COPR repo with built kernel with suggested recommendations about kernel-hardening-checker

[a13xp0p0v]

Hi Krish,

This approach can be called "creating a kernel flavour". Some distros do that.

For example, see:

• Ubuntu kernel flavours: https://wiki.ubuntu.com/Kernel/Dev/Flavours
• Suse kernel flavours: https://www.suse.com/support/kb/doc/?id=000017133
• The discussion about NixOS hardened kernel: NixOS/nixpkgs#76850

[krishjainx]

For sure, this project is perhaps one of the best and most usable for kernel hardening and I would definitely be able to help if you can get started or others with implementing this. Thank you!

[krishjainx]

Yes, thank you I understand that but how would I have your script/tool change the .config to be more hardened and then have that grab new kernel sources and automatically build like if I was to hold a COPR?

[a13xp0p0v]

Thanks Krish, now I see what you mean.

There is an enhancement #67. Maybe it would help to solve your task.

Create a tool that changes kconfig options according the recommendations

It should use the JSON output of kconfig-hardened-check and work with kconfig with kconfiglib.

What do you think?

[krishjainx]

It would be incredibly useful to instead of being developing sideways independent projects like linux-hardened or grsecurity to be working more close with upstream like you are - getting all the performance improvements, bug fixes and applying all available "vanilla" security fixes and pushing this to distributions using that tool. Then people can work off it. Even if it's not "revolutionary" I definitely believe in the long term it would help make Linux even better!

[a13xp0p0v]

I can't comment about grsecurity. This topic is complex... Anyway, they are pioneers in kernel security hardening.

The goal of KSPP is to develop kernel self-protection features for the mainline kernel. I hope my kconfig-hardened-check project also promotes these security features among Linux distros.