1# Help: Basic kernel hardening options
2#
3# These are considered the basic kernel hardening, self-protection, and
4# attack surface reduction options. They are expected to have low (or
5# no) performance impact on most workloads, and have a reasonable level
6# of legacy API removals.
7
8# Make sure reporting of various hardening actions is possible.
9CONFIG_BUG=y
10
11# Basic kernel memory permission enforcement.
12CONFIG_STRICT_KERNEL_RWX=y
13CONFIG_STRICT_MODULE_RWX=y
14CONFIG_VMAP_STACK=y
15
16# Kernel image and memory ASLR.
17CONFIG_RANDOMIZE_BASE=y
18CONFIG_RANDOMIZE_MEMORY=y
19
20# Randomize allocator freelists, harden metadata.
21CONFIG_SLAB_FREELIST_RANDOM=y
22CONFIG_SLAB_FREELIST_HARDENED=y
23CONFIG_SHUFFLE_PAGE_ALLOCATOR=y
24CONFIG_RANDOM_KMALLOC_CACHES=y
25
26# Sanity check userspace page table mappings.
27CONFIG_PAGE_TABLE_CHECK=y
28CONFIG_PAGE_TABLE_CHECK_ENFORCED=y
29
30# Randomize kernel stack offset on syscall entry.
31CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y
32
33# Basic stack frame overflow protection.
34CONFIG_STACKPROTECTOR=y
35CONFIG_STACKPROTECTOR_STRONG=y
36
37# Basic buffer length bounds checking.
38CONFIG_HARDENED_USERCOPY=y
39CONFIG_FORTIFY_SOURCE=y
40
41# Basic array index bounds checking.
42CONFIG_UBSAN=y
43CONFIG_UBSAN_TRAP=y
44CONFIG_UBSAN_BOUNDS=y
45# CONFIG_UBSAN_SHIFT is not set
46# CONFIG_UBSAN_DIV_ZERO is not set
47# CONFIG_UBSAN_UNREACHABLE is not set
48# CONFIG_UBSAN_SIGNED_WRAP is not set
49# CONFIG_UBSAN_BOOL is not set
50# CONFIG_UBSAN_ENUM is not set
51# CONFIG_UBSAN_ALIGNMENT is not set
52
53# Sampling-based heap out-of-bounds and use-after-free detection.
54CONFIG_KFENCE=y
55
56# Linked list integrity checking.
57CONFIG_LIST_HARDENED=y
58
59# Initialize all heap variables to zero on allocation.
60CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
61
62# Initialize all stack variables to zero on function entry.
63CONFIG_INIT_STACK_ALL_ZERO=y
64
65# Wipe RAM at reboot via EFI. For more details, see:
66# https://trustedcomputinggroup.org/resource/pc-client-work-group-platform-reset-attack-mitigation-specification/
67# https://bugzilla.redhat.com/show_bug.cgi?id=1532058
68CONFIG_RESET_ATTACK_MITIGATION=y
69
70# Disable DMA between EFI hand-off and the kernel's IOMMU setup.
71CONFIG_EFI_DISABLE_PCI_DMA=y
72
73# Force IOMMU TLB invalidation so devices will never be able to access stale
74# data content.
75CONFIG_IOMMU_SUPPORT=y
76CONFIG_IOMMU_DEFAULT_DMA_STRICT=y
77
78# Do not allow direct physical memory access to non-device memory.
79CONFIG_STRICT_DEVMEM=y
80CONFIG_IO_STRICT_DEVMEM=y
81
82# Provide userspace with seccomp BPF API for syscall attack surface reduction.
83CONFIG_SECCOMP=y
84CONFIG_SECCOMP_FILTER=y
85
86# Provides some protections against SYN flooding.
87CONFIG_SYN_COOKIES=y
88
89# Enable Kernel Control Flow Integrity (currently Clang only).
90CONFIG_CFI_CLANG=y
91# CONFIG_CFI_PERMISSIVE is not set
92
93# Attack surface reduction: do not autoload TTY line disciplines.
94# CONFIG_LDISC_AUTOLOAD is not set
95
96# Dangerous; enabling this disables userspace brk ASLR.
97# CONFIG_COMPAT_BRK is not set
98
99# Dangerous; exposes kernel text image layout.
100# CONFIG_PROC_KCORE is not set
101
102# Dangerous; enabling this disables userspace VDSO ASLR.
103# CONFIG_COMPAT_VDSO is not set
104
105# Attack surface reduction: Use the modern PTY interface (devpts) only.
106# CONFIG_LEGACY_PTYS is not set
107