?flags%5B0%5D=functional_test)


[![engine unit-test](https://github.com/a13xp0p0v/kernel-hardening-checker/workflows/engine%20unit-test/badge.svg)](https://github.com/a13xp0p0v/kernel-hardening-checker/actions/workflows/engine_unit-test.yml)

[![unit-test coverage](https://codecov.io/gh/a13xp0p0v/kernel-hardening-checker/graph/badge.svg?flag=engine_unit-test)](https://app.codecov.io/gh/a13xp0p0v/kernel-hardening-checker?flags%5B0%5D=engine_unit-test)


[![GitHub tag (latest by date)](https://img.shields.io/github/v/tag/a13xp0p0v/kernel-hardening-checker?label=release)](https://github.com/a13xp0p0v/kernel-hardening-checker/tags)

[![License: GPL v3](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)

## Motivation

There are plenty of security hardening options for the Linux kernel. A lot of them are

not enabled by the major distros. We have to enable these options ourselves to

make our systems more secure.

But nobody likes checking configs manually. So let the computers do their job!

__kernel-hardening-checker__ (formerly __kconfig-hardened-check__) is a tool for checking the security hardening options of the Linux kernel.

License: GPL-3.0.

## Repositories

 - At GitHub 

 - At Codeberg:  (go there if something goes wrong with GitHub)

 - At GitFlic: 

## Features

`kernel-hardening-checker` supports checking:

  - Kconfig options (compile-time)

  - Kernel cmdline arguments (boot-time)

  - Sysctl parameters (runtime)

Supported microarchitectures:

  - X86_64

  - X86_32

  - ARM64

  - ARM

The security hardening recommendations are based on:

  - [KSPP recommended settings][1]

  - [Direct feedback from the Linux kernel maintainers][23]

  - Kernel options disabled by [grsecurity][3] to cut attack surface

  - [CLIP OS kernel configuration][2]

  - [GrapheneOS][25] recommendations

  - [SECURITY_LOCKDOWN_LSM][5] patchset

I also created the [__Linux Kernel Defence Map__][4], which is a graphical representation of the

relationships between security hardening features and the corresponding vulnerability classes

or exploitation techniques.

## Attention!

Changing Linux kernel security parameters may also affect system performance

and functionality of userspace software. So for choosing these parameters, consider

the threat model of your Linux-based information system and perform thorough testing

of its typical workload.

## Installation

You can install the package:

```

pip install git+https://github.com/a13xp0p0v/kernel-hardening-checker

```

or simply run `./bin/kernel-hardening-checker` from the cloned repository.

Some Linux distributions also provide `kernel-hardening-checker` as a package.

## Usage

```

./bin/kernel-hardening-checker -h

usage: kernel-hardening-checker [-h] [--version] [-m {verbose,json,show_ok,show_fail}]

                                [-a] [-c CONFIG] [-v KERNEL_VERSION] [-l CMDLINE] [-s SYSCTL]

                                [-p {X86_64,X86_32,ARM64,ARM}]

                                [-g {X86_64,X86_32,ARM64,ARM}]

A tool for checking the security hardening options of the Linux kernel

options:

  -h, --help            show this help message and exit

  --version             show program's version number and exit

  -m {verbose,json,show_ok,show_fail}, --mode {verbose,json,show_ok,show_fail}

                        choose the report mode

  -a, --autodetect      autodetect and check the security hardening options

                        of the running kernel

  -c CONFIG, --config CONFIG

                        check the security hardening options in the Kconfig file

                        (also supports *.gz files)

  -v KERNEL_VERSION, --kernel-version KERNEL_VERSION

                        extract version from the kernel version file (contents of

                        /proc/version) instead of Kconfig file

  -l CMDLINE, --cmdline CMDLINE

                        check the security hardening options in the kernel cmdline file

                        (contents of /proc/cmdline)

  -s SYSCTL, --sysctl SYSCTL

                        check the security hardening options in the sysctl output file

                        (`sudo sysctl -a > file`)

  -p {X86_64,X86_32,ARM64,ARM}, --print {X86_64,X86_32,ARM64,ARM}

                        print the security hardening recommendations for the selected

                        microarchitecture

  -g {X86_64,X86_32,ARM64,ARM}, --generate {X86_64,X86_32,ARM64,ARM}

                        generate a Kconfig fragment with the security hardening options

                        for the selected microarchitecture

```

## Output modes

  -  no `-m` argument for the default output mode (see the example below)

  - `-m verbose` for printing additional info:

    - config options without a corresponding check

    - internals of complex checks with AND/OR, like this:

```

-------------------------------------------------------------------------------------------

    <<< OR >>>                                                                             

CONFIG_STRICT_DEVMEM                    |kconfig|     y      |defconfig |cut_attack_surface

CONFIG_DEVMEM                           |kconfig| is not set |   kspp   |cut_attack_surface

-------------------------------------------------------------------------------------------

```

  - `-m show_fail` for showing only the failed checks

  - `-m show_ok` for showing only the successful checks

  - `-m json` for printing the results in JSON format (for combining `kernel-hardening-checker` with other tools)

## Example output 
``` 
$ ./bin/kernel-hardening-checker 
[+] Going to 
[+] Detected 
[+] Detected 
[+] Detected 
[+] Saved sysctl 
[+] Detected 
[+] Detected compiler: GCC 110400 
[!] WARNING: 
[!] WARNING: 
===================== 
              option_name 
===================== 
CONFIG_BUG 
CONFIG_SLUB_DEBUG 
CONFIG_THREAD_INFO_IN_TASK 
CONFIG_IOMMU_SUPPORT 
CONFIG_STACKPROTECTOR 
CONFIG_STACKPROTECTOR_STRONG 
CONFIG_STRICT_KERNEL_RWX 
CONFIG_STRICT_MODULE_RWX 
CONFIG_REFCOUNT_FULL 
CONFIG_INIT_STACK_ALL_ZERO 
CONFIG_CPU_MITIGATIONS 
CONFIG_RANDOMIZE_BASE 
CONFIG_VMAP_STACK 
CONFIG_DEBUG_WX 
CONFIG_WERROR 
CONFIG_X86_MCE 
CONFIG_SYN_COOKIES 
CONFIG_MICROCODE 
CONFIG_MICROCODE_INTEL 
CONFIG_MICROCODE_AMD 
CONFIG_X86_SMAP 
CONFIG_X86_UMIP 
CONFIG_X86_MCE_INTEL 
CONFIG_X86_MCE_AMD 
CONFIG_MITIGATION_RETPOLINE 
CONFIG_MITIGATION_RFDS 
CONFIG_MITIGATION_SPECTRE_BHI 
CONFIG_RANDOMIZE_MEMORY 
CONFIG_X86_KERNEL_IBT 
CONFIG_MITIGATION_PAG 
CONFIG_MITIGATION_SRSO 
CONFIG_INTEL_IOMMU 
CONFIG_AMD_IOMMU 
CONFIG_RANDOM_KMALLOC_CACHES 
CONFIG_SLAB_MERGE_DEFAULT 
CONFIG_BUG_ON_DATA_CORRUPTION 
CONFIG_SLAB_FREELIST_HARDENED 
CONFIG_SLAB_FREELIST_RANDOM 
CONFIG_SHUFFLE_PAGE_ALLOCATOR 
CONFIG_FORTIFY_SOURCE 
CONFIG_DEBUG_VIRTUAL 
CONFIG_DEBUG_SG 
CONFIG_INIT_ON_ALLOC_DEFAULT_ON 
CONFIG_STATIC_USERMODEHELPER 
CONFIG_SCHED_CORE 
CONFIG_SECURITY_LOCKDOWN_LSM 
CONFIG_SECURITY_LOCKDOWN_LSM_EARLY 
CONFIG_LOCK_DOWN_KERN 
CONFIG_LIST_HARDENED 
CONFIG_DEBUG_CREDENTIALS 
CONFIG_DEBUG_NOTIFIERS 
CONFIG_SCHED_STACK_END_CHECK 
CONFIG_KFENCE 
CONFIG_KFENCE_SAMPLE_INTERVAL 
CONFIG_RANDSTRUCT_FULL 
CONFIG_HARDENED_USERCOPY 
CONFIG_HARDENED_USERCOPY_FALLBACK 
CONFIG_HARDENED_USERCOPY_PAGESPAN 
CONFIG_GCC_PLUGIN_LATENT_ENTROPY 
CONFIG_MODULE_SIG 
CONFIG_MODULE_SIG_ALL 
CONFIG_MODULE_SIG_SHA512 
CONFIG_MODULE_SIG_FORCE 
CONFIG_INIT_ON_FREE_DEFAULT_ON 
CONFIG_EFI_DISABLE_PCI_DMA 
CONFIG_RESET_ATTACK_MITIGATION 
CONFIG_UBSAN_BOUNDS 
CONFIG_UBSAN_LOCAL_BOUNDS 
CONFIG_UBSAN_TRAP 
CONFIG_UBSAN_SANITIZE_ALL 
CONFIG_GCC_PLUGIN_STACKLEAK 
CONFIG_STACKLEAK_METRICS 
CONFIG_STACKLEAK_RUNTIME_DISABLE 
CONFIG_RANDOMIZE_KSTA 
CONFIG_PAGE_TABLE_CHECK 
CONFIG_PAGE_TABLE_CHECK_ENFORCED 
CONFIG_CFI_CLANG 
CONFIG_CFI_PERMISSIVE 
CONFIG_HW_RANDOM_TPM 
CONFIG_DEFAULT_MMAP_MIN_ADDR 
CONFIG_IOMMU_DEFAULT_DMA_STRICT 
CONFIG_IOMMU_DEFAULT_PASSTHROUGH 
CONFIG_INTEL_IOMMU_DEFAULT_ON 
CONFIG_MITIGATION_SLS 
CONFIG_INTEL_IOMMU_SVM 
CONFIG_AMD_IOMMU_V2 
CONFIG_CFI_AUTO_DEFAULT 
CONFIG_SECURITY 
CONFIG_SECURITY_YAMA 
CONFIG_SECURITY_LANDLOCK 
CONFIG_SECURITY_SELINUX_DISABLE 
CONFIG_SECURITY_SELINUX_BOOTPARAM 
CONFIG_SECURITY_SELINUX_DEVELOP 
CONFIG_SECURITY_WRITABLE_HOOKS 
CONFIG_SECURITY_SELINUX_DEBUG 
CONFIG_SECURITY_SELINUX 
CONFIG_SECCOMP 
CONFIG_SECCOMP_FILTER 
CONFIG_BPF_UNPRIV_DEFAULT_OFF 
CONFIG_STRICT_DEVMEM 
CONFIG_X86_INTEL_TSX_MODE_OFF 
CONFIG_SECURITY_DMESG_RESTRICT 
CONFIG_ACPI_CUSTOM_METHOD 
CONFIG_COMPAT_BRK 
CONFIG_DEVKMEM 
CONFIG_BINFMT_MISC 
CONFIG_INET_DIAG 
CONFIG_KEXEC 
CONFIG_PROC_KCORE 
CONFIG_LEGACY_PTYS 
CONFIG_HIBERNATION 
CONFIG_COMPAT 
CONFIG_IA32_EMULATION 
CONFIG_X86_X32 
CONFIG_X86_X32_ABI 
CONFIG_MODIFY_LDT_SYSCALL 
CONFIG_OABI_COMPAT 
CONFIG_X86_MSR 
CONFIG_LEGACY_TIOCSTI 
CONFIG_MODULE_FORCE_LOAD 
CONFIG_MODULES 
CONFIG_DEVMEM 
CONFIG_IO_STRICT_DEVMEM 
CONFIG_LDISC_AUTOLOAD 
CONFIG_X86_VSYSCALL_EMULATION 
CONFIG_COMPAT_VDSO 
CONFIG_DRM_LEGACY 
CONFIG_FB 
CONFIG_VT 
CONFIG_BLK_DEV_FD 
CONFIG_BLK_DEV_FD_RAWCMD 
CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT 
CONFIG_N_GSM 
CONFIG_ZSMALLOC_STAT 
CONFIG_DEBUG_KMEMLEAK 
CONFIG_BINFMT_AOUT 
CONFIG_KPROBE_EVENTS 
CONFIG_UPROBE_EVENTS 
CONFIG_GENERIC_TRACER 
CONFIG_FUNCTION_TRACER 
CONFIG_STACK_TRACER 
CONFIG_HIST_TRIGGERS 
CONFIG_BLK_DEV_IO_TRACE 
CONFIG_PROC_VMCORE 
CONFIG_PROC_PAGE_MONITOR 
CONFIG_USELIB 
CONFIG_CHECKPOINT_RESTORE 
CONFIG_USERFAULTFD 
CONFIG_HWPOISON_INJECT 
CONFIG_MEM_SOFT_DIRTY 
CONFIG_DEVPORT 
CONFIG_DEBUG_FS 
CONFIG_NOTIFIER_ERROR_INJECTION 
CONFIG_FAIL_FUTEX 
CONFIG_PUNIT_ATOM_DEBUG 
CONFIG_ACPI_CONFIGFS 
CONFIG_EDAC_DEBUG 
CONFIG_DRM_I915_DEBUG 
CONFIG_DVB_C8SECTPFE 
CONFIG_MTD_SLRAM 
CONFIG_MTD_PHRAM 
CONFIG_IO_URING 
CONFIG_KCMP 
CONFIG_RSEQ 
CONFIG_LATENCYTOP 
CONFIG_KCOV 
CONFIG_PROVIDE_OHCI1394_DMA_INIT 
CONFIG_SUNRPC_DEBUG 
CONFIG_X86_16BIT 
CONFIG_BLK_DEV_UBLK 
CONFIG_SMB_SERVER 
CONFIG_XFS_ONLINE_SCRUB_STATS 
CONFIG_CACHESTAT_SYSCALL 
CONFIG_PREEMPTIRQ_TRACEPOINTS 
CONFIG_ENABLE_DEFAULT_TRACERS 
CONFIG_PROVE_LOCKING 
CONFIG_TEST_DEBUG_VIRTUAL 
CONFIG_MPTCP 
CONFIG_TLS 
CONFIG_TIPC 
CONFIG_IP_SCTP 
CONFIG_KGDB 
CONFIG_PTDUMP_DEBUGFS 
CONFIG_X86_PTDUMP 
CONFIG_DEBUG_CLOSURES 
CONFIG_BCACHE_CLOSURES_DEBUG 
CONFIG_STAGING 
CONFIG_KSM 
CONFIG_KALLSYMS 
CONFIG_KEXEC_FILE 
CONFIG_CRASH_DUMP 
CONFIG_USER_NS 
CONFIG_X86_CPUID 
CONFIG_X86_IOPL_IOPERM 
CONFIG_ACPI_TABLE_UPGRADE 
CONFIG_EFI_CUSTOM_SSDT_OVERLAYS 
CONFIG_AIO 
CONFIG_MAGIC_SYSRQ 
CONFIG_MAGIC_SYSRQ_SERIAL 
CONFIG_EFI_TEST 
CONFIG_MMIOTRACE_TEST 
CONFIG_KPROBES 
CONFIG_BPF_SYSCALL 
CONFIG_MMIOTRACE 
CONFIG_LIVEPATCH 
CONFIG_IP_DCCP 
CONFIG_FTRACE 
CONFIG_VIDEO_VIVID 
CONFIG_INPUT_EVBUG 
CONFIG_CORESIGHT 
CONFIG_XFS_SUPPORT_V4 
CONFIG_BLK_DEV_WRITE_MOUNTED 
CONFIG_FAULT_INJECTION 
CONFIG_ARM_PTDUMP_DEBUGFS 
CONFIG_ARM_PTDUMP 
CONFIG_SECCOMP_CACHE_DEBUG 
CONFIG_LKDTM 
CONFIG_TRIM_UNUSED_KSYMS 
CONFIG_COREDUMP 
CONFIG_ARCH_MMAP_RND_BITS 
CONFIG_ARCH_MMAP_RND_COMPAT_BITS 
CONFIG_X86_USER_SHADOW_STACK 
nosmep 
nosmap 
nokaslr 
nopti 
nospectre_v1 
nospectre_v2 
nospectre_bhb 
nospec_store_bypass_disable 
dis_ucode_ldr 
arm64.nobti 
arm64.nopauth 
arm64.nomte 
spectre_v2 
spectre_v2_user 
spectre_bhi 
spec_store_bypass_disable 
l1tf 
mds 
tsx_async_abort 
srbds 
mmio_stale_data 
retbleed 
spec_rstack_overflow 
gather_data_sampling 
reg_file_data_sampling 
rodata 
slab_merge 
slub_merge 
page_alloc.shuffle 
slab_nomerge 
init_on_alloc 
init_on_free 
hardened_usercopy 
slab_common.usercopy_fallback 
kfence.sample_interval 
iommu.strict 
iommu.passthrough 
randomize_kstack_offset 
mitigations 
pti 
cfi 
iommu 
tsx 
nosmt 
vsyscall 
vdso32 
debugfs 
sysrq_always_enabled 
bdev_allow_write_mounted 
ia32_emulation 
norandmaps 
net.core.bpf_jit_harden 
kernel.oops_limit 
kernel.warn_limit 
vm.mmap_min_addr 
kernel.dmesg_restrict 
kernel.perf_event_paranoid 
user.max_user_namespaces 
dev.tty.ldisc_autoload 
kernel.kptr_restrict 
dev.tty.legacy_tiocsti 
kernel.kexec_load_disabled 
kernel.unprivileged_bpf_disabled 
vm.unprivileged_userfaultfd 
kernel.modules_disabled 
kernel.io_uring_disabled 
kernel.sysrq 
fs.protected_symlinks 
fs.protected_hardlinks 
fs.protected_fifos 
fs.protected_regular 
fs.suid_dumpable 
kernel.randomize_va_space 
kernel.yama.ptrace_scope 
vm.mmap_rnd_bits 
vm.mmap_rnd_compat_bits

-a autodetect and check the security hardening options of the running kernel version of the running kernel: (6, 5, 0) kconfig file of the running kernel: /boot/config-6.5.0-1025-azure cmdline parameters of the running kernel: /proc/cmdline output to /tmp/sysctl-n7hd4ab2 microarchitecture: X86_64 cmdline option "console" is found multiple times sysctl options available for root are not found in /tmp/sysctl-n7hd4ab2, try checking the output of `sudo sysctl -a` ==================================================================================================== | type  |desired_val | decision |      reason      | check_result ==================================================================================================== |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | OK: version >= (5, 4, 208) |kconfig|     y      |defconfig | self_protection  | FAIL: is not found |kconfig|     y      |defconfig | self_protection  | OK: CONFIG_SPECULATION_MITIGATIONS is "y" |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | FAIL: "is not set" |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | OK: version >= (5, 19, 0) |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | OK: CONFIG_RETPOLINE is "y" |kconfig|     y      |defconfig | self_protection  | FAIL: is not found |kconfig|     y      |defconfig | self_protection  | FAIL: is not found |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | FAIL: "is not set" E_TABLE_ISOLATION  |kconfig|     y      |defconfig | self_protection  | OK: CONFIG_PAGE_TABLE_ISOLATION is "y" |kconfig|     y      |defconfig | self_protection  | OK: CONFIG_CPU_SRSO is "y" |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |defconfig | self_protection  | OK |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found |kconfig| is not set |   kspp   | self_protection  | FAIL: "y" |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set" |kconfig|     y      |   kspp   | self_protection  | OK |kconfig|     y      |   kspp   | self_protection  | OK |kconfig|     y      |   kspp   | self_protection  | OK |kconfig|     y      |   kspp   | self_protection  | OK |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set" |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set" |kconfig|     y      |   kspp   | self_protection  | OK |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set" |kconfig|     y      |   kspp   | self_protection  | OK |kconfig|     y      |   kspp   | self_protection  | OK |kconfig|     y      |   kspp   | self_protection  | OK EL_FORCE_CONFIDENTIALITY|kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set" |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set" |kconfig|     y      |   kspp   | self_protection  | OK |kconfig|     y      |   kspp   | self_protection  | OK |kconfig|    100     |   kspp   | self_protection  | FAIL: "0" |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found |kconfig|     y      |   kspp   | self_protection  | OK |kconfig| is not set |   kspp   | self_protection  | OK: is not found |kconfig| is not set |   kspp   | self_protection  | OK: is not found |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found |kconfig|     y      |   kspp   | self_protection  | OK |kconfig|     y      |   kspp   | self_protection  | OK |kconfig|     y      |   kspp   | self_protection  | OK |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set" |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set" |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set" |kconfig|     y      |   kspp   | self_protection  | OK |kconfig|     y      |   kspp   | self_protection  | OK |kconfig|     y      |   kspp   | self_protection  | OK: CONFIG_UBSAN_BOUNDS is "y" |kconfig|     y      |   kspp   | self_protection  | FAIL: CONFIG_UBSAN_ENUM is not "is not set" |kconfig|     y      |   kspp   | self_protection  | OK |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found |kconfig| is not set |   kspp   | self_protection  | FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is not "y" |kconfig| is not set |   kspp   | self_protection  | FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is not "y" CK_OFFSET_DEFAULT  |kconfig|     y      |   kspp   | self_protection  | OK |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set" |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found |kconfig|     y      |   kspp   | self_protection  | FAIL: CONFIG_CC_IS_CLANG is not "y" |kconfig| is not set |   kspp   | self_protection  | FAIL: CONFIG_CC_IS_CLANG is not "y" |kconfig|     y      |   kspp   | self_protection  | OK |kconfig|   65536    |   kspp   | self_protection  | OK |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set" |kconfig| is not set |   kspp   | self_protection  | OK |kconfig|     y      |   kspp   | self_protection  | OK |kconfig|     y      |   kspp   | self_protection  | OK: CONFIG_SLS is "y" |kconfig|     y      |   kspp   | self_protection  | OK |kconfig|     y      |   kspp   | self_protection  | FAIL: "m" |kconfig| is not set |a13xp0p0v | self_protection  | FAIL: CONFIG_CFI_AUTO_DEFAULT is not present |kconfig|     y      |defconfig | security_policy  | OK |kconfig|     y      |   kspp   | security_policy  | OK |kconfig|     y      |   kspp   | security_policy  | OK |kconfig| is not set |   kspp   | security_policy  | OK: is not found |kconfig| is not set |   kspp   | security_policy  | FAIL: "y" |kconfig| is not set |   kspp   | security_policy  | FAIL: "y" |kconfig| is not set |   kspp   | security_policy  | OK: is not found |kconfig| is not set |   kspp   | security_policy  | OK: is not found |kconfig|     y      |a13xp0p0v | security_policy  | OK |kconfig|     y      |defconfig |cut_attack_surface| OK |kconfig|     y      |defconfig |cut_attack_surface| OK |kconfig|     y      |defconfig |cut_attack_surface| OK |kconfig|     y      |defconfig |cut_attack_surface| OK |kconfig|     y      |defconfig |cut_attack_surface| OK |kconfig|     y      |   kspp   |cut_attack_surface| OK |kconfig| is not set |   kspp   |cut_attack_surface| OK |kconfig| is not set |   kspp   |cut_attack_surface| OK |kconfig| is not set |   kspp   |cut_attack_surface| OK: is not found |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "m" |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "m" |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y" |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y" |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y" |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y" |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y" |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y" |kconfig| is not set |   kspp   |cut_attack_surface| OK: is not found |kconfig| is not set |   kspp   |cut_attack_surface| OK |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y" |kconfig| is not set |   kspp   |cut_attack_surface| OK: is not found |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "m" |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y" |kconfig| is not set |   kspp   |cut_attack_surface| OK |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y" |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y" |kconfig|     y      |   kspp   |cut_attack_surface| FAIL: "is not set" |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y" |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y" |kconfig| is not set |   kspp   |cut_attack_surface| OK |kconfig| is not set |maintainer|cut_attack_surface| OK |kconfig| is not set |maintainer|cut_attack_surface| FAIL: "y" |kconfig| is not set |maintainer|cut_attack_surface| FAIL: "y" |kconfig| is not set |maintainer|cut_attack_surface| OK |kconfig| is not set |maintainer|cut_attack_surface| OK: is not found |kconfig| is not set |maintainer|cut_attack_surface| OK: is not found |kconfig| is not set |maintainer|cut_attack_surface| FAIL: "m" |kconfig| is not set |  grsec   |cut_attack_surface| OK |kconfig| is not set |  grsec   |cut_attack_surface| OK |kconfig| is not set |  grsec   |cut_attack_surface| OK: is not found |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "m" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "m" |kconfig| is not set |  grsec   |cut_attack_surface| OK: is not found |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "m" |kconfig| is not set |  grsec   |cut_attack_surface| OK |kconfig| is not set |  grsec   |cut_attack_surface| OK |kconfig| is not set |  grsec   |cut_attack_surface| OK |kconfig| is not set |  grsec   |cut_attack_surface| OK: is not found |kconfig| is not set |  grsec   |cut_attack_surface| OK: is not found |kconfig| is not set |  grsec   |cut_attack_surface| OK: is not found |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| OK |kconfig| is not set |  grsec   |cut_attack_surface| OK |kconfig| is not set |  grsec   |cut_attack_surface| OK |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "m" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "m" |kconfig| is not set |  grsec   |cut_attack_surface| OK: is not found |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| OK: is not found |kconfig| is not set |  grsec   |cut_attack_surface| OK: is not found |kconfig| is not set |  grsec   |cut_attack_surface| OK |kconfig| is not set |  grsec   |cut_attack_surface| OK: is not found |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "m" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "m" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "m" |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y" |kconfig| is not set |  grsec   |cut_attack_surface| OK |kconfig| is not set |  grsec   |cut_attack_surface| OK: is not found |kconfig| is not set |  grsec   |cut_attack_surface| OK: is not found |kconfig| is not set |  grsec   |cut_attack_surface| OK |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y" |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y" |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y" |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y" |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y" |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y" |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "m" |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y" |kconfig| is not set |  clipos  |cut_attack_surface| OK |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y" |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y" |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y" |kconfig| is not set |grapheneos|cut_attack_surface| FAIL: "y" |kconfig| is not set | lockdown |cut_attack_surface| FAIL: "m" |kconfig| is not set | lockdown |cut_attack_surface| OK |kconfig| is not set | lockdown |cut_attack_surface| FAIL: "y" |kconfig| is not set | lockdown |cut_attack_surface| FAIL: "y" |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "y" |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "y" |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "m" |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "y" |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "m" |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "m" |kconfig| is not set |a13xp0p0v |cut_attack_surface| OK: is not found |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "y" |kconfig| is not set |a13xp0p0v |cut_attack_surface| OK: is not found |kconfig| is not set |a13xp0p0v |cut_attack_surface| OK |kconfig| is not set |a13xp0p0v |cut_attack_surface| OK: is not found |kconfig| is not set |a13xp0p0v |cut_attack_surface| OK: is not found |kconfig| is not set |a13xp0p0v |cut_attack_surface| OK |kconfig| is not set |a13xp0p0v |cut_attack_surface| OK: is not found |kconfig|     y      |a13xp0p0v |cut_attack_surface| FAIL: "is not set" |kconfig| is not set |  clipos  | harden_userspace | FAIL: "y" |kconfig|     32     |a13xp0p0v | harden_userspace | OK |kconfig|     16     |a13xp0p0v | harden_userspace | OK |kconfig|     y      |   kspp   | harden_userspace | FAIL: is not found |cmdline| is not set |defconfig | self_protection  | OK: is not found |cmdline| is not set |defconfig | self_protection  | OK: is not found |cmdline| is not set |defconfig | self_protection  | OK: is not found |cmdline| is not set |defconfig | self_protection  | OK: is not found |cmdline| is not set |defconfig | self_protection  | OK: is not found |cmdline| is not set |defconfig | self_protection  | OK: is not found |cmdline| is not set |defconfig | self_protection  | OK: is not found |cmdline| is not set |defconfig | self_protection  | OK: is not found |cmdline| is not set |defconfig | self_protection  | OK: is not found |cmdline| is not set |defconfig | self_protection  | OK: is not found |cmdline| is not set |defconfig | self_protection  | OK: is not found |cmdline| is not set |defconfig | self_protection  | OK: is not found |cmdline| is not off |defconfig | self_protection  | FAIL: is off, not found |cmdline| is not off |defconfig | self_protection  | FAIL: is off, not found |cmdline| is not off |defconfig | self_protection  | FAIL: is off, not found |cmdline| is not off |defconfig | self_protection  | FAIL: is off, not found |cmdline| is not off |defconfig | self_protection  | FAIL: is off, not found |cmdline| is not off |defconfig | self_protection  | FAIL: is off, not found |cmdline| is not off |defconfig | self_protection  | FAIL: is off, not found |cmdline| is not off |defconfig | self_protection  | FAIL: is off, not found |cmdline| is not off |defconfig | self_protection  | FAIL: is off, not found |cmdline| is not off |defconfig | self_protection  | FAIL: is off, not found |cmdline| is not off |defconfig | self_protection  | FAIL: is off, not found |cmdline| is not off |defconfig | self_protection  | FAIL: is off, not found |cmdline| is not off |defconfig | self_protection  | FAIL: is off, not found |cmdline|     on     |defconfig | self_protection  | OK: rodata is not found |cmdline| is not set |   kspp   | self_protection  | OK: is not found |cmdline| is not set |   kspp   | self_protection  | OK: is not found |cmdline|     1      |   kspp   | self_protection  | FAIL: is not found |cmdline| is present |   kspp   | self_protection  | FAIL: is not present |cmdline|     1      |   kspp   | self_protection  | OK: CONFIG_INIT_ON_ALLOC_DEFAULT_ON is "y" |cmdline|     1      |   kspp   | self_protection  | FAIL: is not found |cmdline|     1      |   kspp   | self_protection  | OK: CONFIG_HARDENED_USERCOPY is "y" |cmdline| is not set |   kspp   | self_protection  | OK: is not found |cmdline|    100     |   kspp   | self_protection  | FAIL: is not found |cmdline|     1      |   kspp   | self_protection  | FAIL: is not found |cmdline|     0      |   kspp   | self_protection  | OK: CONFIG_IOMMU_DEFAULT_PASSTHROUGH is "is not set" |cmdline|     1      |   kspp   | self_protection  | OK: CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT is "y" |cmdline| auto,nosmt |   kspp   | self_protection  | FAIL: is not found |cmdline|     on     |   kspp   | self_protection  | FAIL: is not found |cmdline|    kcfi    |   kspp   | self_protection  | FAIL: is not found |cmdline|   force    |  clipos  | self_protection  | FAIL: is not found |cmdline|    off     |defconfig |cut_attack_surface| OK: CONFIG_X86_INTEL_TSX_MODE_OFF is "y" |cmdline| is present |   kspp   |cut_attack_surface| FAIL: is not present |cmdline|    none    |   kspp   |cut_attack_surface| FAIL: is not found |cmdline|     0      |   kspp   |cut_attack_surface| OK: CONFIG_COMPAT_VDSO is "is not set" |cmdline|    off     |  grsec   |cut_attack_surface| FAIL: is not found |cmdline| is not set |grapheneos|cut_attack_surface| OK: is not found |cmdline|     0      |a13xp0p0v |cut_attack_surface| OK: CONFIG_BLK_DEV_WRITE_MOUNTED is not found |cmdline|     0      |a13xp0p0v |cut_attack_surface| FAIL: is not found |cmdline| is not set |defconfig | harden_userspace | OK: is not found |sysctl |     2      |   kspp   | self_protection  | FAIL: is not found |sysctl |    100     |a13xp0p0v | self_protection  | FAIL: "10000" |sysctl |    100     |a13xp0p0v | self_protection  | FAIL: "0" |sysctl |   65536    |   kspp   | self_protection  | OK |sysctl |     1      |   kspp   |cut_attack_surface| OK |sysctl |     3      |   kspp   |cut_attack_surface| FAIL: "4" |sysctl |     0      |   kspp   |cut_attack_surface| FAIL: "63899" |sysctl |     0      |   kspp   |cut_attack_surface| FAIL: "1" |sysctl |     2      |   kspp   |cut_attack_surface| FAIL: "1" |sysctl |     0      |   kspp   |cut_attack_surface| FAIL: "1" |sysctl |     1      |   kspp   |cut_attack_surface| FAIL: "0" |sysctl |     1      |   kspp   |cut_attack_surface| FAIL: "2" |sysctl |     0      |   kspp   |cut_attack_surface| OK |sysctl |     1      |   kspp   |cut_attack_surface| FAIL: "0" |sysctl |     2      |  grsec   |cut_attack_surface| FAIL: "0" |sysctl |     0      |a13xp0p0v |cut_attack_surface| FAIL: "176" |sysctl |     1      |   kspp   | harden_userspace | OK |sysctl |     1      |   kspp   | harden_userspace | OK |sysctl |     2      |   kspp   | harden_userspace | FAIL: "1" |sysctl |     2      |   kspp   | harden_userspace | OK |sysctl |     0      |   kspp   | harden_userspace | FAIL: "2" |sysctl |     2      |   kspp   | harden_userspace | OK |sysctl |     3      |   kspp   | harden_userspace | FAIL: "1" |sysctl |     32     |a13xp0p0v | harden_userspace | FAIL: is not found |sysctl |     16     |a13xp0p0v | harden_userspace | FAIL: is not found

[+] Config check is finished: 'OK' - 145 / 'FAIL' - 153

```

## Generating a Kconfig fragment with the security hardening options

With the `-g` argument, the tool generates a Kconfig fragment with the security hardening options for the selected microarchitecture.

This Kconfig fragment can be merged with the existing Linux kernel config:

```

$ ./bin/kernel-hardening-checker -g X86_64 > /tmp/fragment

$ cd ~/linux-src/

$ ./scripts/kconfig/merge_config.sh .config /tmp/fragment

Using .config as base

Merging /tmp/fragment

Value of CONFIG_BUG_ON_DATA_CORRUPTION is redefined by fragment /tmp/fragment:

Previous value: # CONFIG_BUG_ON_DATA_CORRUPTION is not set

New value: CONFIG_BUG_ON_DATA_CORRUPTION=y

 ...

```

## Thanks

Thanks to the [contributors][26] and users of this project!

## Questions and answers

__Q:__ How all these kernel parameters influence the Linux kernel security?

__A:__ To answer this question, you can use the `kernel-hardening-checker` [sources of recommendations][24]

and the [Linux Kernel Defence Map][4] with its references.




__Q:__ How disabling `CONFIG_USER_NS` cuts the attack surface? It's needed for containers!

__A:__ Yes, the `CONFIG_USER_NS` option provides some isolation between the userspace programs,

but the tool recommends disabling it to cut the attack surface __of the kernel__.

The rationale:

  - An LWN article about the corresponding LKML discussion: https://lwn.net/Articles/673597/

  - A twitter thread about `CONFIG_USER_NS` and security: https://twitter.com/robertswiecki/status/1095447678949953541

  - A good overview of the trade-off between having user namespaces enabled, disabled and available only for root: https://github.com/NixOS/nixpkgs/pull/84522#issuecomment-614640601




__Q:__ KSPP and CLIP OS recommend `CONFIG_PANIC_ON_OOPS=y`. Why doesn't this tool do the same?

__A:__ I can't support this recommendation because:

  - It decreases system robustness (kernel oops is still not a rare situation even on production systems)

  - It allows easier denial-of-service attacks for the whole system

You should enable `CONFIG_PANIC_ON_OOPS` if:

  - Your kernel doesn't encounter oopses during a typical workload

  - Occasional system reboot is not a problem in your use case

I see a good compromise, which `kernel-hardening-checker` recommends:

  - Enable the `CONFIG_BUG` kconfig option. If a kernel oops happens in the process context, the offending/attacking process is killed. In other cases, the kernel panics, which is similar to `CONFIG_PANIC_ON_OOPS=y`.

  - Set the sysctl options `kernel.oops_limit` and `kernel.warn_limit` to `100`, for example. On the one hand, this value doesn't allow easy DoS. On the other hand, it is not too large to miss the vulnerability exploitation attempts generating a lot of kernel warnings or oopses.




__Q:__ Why enabling `CONFIG_STATIC_USERMODEHELPER` breaks various things in my GNU/Linux system?

Do I really need that feature?

__A:__ Linux kernel usermode helpers can be used for privilege escalation in kernel exploits

([example 1][9], [example 2][10]). `CONFIG_STATIC_USERMODEHELPER` prevents that method. But it

requires the corresponding support in the userspace: see the [example implementation][11] by

Tycho Andersen [@tych0][12].




__Q:__ What about performance impact of these security hardening options?

__A:__ Ike Devolder [@BlackIkeEagle][7] made some performance tests and described the results in [this article][8].

A more detailed evaluation is in the TODO list (the issue [#66][21]).




__Q:__ Can I easily check which kernel versions support some Kconfig option?

__A:__ Yes. See the [LKDDb][18] project (Linux Kernel Driver Database) by Giacomo Catenazzi [@cateee][19].

You can use it for the `mainline` or `stable` tree from [kernel.org][20] or for your custom kernel sources.




__Q:__ Does my kernel have all those mitigations of Transient Execution Vulnerabilities in my hardware?

__A:__ Checking the kernel config is not enough to answer this question.

I highly recommend using [spectre-meltdown-checker][13] tool maintained by Stéphane Lesimple [@speed47][14].




__Q:__ Why the `CONFIG_GCC_PLUGINS` option is automatically disabled during the kernel compilation?

__A:__ It means that your gcc doesn't support plugins. For example, if you have `gcc-14` on Ubuntu,

try to install `gcc-14-plugin-dev` package, it should help.

[1]: https://kspp.github.io/Recommended_Settings

[2]: https://docs.clip-os.org/clipos/kernel.html#configuration

[3]: https://grsecurity.net/

[4]: https://github.com/a13xp0p0v/linux-kernel-defence-map

[5]: https://lwn.net/Articles/791863/

[6]: https://github.com/a13xp0p0v/kernel-hardening-checker/issues/38

[7]: https://github.com/BlackIkeEagle

[8]: https://blog.herecura.eu/blog/2020-05-30-kconfig-hardening-tests/

[9]: https://googleprojectzero.blogspot.com/2018/09/a-cache-invalidation-bug-in-linux.html

[10]: https://a13xp0p0v.github.io/2020/02/15/CVE-2019-18683.html

[11]: https://github.com/tych0/huldufolk

[12]: https://github.com/tych0

[13]: https://github.com/speed47/spectre-meltdown-checker

[14]: https://github.com/speed47

[15]: https://github.com/a13xp0p0v/kernel-hardening-checker/issues/53

[16]: https://github.com/a13xp0p0v/kernel-hardening-checker/pull/54

[17]: https://github.com/a13xp0p0v/kernel-hardening-checker/pull/62

[18]: https://cateee.net/lkddb/web-lkddb/

[19]: https://github.com/cateee/lkddb

[20]: https://kernel.org/

[21]: https://github.com/a13xp0p0v/kernel-hardening-checker/issues/66

[22]: https://github.com/a13xp0p0v/kernel-hardening-checker/issues/56

[23]: https://github.com/a13xp0p0v/kernel-hardening-checker/issues?q=label%3Akernel_maintainer_feedback

[24]: https://github.com/a13xp0p0v/kernel-hardening-checker#motivation

[25]: https://grapheneos.org/features

[26]: https://github.com/a13xp0p0v/kernel-hardening-checker/graphs/contributors