Git-Mirrors
/
plague-kernel
mirror of https://0xacab.org/optout/plague-kernel.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
47 Commits 1 Branch 0 Tags 569 KiB
Shell 100%
Go to file
optout 10a726ba94
Fixed spacing between opt selections 		2024-04-12 16:47:29 +00:00
6.6.13-hardened1.config Build script fix to KVER standard variable | additional trimming & general config tweaks 2024-02-01 14:59:50 +00:00
README.md Update documentation 2024-03-03 18:41:59 +00:00
host_hardened.config Update naming schema | WIP warning with virt_hardened 2024-03-03 18:37:09 +00:00
self_compilation.sh Fixed spacing between opt selections 2024-04-12 16:47:29 +00:00
virt_hardened.config Update naming schema | WIP warning with virt_hardened 2024-03-03 18:37:09 +00:00

README.md

What is the Plague kernel?

The Plague kernel was initially designed for PlagueOS (hardened Void Linux musl), however the project has taken a life of its own. The kernel is distro-agnostic, therefore it can be ran on Debian, Fedora, Void Linux, and many more. The script detailed below allows for self-compilation of the Plague kernel, along with the option to tailor a custom kernel to your specific hardware.

  • host_hardened.config - Feature-complete baseline designed for the host
  • virt_hardened.config - Work-in-progress baseline designed to work within various guest Virtual Machines
    • Note: This is currently bootable, but a comprehensive test is still needed within a set of VMs. Most notable issues at the moment are video/media drivers preventing video playback

The script performs a variety of functions:

  • Installs needed dependencies for compilation
  • Stages desired linux-hardened kernel under /usr/src/
  • Imports Plague kernel configuration (KSPP recommendations applied + trimming)
  • (Optional) Cut attack surface further by evaluating mapped modules on current system, thus deselecting a variety of bloat from the configuration
  • Remove unnecessary artifacts such as System.map & signing keys

Steps to self-compile

  1. Run bash self_compilation.sh
  2. Set the Kernel version (KVER) variable to a released version you want to obtain from Anthraxx's linux-hardened repository

Note: If you are planning on mapping modules used by your system when prompted via the script, we highly recommend that you access peripherals such as Webcams, adapters, USBs, protocols such as Bluetooth prior to running the script, if they are desired.

Trimming Efforts

While linux-hardened security patchsets along with kernel configurations are notable for this kernel project, the purpose was to practice minimalism by reducing the size of the linux kernel, thereby cutting attack surface. This is not a trivial thing to record, therefore we are displaying the size purely as a point of comparison.

Plague (Virt) Plague (Host) TAILS Whonix Vanilla
Size (/lib/modules/) 1.8 MB 31.0 MB 89.0 MB 89.0 MB 126.0 MB
Size (vmlinuz) 7.9 MB 8.0 MB 7.8 MB 7.8 MB 14.0 MB
No. of modules 69 1409 4039 4044 4402

Additional Resources:

Current kernel-hardening-checker results

Successes

Option Desired Value Source Reason Result
CONFIG_BUG y defconfig self_protection OK
CONFIG_THREAD_INFO_IN_TASK y defconfig self_protection OK
CONFIG_IOMMU_SUPPORT y defconfig self_protection OK
CONFIG_STACKPROTECTOR y defconfig self_protection OK
CONFIG_STACKPROTECTOR_STRONG y defconfig self_protection OK
CONFIG_STRICT_KERNEL_RWX y defconfig self_protection OK
CONFIG_STRICT_MODULE_RWX y defconfig self_protection OK
CONFIG_REFCOUNT_FULL y defconfig self_protection OK: version >= 5.5
CONFIG_INIT_STACK_ALL_ZERO y defconfig self_protection OK
CONFIG_RANDOMIZE_BASE y defconfig self_protection OK
CONFIG_VMAP_STACK y defconfig self_protection OK
CONFIG_SPECULATION_MITIGATIONS y defconfig self_protection OK
CONFIG_DEBUG_WX y defconfig self_protection OK
CONFIG_WERROR y defconfig self_protection OK
CONFIG_X86_MCE y defconfig self_protection OK
CONFIG_X86_MCE_INTEL y defconfig self_protection OK
CONFIG_X86_MCE_AMD y defconfig self_protection OK
CONFIG_RETPOLINE y defconfig self_protection OK
CONFIG_SYN_COOKIES y defconfig self_protection OK
CONFIG_MICROCODE y defconfig self_protection OK
CONFIG_MICROCODE_INTEL y defconfig self_protection OK: CONFIG_MICROCODE is "y"
CONFIG_MICROCODE_AMD y defconfig self_protection OK: CONFIG_MICROCODE is "y"
CONFIG_X86_SMAP y defconfig self_protection OK: version >= 5.19
CONFIG_X86_UMIP y defconfig self_protection OK
CONFIG_PAGE_TABLE_ISOLATION y defconfig self_protection OK
CONFIG_RANDOMIZE_MEMORY y defconfig self_protection OK
CONFIG_X86_KERNEL_IBT y defconfig self_protection OK
CONFIG_CPU_SRSO y defconfig self_protection OK
CONFIG_INTEL_IOMMU y defconfig self_protection OK
CONFIG_AMD_IOMMU y defconfig self_protection OK
CONFIG_BUG_ON_DATA_CORRUPTION y kspp self_protection OK
CONFIG_SLAB_FREELIST_HARDENED y kspp self_protection OK
CONFIG_SLAB_FREELIST_RANDOM y kspp self_protection OK
CONFIG_SHUFFLE_PAGE_ALLOCATOR y kspp self_protection OK
CONFIG_FORTIFY_SOURCE y kspp self_protection OK
CONFIG_DEBUG_LIST y kspp self_protection OK
CONFIG_INIT_ON_ALLOC_DEFAULT_ON y kspp self_protection OK
CONFIG_SCHED_CORE y kspp self_protection OK
CONFIG_SCHED_STACK_END_CHECK y kspp self_protection OK
CONFIG_KFENCE y kspp self_protection OK
CONFIG_KFENCE_SAMPLE_INTERVAL is not off my self_protection OK: is not off, "100"
CONFIG_HARDENED_USERCOPY y kspp self_protection OK
CONFIG_HARDENED_USERCOPY_FALLBACK is not set kspp self_protection OK: is not found
CONFIG_HARDENED_USERCOPY_PAGESPAN is not set kspp self_protection OK: is not found
CONFIG_MODULE_SIG y kspp self_protection OK
CONFIG_MODULE_SIG_ALL y kspp self_protection OK
CONFIG_MODULE_SIG_SHA512 y kspp self_protection OK
CONFIG_MODULE_SIG_FORCE y kspp self_protection OK
CONFIG_INIT_ON_FREE_DEFAULT_ON y kspp self_protection OK
CONFIG_EFI_DISABLE_PCI_DMA y kspp self_protection OK
CONFIG_RESET_ATTACK_MITIGATION y kspp self_protection OK
CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT y kspp self_protection OK
CONFIG_HW_RANDOM_TPM y kspp self_protection OK
CONFIG_DEFAULT_MMAP_MIN_ADDR 65536 kspp self_protection OK
CONFIG_IOMMU_DEFAULT_DMA_STRICT y kspp self_protection OK
CONFIG_IOMMU_DEFAULT_PASSTHROUGH is not set kspp self_protection OK
CONFIG_INTEL_IOMMU_DEFAULT_ON y kspp self_protection OK
CONFIG_SLS y kspp self_protection OK
CONFIG_INTEL_IOMMU_SVM y kspp self_protection OK
CONFIG_AMD_IOMMU_V2 y kspp self_protection OK
CONFIG_SLAB_MERGE_DEFAULT is not set clipos self_protection OK
CONFIG_LIST_HARDENED y my self_protection OK
CONFIG_RANDOM_KMALLOC_CACHES y my self_protection OK
CONFIG_SECURITY y defconfig security_policy OK
CONFIG_SECURITY_YAMA y kspp security_policy OK
CONFIG_SECURITY_LANDLOCK y kspp security_policy OK
CONFIG_SECURITY_SELINUX_DISABLE is not set kspp security_policy OK: is not found
CONFIG_SECURITY_LOCKDOWN_LSM y kspp security_policy OK
CONFIG_SECURITY_LOCKDOWN_LSM_EARLY y kspp security_policy OK
CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY y kspp security_policy OK
CONFIG_SECURITY_WRITABLE_HOOKS is not set kspp security_policy OK: is not found
CONFIG_SECURITY_SELINUX_DEBUG is not set my security_policy OK
CONFIG_SECURITY_SELINUX y my security_policy OK
CONFIG_SECCOMP y defconfig cut_attack_surface OK
CONFIG_SECCOMP_FILTER y defconfig cut_attack_surface OK
CONFIG_BPF_UNPRIV_DEFAULT_OFF y defconfig cut_attack_surface OK
CONFIG_STRICT_DEVMEM y defconfig cut_attack_surface OK: CONFIG_DEVMEM is "is not set"
CONFIG_X86_INTEL_TSX_MODE_OFF y defconfig cut_attack_surface OK
CONFIG_SECURITY_DMESG_RESTRICT y kspp cut_attack_surface OK
CONFIG_ACPI_CUSTOM_METHOD is not set kspp cut_attack_surface OK: is not found
CONFIG_COMPAT_BRK is not set kspp cut_attack_surface OK
CONFIG_DEVKMEM is not set kspp cut_attack_surface OK: is not found
CONFIG_INET_DIAG is not set kspp cut_attack_surface OK
CONFIG_KEXEC is not set kspp cut_attack_surface OK
CONFIG_PROC_KCORE is not set kspp cut_attack_surface OK
CONFIG_LEGACY_PTYS is not set kspp cut_attack_surface OK
CONFIG_HIBERNATION is not set kspp cut_attack_surface OK
CONFIG_COMPAT is not set kspp cut_attack_surface OK: is not found
CONFIG_IA32_EMULATION is not set kspp cut_attack_surface OK
CONFIG_X86_X32 is not set kspp cut_attack_surface OK: is not found
CONFIG_X86_X32_ABI is not set kspp cut_attack_surface OK
CONFIG_MODIFY_LDT_SYSCALL is not set kspp cut_attack_surface OK
CONFIG_OABI_COMPAT is not set kspp cut_attack_surface OK: is not found
CONFIG_X86_MSR is not set kspp cut_attack_surface OK
CONFIG_LEGACY_TIOCSTI is not set kspp cut_attack_surface OK
CONFIG_DEVMEM is not set kspp cut_attack_surface OK
CONFIG_IO_STRICT_DEVMEM y kspp cut_attack_surface OK: CONFIG_DEVMEM is "is not set"
CONFIG_LDISC_AUTOLOAD is not set kspp cut_attack_surface OK
CONFIG_COMPAT_VDSO is not set kspp cut_attack_surface OK: is not found
CONFIG_X86_VSYSCALL_EMULATION is not set kspp cut_attack_surface OK
CONFIG_ZSMALLOC_STAT is not set grsec cut_attack_surface OK
CONFIG_PAGE_OWNER is not set grsec cut_attack_surface OK
CONFIG_DEBUG_KMEMLEAK is not set grsec cut_attack_surface OK
CONFIG_BINFMT_AOUT is not set grsec cut_attack_surface OK: is not found
CONFIG_KPROBE_EVENTS is not set grsec cut_attack_surface OK: is not found
CONFIG_UPROBE_EVENTS is not set grsec cut_attack_surface OK: is not found
CONFIG_GENERIC_TRACER is not set grsec cut_attack_surface OK: is not found
CONFIG_FUNCTION_TRACER is not set grsec cut_attack_surface OK: is not found
CONFIG_STACK_TRACER is not set grsec cut_attack_surface OK: is not found
CONFIG_HIST_TRIGGERS is not set grsec cut_attack_surface OK: is not found
CONFIG_BLK_DEV_IO_TRACE is not set grsec cut_attack_surface OK: is not found
CONFIG_PROC_VMCORE is not set grsec cut_attack_surface OK
CONFIG_PROC_PAGE_MONITOR is not set grsec cut_attack_surface OK
CONFIG_USELIB is not set grsec cut_attack_surface OK
CONFIG_CHECKPOINT_RESTORE is not set grsec cut_attack_surface OK
CONFIG_USERFAULTFD is not set grsec cut_attack_surface OK
CONFIG_HWPOISON_INJECT is not set grsec cut_attack_surface OK: is not found
CONFIG_MEM_SOFT_DIRTY is not set grsec cut_attack_surface OK: is not found
CONFIG_DEVPORT is not set grsec cut_attack_surface OK
CONFIG_DEBUG_FS is not set grsec cut_attack_surface OK
CONFIG_NOTIFIER_ERROR_INJECTION is not set grsec cut_attack_surface OK
CONFIG_FAIL_FUTEX is not set grsec cut_attack_surface OK: is not found
CONFIG_PUNIT_ATOM_DEBUG is not set grsec cut_attack_surface OK
CONFIG_ACPI_CONFIGFS is not set grsec cut_attack_surface OK
CONFIG_EDAC_DEBUG is not set grsec cut_attack_surface OK
CONFIG_DRM_I915_DEBUG is not set grsec cut_attack_surface OK
CONFIG_BCACHE_CLOSURES_DEBUG is not set grsec cut_attack_surface OK
CONFIG_DVB_C8SECTPFE is not set grsec cut_attack_surface OK: is not found
CONFIG_MTD_SLRAM is not set grsec cut_attack_surface OK: is not found
CONFIG_MTD_PHRAM is not set grsec cut_attack_surface OK: is not found
CONFIG_IO_URING is not set grsec cut_attack_surface OK
CONFIG_RSEQ is not set grsec cut_attack_surface OK
CONFIG_LATENCYTOP is not set grsec cut_attack_surface OK
CONFIG_KCOV is not set grsec cut_attack_surface OK
CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set grsec cut_attack_surface OK
CONFIG_SUNRPC_DEBUG is not set grsec cut_attack_surface OK: is not found
CONFIG_PTDUMP_DEBUGFS is not set grsec cut_attack_surface OK: is not found
CONFIG_DRM_LEGACY is not set maintainer cut_attack_surface OK
CONFIG_BLK_DEV_FD is not set maintainer cut_attack_surface OK: is not found
CONFIG_BLK_DEV_FD_RAWCMD is not set maintainer cut_attack_surface OK: is not found
CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT is not set maintainer cut_attack_surface OK: is not found
CONFIG_STAGING is not set clipos cut_attack_surface OK
CONFIG_KSM is not set clipos cut_attack_surface OK
CONFIG_KALLSYMS is not set clipos cut_attack_surface OK
CONFIG_MAGIC_SYSRQ is not set clipos cut_attack_surface OK
CONFIG_KEXEC_FILE is not set clipos cut_attack_surface OK
CONFIG_X86_CPUID is not set clipos cut_attack_surface OK
CONFIG_X86_IOPL_IOPERM is not set clipos cut_attack_surface OK
CONFIG_ACPI_TABLE_UPGRADE is not set clipos cut_attack_surface OK
CONFIG_EFI_CUSTOM_SSDT_OVERLAYS is not set clipos cut_attack_surface OK
CONFIG_AIO is not set clipos cut_attack_surface OK
CONFIG_EFI_TEST is not set lockdown cut_attack_surface OK
CONFIG_MMIOTRACE_TEST is not set lockdown cut_attack_surface OK: is not found
CONFIG_KPROBES is not set lockdown cut_attack_surface OK
CONFIG_MMIOTRACE is not set my cut_attack_surface OK: is not found
CONFIG_LIVEPATCH is not set my cut_attack_surface OK: is not found
CONFIG_IP_DCCP is not set my cut_attack_surface OK
CONFIG_IP_SCTP is not set my cut_attack_surface OK
CONFIG_FTRACE is not set my cut_attack_surface OK
CONFIG_VIDEO_VIVID is not set my cut_attack_surface OK
CONFIG_INPUT_EVBUG is not set my cut_attack_surface OK
CONFIG_KGDB is not set my cut_attack_surface OK
CONFIG_CORESIGHT is not set my cut_attack_surface OK: is not found
CONFIG_XFS_SUPPORT_V4 is not set my cut_attack_surface OK: is not found
CONFIG_TRIM_UNUSED_KSYMS y my cut_attack_surface OK
CONFIG_MODULE_FORCE_LOAD is not set my cut_attack_surface OK
CONFIG_COREDUMP is not set clipos harden_userspace OK
CONFIG_ARCH_MMAP_RND_BITS 32 my harden_userspace OK
CONFIG_BINFMT_MISC is not set kspp cut_attack_surface OK

Fails

Option Desired Value Source Reason Result
CONFIG_SLUB_DEBUG y defconfig self_protection FAIL: "is not set"
CONFIG_GCC_PLUGINS y defconfig self_protection FAIL: is not found
CONFIG_DEBUG_VIRTUAL y kspp self_protection FAIL: "is not set"
CONFIG_DEBUG_SG y kspp self_protection FAIL: "is not set"
CONFIG_DEBUG_CREDENTIALS y kspp self_protection FAIL: is not found
CONFIG_STATIC_USERMODEHELPER y kspp self_protection FAIL: "is not set"
CONFIG_DEBUG_NOTIFIERS y kspp self_protection FAIL: "is not set"
CONFIG_RANDSTRUCT_FULL y kspp self_protection FAIL: is not found
CONFIG_RANDSTRUCT_PERFORMANCE is not set kspp self_protection FAIL: CONFIG_RANDSTRUCT_FULL is not "y"
CONFIG_GCC_PLUGIN_LATENT_ENTROPY y kspp self_protection FAIL: CONFIG_GCC_PLUGINS is not "y"
CONFIG_UBSAN_BOUNDS y kspp self_protection FAIL: is not found
CONFIG_UBSAN_LOCAL_BOUNDS y kspp self_protection FAIL: is not found
CONFIG_UBSAN_TRAP y kspp self_protection FAIL: CONFIG_UBSAN_BOUNDS is not "y"
CONFIG_UBSAN_SANITIZE_ALL y kspp self_protection FAIL: CONFIG_UBSAN_BOUNDS is not "y"
CONFIG_GCC_PLUGIN_STACKLEAK y kspp self_protection FAIL: CONFIG_GCC_PLUGINS is not "y"
CONFIG_STACKLEAK_METRICS is not set kspp self_protection FAIL: CONFIG_GCC_PLUGINS is not "y"
CONFIG_STACKLEAK_RUNTIME_DISABLE is not set kspp self_protection FAIL: CONFIG_GCC_PLUGINS is not "y"
CONFIG_CFI_CLANG y kspp self_protection FAIL: is not found
CONFIG_CFI_PERMISSIVE is not set kspp self_protection FAIL: CONFIG_CFI_CLANG is not "y"
CONFIG_SECURITY_SELINUX_BOOTPARAM is not set kspp security_policy FAIL: "y"
CONFIG_SECURITY_SELINUX_DEVELOP is not set kspp security_policy FAIL: "y"
CONFIG_MODULES is not set kspp cut_attack_surface FAIL: "y"
CONFIG_FAIL_FUTEX is not set grsec cut_attack_surface OK: is not found
CONFIG_KCMP is not set grsec cut_attack_surface FAIL: "y"
CONFIG_FB is not set maintainer cut_attack_surface FAIL: "y"
CONFIG_VT is not set maintainer cut_attack_surface FAIL: "y"
CONFIG_USER_NS is not set clipos cut_attack_surface FAIL: "y"
CONFIG_BPF_SYSCALL is not set lockdown cut_attack_surface FAIL: "y" 
[+] Config check is finished: 'OK' - 169 / 'FAIL' - 27