Compare with clipos recommendations about kernel-hardening-checker

[a13xp0p0v]

Hi @HacKurx and @Bernhard40,
I've added new checks based on the CLIP OS recommendations.

[a13xp0p0v]

@a13xp0p0v CONFIG_X86_MSR could also be set to m which I think should be ok.
At least Ubuntu, Debian, Archlinux and opensSUSE have it set this way.

@Bernhard40, thanks for pointing this out.
I double-checked and dropped this recommendation - IMO it's wrong.
CONFIG_X86_MSR provides access from the userspace to the x86 MSRs via char devices.
Kernel doesn't need it for mitigating CPU bugs.

I've created an issue with a question for the CLIP OS project:
https://github.com/clipos/src_platform_config-linux-hardware/issues/1

[theLOICofFRANCE]

Even if I'm not a fan of black magic (see this), the CONFIG_MICROCODE=y option is now essential.

[Bernhard40]

Some of those options are available only in linux-hardened patchset thus not applicable here. Others like CONFIG_INTEGRITY=n or CONFIG_INTEL_TXT=n are specific to clipos and general recommendations would be the opposite.

[theLOICofFRANCE]

Yes, you're right, I did a quick extraction.
Are there any options you think are interesting?

[a13xp0p0v]

Cool! @HacKurx, learning the CLIP OS config is a nice idea.

Thanks for the link, I'll check the options from their documentation and choose relevant for the script.

Do you have their full kernel config for adding to config_files?

[theLOICofFRANCE]

Hi @a13xp0p0v,

Thanks you :)

Do you have their full kernel config for adding to config_files?

The configuration is automatically generated by a script in their own kernel source:
https://github.com/clipos/src_platform_config-linux-hardware/tree/master/
https://github.com/clipos/src_external_linux

I can ask @tsautereau-anssi for confirm it.

Best regards,

[Bernhard40]

@a13xp0p0v CONFIG_X86_MSR could also be set to m which I think should be ok.

At least Ubuntu, Debian, Archlinux and opensSUSE have it set this way.