#
CONFIG_GRKERNSEC=y
# CONFIG_GRKERNSEC_LOW is not set
-# CONFIG_GRKERNSEC_MID is not set
-# CONFIG_GRKERNSEC_HI is not set
+# CONFIG_GRKERNSEC_MEDIUM is not set
+# CONFIG_GRKERNSEC_HIGH is not set
CONFIG_GRKERNSEC_CUSTOM=y
-CONFIG_IP_NF_MATCH_STEALTH=m
#
-# Buffer Overflow Protection
+# Address Space Protection
#
-CONFIG_GRKERNSEC_STACK=y
-CONFIG_GRKERNSEC_STACK_GCC=y
-CONFIG_GRKERNSEC_KMEM=y
-CONFIG_GRKERNSEC_KSYMS=y
-# CONFIG_GRKERNSEC_PAX_RANDMMAP is not set
+# CONFIG_GRKERNSEC_KMEM is not set
+# CONFIG_GRKERNSEC_IO is not set
+# CONFIG_GRKERNSEC_PROC_MEMMAP is not set
+CONFIG_GRKERNSEC_BRUTE=y
+CONFIG_GRKERNSEC_MODSTOP=y
+# CONFIG_GRKERNSEC_HIDESYM is not set
+# CONFIG_GRKERNSEC_KERN_LOCKOUT is not set
-#
-# ACL options
-#
-# CONFIG_GR_DEBUG is not set
-# CONFIG_GRKERNSEC_ACL_CAPLOG is not set
-CONFIG_GR_MAXTRIES=3
-CONFIG_GR_TIMEOUT=30
+CONFIG_GRKERNSEC_VM86=y
#
-# Access Control Lists
+# Role Based Access Control Options
#
-# CONFIG_OBV_PROC is not set
-# CONFIG_GRKERNSEC_ACL is not set
+# CONFIG_GRKERNSEC_NO_RBAC is not set
+CONFIG_GRKERNSEC_ACL_HIDEKERN=y
+CONFIG_GRKERNSEC_ACL_MAXTRIES=3
+CONFIG_GRKERNSEC_ACL_TIMEOUT=30
+
#
# Filesystem Protections
#
CONFIG_GRKERNSEC_PROC_USERGROUP=y
CONFIG_GRKERNSEC_PROC_GID=17
CONFIG_GRKERNSEC_PROC_ADD=y
-# CONFIG_GRKERNSEC_PROC_MEMMAP is not set
CONFIG_GRKERNSEC_LINK=y
CONFIG_GRKERNSEC_FIFO=y
-CONFIG_GRKERNSEC_FD=y
+CONFIG_GRKERNSEC_SYSFS_RESTRICT=y
+CONFIG_GRKERNSEC_ROFS=y
CONFIG_GRKERNSEC_CHROOT=y
-CONFIG_GRKERNSEC_CHROOT_SIG=y
CONFIG_GRKERNSEC_CHROOT_MOUNT=y
CONFIG_GRKERNSEC_CHROOT_DOUBLE=y
CONFIG_GRKERNSEC_CHROOT_PIVOT=y
CONFIG_GRKERNSEC_CHROOT_CHDIR=y
-CONFIG_GRKERNSEC_CHROOT_FCHDIR=y
CONFIG_GRKERNSEC_CHROOT_CHMOD=y
+CONFIG_GRKERNSEC_CHROOT_FCHDIR=y
CONFIG_GRKERNSEC_CHROOT_MKNOD=y
+CONFIG_GRKERNSEC_CHROOT_SHMAT=y
+CONFIG_GRKERNSEC_CHROOT_UNIX=y
CONFIG_GRKERNSEC_CHROOT_FINDTASK=y
-CONFIG_GRKERNSEC_CHROOT_PTRACE=y
CONFIG_GRKERNSEC_CHROOT_NICE=y
-CONFIG_GRKERNSEC_CHROOT_EXECLOG=y
-CONFIG_GRKERNSEC_AUDIT_CHDIR=y
-CONFIG_GRKERNSEC_AUDIT_MOUNT=y
-CONFIG_GRKERNSEC_AUDIT_IPC=y
-CONFIG_GRKERNSEC_AUDIT_PTRACE=y
+CONFIG_GRKERNSEC_CHROOT_SYSCTL=y
CONFIG_GRKERNSEC_CHROOT_CAPS=y
-CONFIG_GRKERNSEC_KBMAP=y
#
# Kernel Auditing
#
CONFIG_GRKERNSEC_AUDIT_GROUP=y
CONFIG_GRKERNSEC_AUDIT_GID=1007
-
-#
-# Security Logging
-#
CONFIG_GRKERNSEC_EXECLOG=y
-CONFIG_GRKERNSEC_SUID=y
+CONFIG_GRKERNSEC_RESLOG=y
+CONFIG_GRKERNSEC_CHROOT_EXECLOG=y
+CONFIG_GRKERNSEC_AUDIT_PTRACE=y
+CONFIG_GRKERNSEC_AUDIT_CHDIR=y
+CONFIG_GRKERNSEC_AUDIT_MOUNT=y
+CONFIG_GRKERNSEC_AUDIT_IPC=y
CONFIG_GRKERNSEC_SIGNAL=y
CONFIG_GRKERNSEC_FORKFAIL=y
CONFIG_GRKERNSEC_TIME=y
+CONFIG_GRKERNSEC_PROC_IPADDR=y
+CONFIG_GRKERNSEC_AUDIT_TEXTREL=y
#
# Executable Protections
#
CONFIG_GRKERNSEC_EXECVE=y
CONFIG_GRKERNSEC_DMESG=y
-CONFIG_GRKERNSEC_RANDPID=y
-CONFIG_GRKERNSEC_IPC=y
-CONFIG_GRKERNSEC_TTYROOT=y
-CONFIG_GRKERNSEC_TTYROOT_PHYS=y
-CONFIG_GRKERNSEC_TTYROOT_SERIAL=y
-CONFIG_GRKERNSEC_TTYROOT_PSEUDO=y
-CONFIG_GRKERNSEC_FORKBOMB=y
-CONFIG_GRKERNSEC_FORKBOMB_GID=65504
-CONFIG_GRKERNSEC_FORKBOMB_SEC=40
-CONFIG_GRKERNSEC_FORKBOMB_MAX=20
+CONFIG_GRKERNSEC_HARDEN_PTRACE=y
+CONFIG_GRKERNSEC_PTRACE_READEXEC=y
+CONFIG_GRKERNSEC_SETXID=y
CONFIG_GRKERNSEC_TPE=y
-CONFIG_GRKERNSEC_TPE_GLIBC=y
CONFIG_GRKERNSEC_TPE_ALL=y
+# CONFIG_GRKERNSEC_TPE_INVERT is not set
CONFIG_GRKERNSEC_TPE_GID=65500
#
# Network Protections
#
-CONFIG_GRKERNSEC_RANDID=y
-CONFIG_GRKERNSEC_RANDSRC=y
-CONFIG_GRKERNSEC_RANDRPC=y
-CONFIG_GRKERNSEC_RANDBIND=y
-CONFIG_GRKERNSEC_RANDPING=y
-CONFIG_GRKERNSEC_RANDTTL=y
-CONFIG_GRKERNSEC_RANDTTL_THRESH=64
CONFIG_GRKERNSEC_RANDNET=y
CONFIG_GRKERNSEC_SOCKET=y
CONFIG_GRKERNSEC_SOCKET_ALL=y
-CONFIG_GRKERNSEC_SOCKET_ALL_GID=1004
-CONFIG_GRKERNSEC_ALL_GID=65501
+CONFIG_GRKERNSEC_SOCKET_ALL_GID=65501
CONFIG_GRKERNSEC_SOCKET_CLIENT=y
-CONFIG_GRKERNSEC_SOCKET_CLIENT_GID=1003
-CONFIG_GRKERNSEC_CLIENT_GID=65502
+CONFIG_GRKERNSEC_SOCKET_CLIENT_GID=65502
CONFIG_GRKERNSEC_SOCKET_SERVER=y
-CONFIG_GRKERNSEC_SOCKET_SERVER_GID=1002
-CONFIG_GRKERNSEC_SERVER_GID=65503
-CONFIG_GRKERNSEC_PTRACE=y
-CONFIG_GRKERNSEC_PTRACE_GROUP=y
-CONFIG_GRKERNSEC_PTRACE_GID=1008
-CONFIG_GRKERNSEC_STEALTH=y
-CONFIG_GRKERNSEC_STEALTH_RST=y
-CONFIG_GRKERNSEC_STEALTH_UDP=y
-CONFIG_GRKERNSEC_STEALTH_ICMP=y
-CONFIG_GRKERNSEC_STEALTH_IGMP=y
-CONFIG_GRKERNSEC_STEALTH_FLAGS=y
-
-#
-# Network Logging
-#
-CONFIG_GRKERNSEC_STEALTH_ICMP_LOG=y
-CONFIG_GRKERNSEC_STEALTH_RST_LOG=y
-CONFIG_GRKERNSEC_STEALTH_UDP_LOG=y
-CONFIG_GRKERNSEC_STEALTH_FLAGS_LOG=y
+CONFIG_GRKERNSEC_SOCKET_SERVER_GID=65503
+# CONFIG_GRKERNSEC_BLACKHOLE is not set
#
# Sysctl support
#
CONFIG_GRKERNSEC_SYSCTL=y
+# CONFIG_GRKERNSEC_SYSCTL_ON is not set
#
-# Miscellaneous Enhancements
+# Logging Options
#
-CONFIG_GRKERNSEC_COREDUMP=y
-CONFIG_GRKERNSEC_FLOODTIME=30
-CONFIG_GRKERNSEC_FLOODBURST=4
+CONFIG_GRKERNSEC_FLOODTIME=10
+CONFIG_GRKERNSEC_FLOODBURST=10
+
+CONFIG_IP_NF_MATCH_STEALTH=m
+
+# CONFIG_GRKERNSEC_MODHARDEN is not set
+# CONFIG_PAX_MEMORY_STACKLEAK is not set
projects / packages / kernel.git / blobdiff