@@ -55,3 +55,3 @@ # CONFIG_COMPILE_TEST is not set -CONFIG_LOCALVERSION="-ARCH" +CONFIG_LOCALVERSION="-hardened" # CONFIG_LOCALVERSION_AUTO is not set @@ -78,4 +78,7 @@ # CONFIG_USELIB is not set -# CONFIG_AUDIT is not set +CONFIG_AUDIT=y CONFIG_HAVE_ARCH_AUDITSYSCALL=y +CONFIG_AUDITSYSCALL=y +CONFIG_AUDIT_WATCH=y +CONFIG_AUDIT_TREE=y @@ -180,3 +183,3 @@ CONFIG_IPC_NS=y -# CONFIG_USER_NS is not set +CONFIG_USER_NS=y CONFIG_PID_NS=y @@ -229,3 +232,3 @@ CONFIG_ADVISE_SYSCALLS=y -CONFIG_USERFAULTFD=y +# CONFIG_USERFAULTFD is not set CONFIG_PCI_QUIRKS=y @@ -247,5 +250,9 @@ CONFIG_SLUB=y -CONFIG_SLAB_MERGE_DEFAULT=y +# CONFIG_SLAB_MERGE_DEFAULT is not set CONFIG_SLAB_FREELIST_RANDOM=y CONFIG_SLAB_FREELIST_HARDENED=y +CONFIG_SLAB_HARDENED=y +CONFIG_SLAB_CANARY=y +CONFIG_SLAB_SANITIZE=y +CONFIG_SLAB_SANITIZE_VERIFY=y CONFIG_SLUB_CPU_PARTIAL=y @@ -324,5 +331,5 @@ CONFIG_HAVE_EXIT_THREAD=y -CONFIG_ARCH_MMAP_RND_BITS=28 +CONFIG_ARCH_MMAP_RND_BITS=32 CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS=y -CONFIG_ARCH_MMAP_RND_COMPAT_BITS=8 +CONFIG_ARCH_MMAP_RND_COMPAT_BITS=16 CONFIG_HAVE_ARCH_COMPAT_MMAP_BASES=y @@ -343,3 +350,3 @@ CONFIG_STRICT_MODULE_RWX=y -# CONFIG_REFCOUNT_FULL is not set +CONFIG_REFCOUNT_FULL=y @@ -527,4 +534,2 @@ # CONFIG_VM86 is not set -CONFIG_X86_16BIT=y -CONFIG_X86_ESPFIX64=y CONFIG_X86_VSYSCALL_EMULATION=y @@ -555,3 +560,2 @@ CONFIG_ARCH_MEMORY_PROBE=y -CONFIG_ARCH_PROC_KCORE_TEXT=y CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000 @@ -650,3 +654,3 @@ CONFIG_SCHED_HRTICK=y -CONFIG_KEXEC=y +# CONFIG_KEXEC is not set CONFIG_KEXEC_FILE=y @@ -654,3 +658,2 @@ CONFIG_CRASH_DUMP=y -CONFIG_KEXEC_JUMP=y CONFIG_PHYSICAL_START=0x1000000 @@ -667,6 +670,8 @@ # CONFIG_LEGACY_VSYSCALL_NATIVE is not set -CONFIG_LEGACY_VSYSCALL_EMULATE=y -# CONFIG_LEGACY_VSYSCALL_NONE is not set -# CONFIG_CMDLINE_BOOL is not set -CONFIG_MODIFY_LDT_SYSCALL=y +# CONFIG_LEGACY_VSYSCALL_EMULATE is not set +CONFIG_LEGACY_VSYSCALL_NONE=y +CONFIG_CMDLINE_BOOL=y +CONFIG_CMDLINE="audit=0" +# CONFIG_CMDLINE_OVERRIDE is not set +# CONFIG_MODIFY_LDT_SYSCALL is not set CONFIG_HAVE_LIVEPATCH=y @@ -680,3 +685,2 @@ # -CONFIG_ARCH_HIBERNATION_HEADER=y CONFIG_SUSPEND=y @@ -684,4 +688,3 @@ CONFIG_HIBERNATE_CALLBACKS=y -CONFIG_HIBERNATION=y -CONFIG_PM_STD_PARTITION="" +# CONFIG_HIBERNATION is not set CONFIG_PM_SLEEP=y @@ -740,3 +743,3 @@ CONFIG_ACPI_HED=y -CONFIG_ACPI_CUSTOM_METHOD=m +# CONFIG_ACPI_CUSTOM_METHOD is not set CONFIG_ACPI_BGRT=y @@ -1127,2 +1130,3 @@ # +CONFIG_NETFILTER_XT_TARGET_AUDIT=m CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m @@ -3764,3 +3768,3 @@ CONFIG_TELCLOCK=m -CONFIG_DEVPORT=y +# CONFIG_DEVPORT is not set # CONFIG_XILLYBUS is not set @@ -7587,4 +7591,4 @@ CONFIG_PROC_FS=y -CONFIG_PROC_KCORE=y -CONFIG_PROC_VMCORE=y +# CONFIG_PROC_KCORE is not set +# CONFIG_PROC_VMCORE is not set CONFIG_PROC_SYSCTL=y @@ -7693,3 +7697,2 @@ CONFIG_NFS_USE_KERNEL_DNS=y -CONFIG_NFS_DEBUG=y CONFIG_NFSD=m @@ -7878,4 +7881,4 @@ # CONFIG_WQ_WATCHDOG is not set -# CONFIG_PANIC_ON_OOPS is not set -CONFIG_PANIC_ON_OOPS_VALUE=0 +CONFIG_PANIC_ON_OOPS=y +CONFIG_PANIC_ON_OOPS_VALUE=1 CONFIG_PANIC_TIMEOUT=0 @@ -7906,7 +7909,7 @@ CONFIG_DEBUG_BUGVERBOSE=y -# CONFIG_DEBUG_LIST is not set +CONFIG_DEBUG_LIST=y # CONFIG_DEBUG_PI_LIST is not set # CONFIG_DEBUG_SG is not set -# CONFIG_DEBUG_NOTIFIERS is not set -# CONFIG_DEBUG_CREDENTIALS is not set +CONFIG_DEBUG_NOTIFIERS=y +CONFIG_DEBUG_CREDENTIALS=y @@ -8013,3 +8016,3 @@ # CONFIG_MEMTEST is not set -# CONFIG_BUG_ON_DATA_CORRUPTION is not set +CONFIG_BUG_ON_DATA_CORRUPTION=y # CONFIG_SAMPLES is not set @@ -8028,6 +8031,6 @@ # CONFIG_EARLY_PRINTK_USB_XDBC is not set -# CONFIG_X86_PTDUMP_CORE is not set +CONFIG_X86_PTDUMP_CORE=y # CONFIG_X86_PTDUMP is not set # CONFIG_EFI_PGT_DUMP is not set -# CONFIG_DEBUG_WX is not set +CONFIG_DEBUG_WX=y CONFIG_DOUBLEFAULT=y @@ -8067,3 +8070,5 @@ CONFIG_KEY_DH_OPERATIONS=y -# CONFIG_SECURITY_DMESG_RESTRICT is not set +CONFIG_SECURITY_DMESG_RESTRICT=y +CONFIG_SECURITY_PERF_EVENTS_RESTRICT=y +CONFIG_SECURITY_TIOCSTI_RESTRICT=y CONFIG_SECURITY=y @@ -8071,6 +8076,8 @@ CONFIG_SECURITYFS=y -# CONFIG_SECURITY_NETWORK is not set +CONFIG_SECURITY_NETWORK=y CONFIG_SECURITY_INFINIBAND=y +CONFIG_SECURITY_NETWORK_XFRM=y CONFIG_SECURITY_PATH=y # CONFIG_INTEL_TXT is not set +CONFIG_LSM_MMAP_MIN_ADDR=65536 CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y @@ -8078,3 +8085,12 @@ CONFIG_FORTIFY_SOURCE=y +CONFIG_PAGE_SANITIZE=y +CONFIG_PAGE_SANITIZE_VERIFY=y # CONFIG_STATIC_USERMODEHELPER is not set +CONFIG_SECURITY_SELINUX=y +CONFIG_SECURITY_SELINUX_BOOTPARAM=y +CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0 +# CONFIG_SECURITY_SELINUX_DISABLE is not set +CONFIG_SECURITY_SELINUX_DEVELOP=y +CONFIG_SECURITY_SELINUX_AVC_STATS=y +CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=0 # CONFIG_SECURITY_SMACK is not set @@ -8086,4 +8102,6 @@ # CONFIG_INTEGRITY_SIGNATURE is not set +CONFIG_INTEGRITY_AUDIT=y # CONFIG_IMA is not set # CONFIG_EVM is not set +# CONFIG_DEFAULT_SECURITY_SELINUX is not set CONFIG_DEFAULT_SECURITY_DAC=y