kconfig-hardened-check
kconfig-hardened-check copied to clipboard
a13xp0p0v
A tool for checking the security hardening options of the Linux kernel
Found here: https://timesys.com/pdf/Timesys-kernel-hardening-guide.pdf Dated 2022 https://web.archive.org/web/20241227042743/https://timesys.com/pdf/Timesys-kernel-hardening-guide.pdf This seems useful for the project: `DEBUG_BUGVERBOSE=is not set` > Make sure this is not enabled, as it could provide an attacker > sensitive...
- `intel_iommu=on` - pass if value is `on` - pass if `CONFIG_INTEL_IOMMU_DEFAULT_ON` is `y` - skip if non-intel? - fail otherwise - `lockdown=confidentiality` - pass if value is `confidentiality` -...
Linux 6.12 added proc mem force, see https://lwn.net/Articles/983169/ - Kconfig: `CONFIG_PROC_MEM_NO_FORCE=y` - command-line: `proc_mem.force_override=never` or - Kconfig: `CONFIG_PROC_MEM_FORCE_PTRACE=y` - command-line: `proc_mem.force_override=ptrace`