forked from sammcj/kernel-ci
-
Notifications
You must be signed in to change notification settings - Fork 0
/
kernel_config.sh
executable file
·328 lines (284 loc) · 12.2 KB
/
kernel_config.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
#! /usr/bin/env bash
set -xe
# Set config options in kernel
# Manipulate options in a .config file from the command line.
# Usage:
# $myname options command ...
# commands:
# --enable|-e option Enable option
# --disable|-d option Disable option
# --module|-m option Turn option into a module
# --set-str option string
# Set option to "string"
# --set-val option value
# Set option to value
# --undefine|-u option Undefine option
# --state|-s option Print state of option (n,y,m,undef)
# --enable-after|-E beforeopt option
# Enable option directly after other option
# --disable-after|-D beforeopt option
# Disable option directly after other option
# --module-after|-M beforeopt option
# Turn option into module directly after other option
# commands can be repeated multiple times
# options:
# --file config-file .config file to change (default .config)
# --keep-case|-k Keep next symbols' case (dont' upper-case it)
# $myname doesn't check the validity of the .config file. This is done at next
# make time.
# By default, $myname will upper-case the given symbol. Use --keep-case to keep
# the case of all following symbols unchanged.
# $myname uses 'CONFIG_' as the default symbol prefix. Set the environment
# variable CONFIG_ to the prefix to use. Eg.: CONFIG_="FOO_" $myname ...
# Debuginfo is only needed if you plan to use binary object tools like crash, kgdb, and SystemTap on the kernel.
scripts/config --disable DEBUG_INFO
### Virtualisation Helper ###
scripts/config --set-str CONFIG_UEVENT_HELPER_PATH ""
scripts/config --enable CONFIG_UEVENT_HELPER
### Storage Helper ###
scripts/config --enable CONFIG_SCSI \
--enable CONFIG_SCSI_MQ_DEFAULT \
--enable CONFIG_SATA_AHCI \
--enable CONFIG_BLK_DEV_SD
### OverlayFS (new Docker storage driver), 3.18+ ###
scripts/config --enable CONFIG_OVERLAY_FS
### IPTABLES FOR 3.18+ ###
#
# IP: Netfilter Configuration
#
scripts/config --enable CONFIG_NF_CONNTRACK_PROC_COMPAT
scripts/config --module CONFIG_NF_DEFRAG_IPV4 \
--module CONFIG_NF_CONNTRACK_IPV4 \
--module CONFIG_NF_LOG_ARP \
--module CONFIG_NF_LOG_IPV4 \
--module CONFIG_NF_TABLES_IPV4 \
--module CONFIG_NFT_CHAIN_ROUTE_IPV4 \
--module CONFIG_NF_REJECT_IPV4 \
--module CONFIG_NFT_REJECT_IPV4 \
--module CONFIG_NF_TABLES_ARP \
--module CONFIG_NF_NAT_IPV4 \
--module CONFIG_NFT_CHAIN_NAT_IPV4 \
--module CONFIG_NF_NAT_MASQUERADE_IPV4 \
--module CONFIG_NFT_MASQ_IPV4 \
--module CONFIG_NF_NAT_SNMP_BASIC \
--module CONFIG_NF_NAT_PROTO_GRE \
--module CONFIG_NF_NAT_PPTP \
--module CONFIG_NF_NAT_H323 \
--module CONFIG_IP_NF_IPTABLES \
--module CONFIG_IP_NF_MATCH_AH \
--module CONFIG_IP_NF_MATCH_ECN \
--module CONFIG_IP_NF_MATCH_RPFILTER \
--module CONFIG_IP_NF_MATCH_TTL \
--module CONFIG_IP_NF_FILTER \
--module CONFIG_IP_NF_TARGET_REJECT \
--module CONFIG_IP_NF_TARGET_SYNPROXY \
--module CONFIG_IP_NF_NAT \
--module CONFIG_IP_NF_TARGET_MASQUERADE \
--module CONFIG_IP_NF_TARGET_NETMAP \
--module CONFIG_IP_NF_TARGET_REDIRECT \
--module CONFIG_IP_NF_MANGLE \
--module CONFIG_IP_NF_TARGET_CLUSTERIP \
--module CONFIG_IP_NF_TARGET_ECN \
--module CONFIG_IP_NF_TARGET_TTL \
--module CONFIG_IP_NF_RAW \
--module CONFIG_IP_NF_SECURITY \
--module CONFIG_IP_NF_ARPTABLES \
--module CONFIG_IP_NF_ARPFILTER \
--module CONFIG_IP_NF_ARP_MANGLE
#
# IPv6: Netfilter Configuration
#
scripts/config --module CONFIG_NF_DEFRAG_IPV6 \
--module CONFIG_NF_CONNTRACK_IPV6 \
--module CONFIG_NF_TABLES_IPV6 \
--module CONFIG_NFT_CHAIN_ROUTE_IPV6 \
--module CONFIG_NF_REJECT_IPV6 \
--module CONFIG_NFT_REJECT_IPV6 \
--module CONFIG_NF_LOG_IPV6 \
--module CONFIG_NF_NAT_IPV6 \
--module CONFIG_NFT_CHAIN_NAT_IPV6 \
--module CONFIG_NF_NAT_MASQUERADE_IPV6 \
--module CONFIG_NFT_MASQ_IPV6 \
--module CONFIG_IP6_NF_IPTABLES \
--module CONFIG_IP6_NF_MATCH_AH \
--module CONFIG_IP6_NF_MATCH_EUI64 \
--module CONFIG_IP6_NF_MATCH_FRAG \
--module CONFIG_IP6_NF_MATCH_OPTS \
--module CONFIG_IP6_NF_MATCH_HL \
--module CONFIG_IP6_NF_MATCH_IPV6HEADER \
--module CONFIG_IP6_NF_MATCH_MH \
--module CONFIG_IP6_NF_MATCH_RPFILTER \
--module CONFIG_IP6_NF_MATCH_RT \
--module CONFIG_IP6_NF_TARGET_HL \
--module CONFIG_IP6_NF_FILTER \
--module CONFIG_IP6_NF_TARGET_REJECT \
--module CONFIG_IP6_NF_TARGET_SYNPROXY \
--module CONFIG_IP6_NF_MANGLE \
--module CONFIG_IP6_NF_RAW \
--module CONFIG_IP6_NF_SECURITY \
--module CONFIG_IP6_NF_NAT \
--module CONFIG_IP6_NF_TARGET_MASQUERADE \
--module CONFIG_IP6_NF_TARGET_NPT
#
# DECnet: Netfilter Configuration
#
scripts/config --module CONFIG_DECNET_NF_GRABULATOR \
--module CONFIG_NF_TABLES_BRIDGE \
--module CONFIG_NFT_BRIDGE_META \
--module CONFIG_NFT_BRIDGE_REJECT \
--module CONFIG_NF_LOG_BRIDGE \
--module CONFIG_BRIDGE_NF_EBTABLES \
--module CONFIG_BRIDGE_EBT_BROUTE \
--module CONFIG_BRIDGE_EBT_T_FILTER \
--module CONFIG_BRIDGE_EBT_T_NAT \
--module CONFIG_BRIDGE_EBT_802_3 \
--module CONFIG_BRIDGE_EBT_AMONG \
--module CONFIG_BRIDGE_EBT_ARP \
--module CONFIG_BRIDGE_EBT_IP \
--module CONFIG_BRIDGE_EBT_IP6 \
--module CONFIG_BRIDGE_EBT_LIMIT \
--module CONFIG_BRIDGE_EBT_MARK \
--module CONFIG_BRIDGE_EBT_PKTTYPE \
--module CONFIG_BRIDGE_EBT_STP \
--module CONFIG_BRIDGE_EBT_VLAN \
--module CONFIG_BRIDGE_EBT_ARPREPLY \
--module CONFIG_BRIDGE_EBT_DNAT \
--module CONFIG_BRIDGE_EBT_MARK_T \
--module CONFIG_BRIDGE_EBT_REDIRECT \
--module CONFIG_BRIDGE_EBT_SNAT \
--module CONFIG_BRIDGE_EBT_LOG \
--module CONFIG_BRIDGE_EBT_NFLOG \
--module CONFIG_IP_DCCP \
--module CONFIG_INET_DCCP_DIAG
if [ "$GRSEC" = "true" ]; then
### GRSecurity ###
scripts/config --set-val CONFIG_TASK_SIZE_MAX_SHIFT 47
scripts/config --enable CONFIG_PAX_USERCOPY_SLABS \
--enable CONFIG_GRKERNSEC \
--enable CONFIG_GRKERNSEC_CONFIG_AUTO \
--enable CONFIG_GRKERNSEC_CONFIG_SERVER \
--enable CONFIG_GRKERNSEC_CONFIG_VIRT_GUEST \
--enable CONFIG_GRKERNSEC_CONFIG_VIRT_EPT \
--enable CONFIG_GRKERNSEC_CONFIG_VIRT_XEN \
--enable CONFIG_GRKERNSEC_CONFIG_PRIORITY_PERF
#
# Default Special Groups
#
scripts/config --set-val CONFIG_GRKERNSEC_PROC_GID 1001 \
--set-val CONFIG_GRKERNSEC_TPE_UNTRUSTED_GID 1005 \
--set-val CONFIG_GRKERNSEC_SYMLINKOWN_GID 1006
#
# PaX
#
scripts/config --enable CONFIG_PAX \
--enable CONFIG_PAX_EI_PAX \
--enable CONFIG_PAX_PT_PAX_FLAGS \
--enable CONFIG_PAX_XATTR_PAX_FLAGS \
--enable CONFIG_PAX_HAVE_ACL_FLAGS
#
# Non-executable pages
#
scripts/config --enable CONFIG_PAX_NOEXEC \
--enable CONFIG_PAX_PAGEEXEC \
--enable CONFIG_PAX_EMUTRAMP \
--enable CONFIG_PAX_MPROTECT
scripts/config --set-str CONFIG_PAX_KERNEXEC_PLUGIN_METHOD ""
#
# Address Space Layout Randomization
#
scripts/config --enable CONFIG_PAX_ASLR \
--enable CONFIG_PAX_RANDKSTACK \
--enable CONFIG_PAX_RANDUSTACK \
--enable CONFIG_PAX_RANDMMAP
#
# Miscellaneous hardening features
#
scripts/config --enable CONFIG_PAX_REFCOUNT \
--enable CONFIG_PAX_USERCOPY \
--enable CONFIG_PAX_SIZE_OVERFLOW \
--enable CONFIG_PAX_LATENT_ENTROPY
#
# Memory Protections
#
scripts/config --enable CONFIG_GRKERNSEC_KMEM \
--enable CONFIG_GRKERNSEC_IO \
--enable CONFIG_GRKERNSEC_BPF_HARDEN \
--enable CONFIG_GRKERNSEC_PERF_HARDEN \
--enable CONFIG_GRKERNSEC_RAND_THREADSTACK \
--enable CONFIG_GRKERNSEC_PROC_MEMMAP \
--enable CONFIG_GRKERNSEC_KSTACKOVERFLOW \
--enable CONFIG_GRKERNSEC_BRUTE \
--enable CONFIG_GRKERNSEC_MODHARDEN \
--enable CONFIG_GRKERNSEC_HIDESYM \
--enable CONFIG_GRKERNSEC_RANDSTRUCT \
--enable CONFIG_GRKERNSEC_RANDSTRUCT_PERFORMANCE \
--enable CONFIG_GRKERNSEC_KERN_LOCKOUT
#
# Role Based Access Control Options
#
scripts/config --set-val CONFIG_GRKERNSEC_ACL_MAXTRIES 3 \
--set-val CONFIG_GRKERNSEC_ACL_TIMEOUT 30
#
# Filesystem Protections
#
scripts/config --enable CONFIG_GRKERNSEC_PROC \
--enable CONFIG_GRKERNSEC_PROC_USERGROUP \
--enable CONFIG_GRKERNSEC_PROC_ADD \
--enable CONFIG_GRKERNSEC_LINK \
--enable CONFIG_GRKERNSEC_SYMLINKOWN \
--enable CONFIG_GRKERNSEC_FIFO \
--enable CONFIG_GRKERNSEC_SYSFS_RESTRICT \
--enable CONFIG_GRKERNSEC_DEVICE_SIDECHANNEL \
--enable CONFIG_GRKERNSEC_CHROOT \
--enable CONFIG_GRKERNSEC_CHROOT_MOUNT \
--enable CONFIG_GRKERNSEC_CHROOT_DOUBLE \
--enable CONFIG_GRKERNSEC_CHROOT_PIVOT \
--enable CONFIG_GRKERNSEC_CHROOT_CHDIR \
--enable CONFIG_GRKERNSEC_CHROOT_CHMOD \
--enable CONFIG_GRKERNSEC_CHROOT_FCHDIR \
--enable CONFIG_GRKERNSEC_CHROOT_MKNOD \
--enable CONFIG_GRKERNSEC_CHROOT_SHMAT \
--enable CONFIG_GRKERNSEC_CHROOT_UNIX \
--enable CONFIG_GRKERNSEC_CHROOT_FINDTASK \
--enable CONFIG_GRKERNSEC_CHROOT_NICE \
--enable CONFIG_GRKERNSEC_CHROOT_SYSCTL \
--enable CONFIG_GRKERNSEC_CHROOT_CAPS \
--enable CONFIG_GRKERNSEC_CHROOT_INITRD
#
# Kernel Auditing
#
scripts/config --enable CONFIG_GRKERNSEC_RESLOG \
--enable CONFIG_GRKERNSEC_SIGNAL \
--enable CONFIG_GRKERNSEC_TIME \
--enable CONFIG_GRKERNSEC_PROC_IPADDR \
--enable CONFIG_GRKERNSEC_RWXMAP_LOG
#
# Executable Protections
#
scripts/config --enable CONFIG_GRKERNSEC_DMESG \
--enable CONFIG_GRKERNSEC_HARDEN_PTRACE \
--enable CONFIG_GRKERNSEC_PTRACE_READEXEC \
--enable CONFIG_GRKERNSEC_SETXID \
--enable CONFIG_GRKERNSEC_HARDEN_IPC \
--enable CONFIG_GRKERNSEC_TPE
scripts/config --set-val CONFIG_GRKERNSEC_TPE_GID 1005
#
# Network Protections
#
scripts/config --enable CONFIG_GRKERNSEC_BLACKHOLE \
--enable CONFIG_GRKERNSEC_NO_SIMULT_CONNECT
#
# Physical Protections
#
scripts/config --enable CONFIG_GRKERNSEC_DENYUSB
#
# Sysctl Support
#
scripts/config --enable CONFIG_GRKERNSEC_SYSCTL \
--enable CONFIG_GRKERNSEC_SYSCTL_ON
#
# Logging Options
#
scripts/config --set-val CONFIG_GRKERNSEC_FLOODTIME 10 \
--set-val CONFIG_GRKERNSEC_FLOODBURST 6
fi