up to 2.6.32.63, use .xz patch

[packages/kernel.git] / kernel-grsec.config

diff --git a/kernel-grsec.config b/kernel-grsec.config
index 89703feec87cd76c0671e82db436a1912b936e0d..e9a3c3e15560cda2cc6303c15c96e51cacf05ec8 100644 (file)
--- a/kernel-grsec.config
+++ b/kernel-grsec.config
@@ -1,13 +1,32 @@
 #
-# Getrewted Kernel Security
+# Grsecurity
 #
 CONFIG_GRKERNSEC=y
+# CONFIG_GRKERNSEC_LOW is not set
+# CONFIG_GRKERNSEC_MEDIUM is not set
+# CONFIG_GRKERNSEC_HIGH is not set
+CONFIG_GRKERNSEC_CUSTOM=y
 
 #
-# Buffer Overflow Protection
+# Address Space Protection
 #
-CONFIG_GRKERNSEC_STACK=y
-CONFIG_GRKERNSEC_STACK_GCC=y
+# CONFIG_GRKERNSEC_KMEM is not set
+# CONFIG_GRKERNSEC_IO is not set
+# CONFIG_GRKERNSEC_PROC_MEMMAP is not set
+CONFIG_GRKERNSEC_BRUTE=y
+CONFIG_GRKERNSEC_MODSTOP=y
+# CONFIG_GRKERNSEC_HIDESYM is not set
+# CONFIG_GRKERNSEC_KERN_LOCKOUT is not set
+
+CONFIG_GRKERNSEC_VM86=y
+
+#
+# Role Based Access Control Options
+#
+# CONFIG_GRKERNSEC_NO_RBAC is not set
+CONFIG_GRKERNSEC_ACL_HIDEKERN=y
+CONFIG_GRKERNSEC_ACL_MAXTRIES=3
+CONFIG_GRKERNSEC_ACL_TIMEOUT=30
 
 #
 # Filesystem Protections
@@ -16,51 +35,83 @@ CONFIG_GRKERNSEC_PROC=y
 # CONFIG_GRKERNSEC_PROC_USER is not set
 CONFIG_GRKERNSEC_PROC_USERGROUP=y
 CONFIG_GRKERNSEC_PROC_GID=17
+CONFIG_GRKERNSEC_PROC_ADD=y
 CONFIG_GRKERNSEC_LINK=y
 CONFIG_GRKERNSEC_FIFO=y
-CONFIG_GRKERNSEC_FD=y
+CONFIG_GRKERNSEC_SYSFS_RESTRICT=y
+CONFIG_GRKERNSEC_ROFS=y
 CONFIG_GRKERNSEC_CHROOT=y
-# CONFIG_GRKERNSEC_CHROOT_EXECLOG is not set
-# CONFIG_GRKERNSEC_CHROOT_CAPS is not set
-# CONFIG_GRKERNSEC_KBMAP is not set
+CONFIG_GRKERNSEC_CHROOT_MOUNT=y
+CONFIG_GRKERNSEC_CHROOT_DOUBLE=y
+CONFIG_GRKERNSEC_CHROOT_PIVOT=y
+CONFIG_GRKERNSEC_CHROOT_CHDIR=y
+CONFIG_GRKERNSEC_CHROOT_CHMOD=y
+CONFIG_GRKERNSEC_CHROOT_FCHDIR=y
+CONFIG_GRKERNSEC_CHROOT_MKNOD=y
+CONFIG_GRKERNSEC_CHROOT_SHMAT=y
+CONFIG_GRKERNSEC_CHROOT_UNIX=y
+CONFIG_GRKERNSEC_CHROOT_FINDTASK=y
+CONFIG_GRKERNSEC_CHROOT_NICE=y
+CONFIG_GRKERNSEC_CHROOT_SYSCTL=y
+CONFIG_GRKERNSEC_CHROOT_CAPS=y
 
 #
-# Security Logging
+# Kernel Auditing
 #
-# CONFIG_GRKERNSEC_EXECLOG is not set
-# CONFIG_GRKERNSEC_SUID is not set
+CONFIG_GRKERNSEC_AUDIT_GROUP=y
+CONFIG_GRKERNSEC_AUDIT_GID=1007
+CONFIG_GRKERNSEC_EXECLOG=y
+CONFIG_GRKERNSEC_RESLOG=y
+CONFIG_GRKERNSEC_CHROOT_EXECLOG=y
+CONFIG_GRKERNSEC_AUDIT_PTRACE=y
+CONFIG_GRKERNSEC_AUDIT_CHDIR=y
+CONFIG_GRKERNSEC_AUDIT_MOUNT=y
+CONFIG_GRKERNSEC_AUDIT_IPC=y
 CONFIG_GRKERNSEC_SIGNAL=y
-# CONFIG_GRKERNSEC_FORKFAIL is not set
+CONFIG_GRKERNSEC_FORKFAIL=y
 CONFIG_GRKERNSEC_TIME=y
+CONFIG_GRKERNSEC_PROC_IPADDR=y
+CONFIG_GRKERNSEC_AUDIT_TEXTREL=y
 
 #
 # Executable Protections
 #
 CONFIG_GRKERNSEC_EXECVE=y
-# CONFIG_GRKERNSEC_NOEXEC is not set
-# CONFIG_GRKERNSEC_SIDCAPS is not set
-# CONFIG_GRKERNSEC_TPE is not set
+CONFIG_GRKERNSEC_DMESG=y
+CONFIG_GRKERNSEC_HARDEN_PTRACE=y
+CONFIG_GRKERNSEC_PTRACE_READEXEC=y
+CONFIG_GRKERNSEC_SETXID=y
+CONFIG_GRKERNSEC_TPE=y
+CONFIG_GRKERNSEC_TPE_ALL=y
+# CONFIG_GRKERNSEC_TPE_INVERT is not set
+CONFIG_GRKERNSEC_TPE_GID=65500
 
 #
 # Network Protections
 #
-# CONFIG_GRKERNSEC_RANDPID is not set
-# CONFIG_GRKERNSEC_RANDID is not set
-# CONFIG_GRKERNSEC_RANDSRC is not set
-# CONFIG_GRKERNSEC_RANDPING is not set
-# CONFIG_GRKERNSEC_RANDTTL is not set
 CONFIG_GRKERNSEC_RANDNET=y
 CONFIG_GRKERNSEC_SOCKET=y
 CONFIG_GRKERNSEC_SOCKET_ALL=y
-CONFIG_GRKERNSEC_ALL_GID=65501
+CONFIG_GRKERNSEC_SOCKET_ALL_GID=65501
 CONFIG_GRKERNSEC_SOCKET_CLIENT=y
-CONFIG_GRKERNSEC_CLIENT_GID=65502
+CONFIG_GRKERNSEC_SOCKET_CLIENT_GID=65502
 CONFIG_GRKERNSEC_SOCKET_SERVER=y
-CONFIG_GRKERNSEC_SERVER_GID=65503
-# CONFIG_GRKERNSEC_STEALTH is not set
+CONFIG_GRKERNSEC_SOCKET_SERVER_GID=65503
+# CONFIG_GRKERNSEC_BLACKHOLE is not set
 
 #
-# Miscellaneous Enhancements
+# Sysctl support
 #
-# CONFIG_GRKERNSEC_COREDUMP is not set
-# CONFIG_OBV_PROC is not set
+CONFIG_GRKERNSEC_SYSCTL=y
+# CONFIG_GRKERNSEC_SYSCTL_ON is not set
+
+#
+# Logging Options
+#
+CONFIG_GRKERNSEC_FLOODTIME=10
+CONFIG_GRKERNSEC_FLOODBURST=10
+
+CONFIG_IP_NF_MATCH_STEALTH=m
+
+# CONFIG_GRKERNSEC_MODHARDEN is not set
+# CONFIG_PAX_MEMORY_STACKLEAK is not set