mirror of
https://github.com/linuxkit/linuxkit.git
synced 2025-07-29 21:42:39 +00:00
Harden kernel config with page poisoning, randomized mem, disabling ia32 and ldt syscall modification
Signed-off-by: Riyaz Faizullabhoy <riyaz.faizullabhoy@docker.com>
This commit is contained in:
parent
331719f098
commit
87b4688923
@ -550,17 +550,19 @@ CONFIG_SCHED_HRTICK=y
|
||||
# CONFIG_CRASH_DUMP is not set
|
||||
CONFIG_PHYSICAL_START=0x1000000
|
||||
CONFIG_RELOCATABLE=y
|
||||
# CONFIG_RANDOMIZE_BASE is not set
|
||||
CONFIG_RANDOMIZE_BASE=y
|
||||
CONFIG_X86_NEED_RELOCS=y
|
||||
CONFIG_PHYSICAL_ALIGN=0x1000000
|
||||
CONFIG_RANDOMIZE_MEMORY=y
|
||||
CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING=0xa
|
||||
CONFIG_HOTPLUG_CPU=y
|
||||
# CONFIG_BOOTPARAM_HOTPLUG_CPU0 is not set
|
||||
# CONFIG_DEBUG_HOTPLUG_CPU0 is not set
|
||||
# CONFIG_COMPAT_VDSO is not set
|
||||
# CONFIG_LEGACY_VSYSCALL_NATIVE is not set
|
||||
# CONFIG_LEGACY_VSYSCALL_EMULATE is not set
|
||||
CONFIG_LEGACY_VSYSCALL_NONE=y
|
||||
# CONFIG_CMDLINE_BOOL is not set
|
||||
CONFIG_MODIFY_LDT_SYSCALL=y
|
||||
# CONFIG_MODIFY_LDT_SYSCALL is not set
|
||||
CONFIG_HAVE_LIVEPATCH=y
|
||||
CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
|
||||
CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y
|
||||
@ -731,20 +733,14 @@ CONFIG_AMD_NB=y
|
||||
# Executable file formats / Emulations
|
||||
#
|
||||
CONFIG_BINFMT_ELF=y
|
||||
CONFIG_COMPAT_BINFMT_ELF=y
|
||||
CONFIG_ELFCORE=y
|
||||
# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
|
||||
CONFIG_BINFMT_SCRIPT=y
|
||||
# CONFIG_HAVE_AOUT is not set
|
||||
CONFIG_BINFMT_MISC=y
|
||||
CONFIG_COREDUMP=y
|
||||
CONFIG_IA32_EMULATION=y
|
||||
# CONFIG_IA32_AOUT is not set
|
||||
# CONFIG_IA32_EMULATION is not set
|
||||
# CONFIG_X86_X32 is not set
|
||||
CONFIG_COMPAT=y
|
||||
CONFIG_COMPAT_FOR_U64_ALIGNMENT=y
|
||||
CONFIG_SYSVIPC_COMPAT=y
|
||||
CONFIG_KEYS_COMPAT=y
|
||||
CONFIG_X86_DEV_DMA_OPS=y
|
||||
CONFIG_PMC_ATOM=y
|
||||
CONFIG_NET=y
|
||||
@ -3115,9 +3111,11 @@ CONFIG_DEBUG_KERNEL=y
|
||||
#
|
||||
# Memory Debugging
|
||||
#
|
||||
# CONFIG_PAGE_EXTENSION is not set
|
||||
CONFIG_PAGE_EXTENSION=y
|
||||
# CONFIG_DEBUG_PAGEALLOC is not set
|
||||
# CONFIG_PAGE_POISONING is not set
|
||||
CONFIG_PAGE_POISONING=y
|
||||
CONFIG_PAGE_POISONING_NO_SANITY=y
|
||||
CONFIG_PAGE_POISONING_ZERO=y
|
||||
# CONFIG_DEBUG_PAGE_REF is not set
|
||||
# CONFIG_DEBUG_OBJECTS is not set
|
||||
# CONFIG_DEBUG_SLAB is not set
|
||||
|
Loading…
Reference in New Issue
Block a user