[+] Kconfig file to check: /khc-config [+] Kernel cmdline file to check: /khc-cmdline [+] Sysctl output file to check: /khc-sysctl [+] Detected kernel version: (6, 12, 9) [+] Detected architecture: X86_64 [+] Detected compiler: GCC 140200 ========================================================================================================================= option_name | type | reason | decision |desired_val | check_result ========================================================================================================================= CONFIG_BUG |kconfig| self_protection |defconfig | y | FAIL: "is not set" CONFIG_SLUB_DEBUG |kconfig| self_protection |defconfig | y | OK CONFIG_THREAD_INFO_IN_TASK |kconfig| self_protection |defconfig | y | OK CONFIG_IOMMU_DEFAULT_PASSTHROUGH |kconfig| self_protection |defconfig | is not set | OK CONFIG_IOMMU_SUPPORT |kconfig| self_protection |defconfig | y | OK CONFIG_STACKPROTECTOR |kconfig| self_protection |defconfig | y | OK CONFIG_STACKPROTECTOR_STRONG |kconfig| self_protection |defconfig | y | OK CONFIG_STRICT_KERNEL_RWX |kconfig| self_protection |defconfig | y | OK CONFIG_STRICT_MODULE_RWX |kconfig| self_protection |defconfig | y | OK CONFIG_REFCOUNT_FULL |kconfig| self_protection |defconfig | y | OK CONFIG_INIT_STACK_ALL_ZERO |kconfig| self_protection |defconfig | y | OK CONFIG_CPU_MITIGATIONS |kconfig| self_protection |defconfig | y | OK CONFIG_RANDOMIZE_BASE |kconfig| self_protection |defconfig | y | OK CONFIG_VMAP_STACK |kconfig| self_protection |defconfig | y | OK CONFIG_LSM_MMAP_MIN_ADDR |kconfig| self_protection |defconfig | 65536 | FAIL: "32768" CONFIG_DEBUG_WX |kconfig| self_protection |defconfig | y | FAIL: is not found CONFIG_WERROR |kconfig| self_protection |defconfig | y | FAIL: is not found CONFIG_X86_MCE |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_SPECTRE_V1 |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_SPECTRE_V2 |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_SSB |kconfig| self_protection |defconfig | y | OK CONFIG_MICROCODE |kconfig| self_protection |defconfig | y | OK CONFIG_MICROCODE_INTEL |kconfig| self_protection |defconfig | y | OK CONFIG_MICROCODE_AMD |kconfig| self_protection |defconfig | y | OK CONFIG_X86_SMAP |kconfig| self_protection |defconfig | y | OK CONFIG_X86_UMIP |kconfig| self_protection |defconfig | y | OK CONFIG_X86_MCE_INTEL |kconfig| self_protection |defconfig | y | OK CONFIG_X86_MCE_AMD |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_RETPOLINE |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_GDS |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_RFDS |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_SPECTRE_BHI |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_MDS |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_TAA |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_MMIO_STALE_DATA |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_L1TF |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_RETBLEED |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_SRBDS |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_TSA |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_VMSCAPE |kconfig| self_protection |defconfig | y | OK CONFIG_RANDOMIZE_MEMORY |kconfig| self_protection |defconfig | y | OK CONFIG_X86_KERNEL_IBT |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_RETHUNK |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_PAGE_TABLE_ISOLATION|kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_UNRET_ENTRY |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_CALL_DEPTH_TRACKING |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_IBPB_ENTRY |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_IBRS_ENTRY |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_SRSO |kconfig| self_protection |defconfig | y | OK CONFIG_MITIGATION_ITS |kconfig| self_protection |defconfig | y | OK CONFIG_INTEL_IOMMU |kconfig| self_protection |defconfig | y | OK CONFIG_AMD_IOMMU |kconfig| self_protection |defconfig | y | OK CONFIG_RANDOM_KMALLOC_CACHES |kconfig| self_protection | kspp | y | OK CONFIG_SLAB_MERGE_DEFAULT |kconfig| self_protection | kspp | is not set | OK CONFIG_BUG_ON_DATA_CORRUPTION |kconfig| self_protection | kspp | y | OK CONFIG_SLAB_FREELIST_HARDENED |kconfig| self_protection | kspp | y | OK CONFIG_SLAB_FREELIST_RANDOM |kconfig| self_protection | kspp | y | OK CONFIG_SHUFFLE_PAGE_ALLOCATOR |kconfig| self_protection | kspp | y | OK CONFIG_FORTIFY_SOURCE |kconfig| self_protection | kspp | y | OK CONFIG_DEBUG_VIRTUAL |kconfig| self_protection | kspp | y | OK CONFIG_INIT_ON_ALLOC_DEFAULT_ON |kconfig| self_protection | kspp | y | OK CONFIG_STATIC_USERMODEHELPER |kconfig| self_protection | kspp | y | OK CONFIG_SECURITY_LOCKDOWN_LSM |kconfig| self_protection | kspp | y | OK CONFIG_LSM |kconfig| self_protection | kspp | *lockdown* | FAIL: is not found CONFIG_SECURITY_LOCKDOWN_LSM_EARLY |kconfig| self_protection | kspp | y | OK CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY|kconfig| self_protection | kspp | y | OK CONFIG_DEBUG_SG |kconfig| self_protection | kspp | y | OK CONFIG_ZERO_CALL_USED_REGS |kconfig| self_protection | kspp | y | OK CONFIG_DEBUG_CREDENTIALS |kconfig| self_protection | kspp | y | OK CONFIG_DEBUG_NOTIFIERS |kconfig| self_protection | kspp | y | OK CONFIG_KFENCE |kconfig| self_protection | kspp | y | OK CONFIG_KFENCE_SAMPLE_INTERVAL |kconfig| self_protection | kspp | 100 | OK CONFIG_RANDSTRUCT_FULL |kconfig| self_protection | kspp | y | OK CONFIG_HARDENED_USERCOPY |kconfig| self_protection | kspp | y | OK CONFIG_HARDENED_USERCOPY_DEFAULT_ON |kconfig| self_protection | kspp | y | OK CONFIG_HARDENED_USERCOPY_FALLBACK |kconfig| self_protection | kspp | is not set | OK CONFIG_HARDENED_USERCOPY_PAGESPAN |kconfig| self_protection | kspp | is not set | OK CONFIG_GCC_PLUGIN_LATENT_ENTROPY |kconfig| self_protection | kspp | y | FAIL: CONFIG_CC_IS_GCC is not "y" CONFIG_MODULE_SIG |kconfig| self_protection | kspp | y | OK CONFIG_MODULE_SIG_ALL |kconfig| self_protection | kspp | y | OK CONFIG_MODULE_SIG_SHA512 |kconfig| self_protection | kspp | y | OK CONFIG_MODULE_SIG_FORCE |kconfig| self_protection | kspp | y | OK CONFIG_INIT_ON_FREE_DEFAULT_ON |kconfig| self_protection | kspp | y | OK CONFIG_EFI_DISABLE_PCI_DMA |kconfig| self_protection | kspp | y | OK CONFIG_RESET_ATTACK_MITIGATION |kconfig| self_protection | kspp | y | OK CONFIG_UBSAN_BOUNDS |kconfig| self_protection | kspp | y | OK CONFIG_UBSAN_LOCAL_BOUNDS |kconfig| self_protection | kspp | y | OK CONFIG_UBSAN_TRAP |kconfig| self_protection | kspp | y | OK CONFIG_UBSAN_SANITIZE_ALL |kconfig| self_protection | kspp | y | OK CONFIG_SCHED_STACK_END_CHECK |kconfig| self_protection | kspp | y | OK CONFIG_KSTACK_ERASE |kconfig| self_protection | kspp | y | OK CONFIG_KSTACK_ERASE_METRICS |kconfig| self_protection | kspp | is not set | OK CONFIG_KSTACK_ERASE_RUNTIME_DISABLE |kconfig| self_protection | kspp | is not set | OK CONFIG_SCHED_CORE |kconfig| self_protection | kspp | y | OK CONFIG_LIST_HARDENED |kconfig| self_protection | kspp | y | OK CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT|kconfig| self_protection | kspp | y | OK CONFIG_PAGE_TABLE_CHECK |kconfig| self_protection | kspp | y | OK CONFIG_PAGE_TABLE_CHECK_ENFORCED |kconfig| self_protection | kspp | y | OK CONFIG_DEFAULT_MMAP_MIN_ADDR |kconfig| self_protection | kspp | 65536 | OK CONFIG_HW_RANDOM_TPM |kconfig| self_protection | kspp | y | OK CONFIG_CFI_CLANG |kconfig| self_protection | kspp | y | FAIL: CONFIG_CC_IS_CLANG is not "y" CONFIG_CFI_PERMISSIVE |kconfig| self_protection | kspp | is not set | FAIL: CONFIG_CC_IS_CLANG is not "y" CONFIG_IOMMU_DEFAULT_DMA_STRICT |kconfig| self_protection | kspp | y | OK CONFIG_INTEL_IOMMU_DEFAULT_ON |kconfig| self_protection | kspp | y | OK CONFIG_CFI_AUTO_DEFAULT |kconfig| self_protection | kspp | is not set | OK CONFIG_MITIGATION_SLS |kconfig| self_protection | kspp | y | OK CONFIG_INTEL_IOMMU_SVM |kconfig| self_protection | kspp | y | OK CONFIG_AMD_IOMMU_V2 |kconfig| self_protection | kspp | y | OK CONFIG_SECURITY |kconfig| security_policy |defconfig | y | OK CONFIG_SECURITY_YAMA |kconfig| security_policy | kspp | y | OK CONFIG_LSM |kconfig| security_policy | kspp | *yama* | FAIL: is not found CONFIG_SECURITY_LANDLOCK |kconfig| security_policy | kspp | y | OK CONFIG_LSM |kconfig| security_policy | kspp | *landlock* | FAIL: is not found CONFIG_SECURITY_SELINUX_DISABLE |kconfig| security_policy | kspp | is not set | OK CONFIG_SECURITY_SELINUX_BOOTPARAM |kconfig| security_policy | kspp | is not set | OK CONFIG_SECURITY_SELINUX_DEVELOP |kconfig| security_policy | kspp | is not set | OK CONFIG_SECURITY_WRITABLE_HOOKS |kconfig| security_policy | kspp | is not set | OK CONFIG_SECURITY_SELINUX_DEBUG |kconfig| security_policy | kspp | is not set | OK CONFIG_SECURITY_SELINUX |kconfig| security_policy |a13xp0p0v | y | OK CONFIG_LSM |kconfig| security_policy |a13xp0p0v | *selinux* | FAIL: is not found CONFIG_SECCOMP |kconfig|cut_attack_surface|defconfig | y | OK CONFIG_SECCOMP_FILTER |kconfig|cut_attack_surface|defconfig | y | OK CONFIG_BPF_UNPRIV_DEFAULT_OFF |kconfig|cut_attack_surface|defconfig | y | OK CONFIG_STRICT_DEVMEM |kconfig|cut_attack_surface|defconfig | y | OK CONFIG_X86_INTEL_TSX_MODE_OFF |kconfig|cut_attack_surface|defconfig | y | OK CONFIG_SECURITY_DMESG_RESTRICT |kconfig|cut_attack_surface| kspp | y | OK CONFIG_ACPI_CUSTOM_METHOD |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_COMPAT_BRK |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_DEVKMEM |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_BINFMT_MISC |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_INET_DIAG |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_KEXEC |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_PROC_KCORE |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_LEGACY_PTYS |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_HIBERNATION |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_COMPAT |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_IA32_EMULATION |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_X86_X32 |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_X86_X32_ABI |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_MODIFY_LDT_SYSCALL |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_OABI_COMPAT |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_X86_MSR |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_LEGACY_TIOCSTI |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_MODULE_FORCE_LOAD |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_M486 |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_MODULES |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_DEVMEM |kconfig|cut_attack_surface| kspp | is not set | FAIL: "y" CONFIG_IO_STRICT_DEVMEM |kconfig|cut_attack_surface| kspp | y | OK CONFIG_LDISC_AUTOLOAD |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_X86_VSYSCALL_EMULATION |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_COMPAT_VDSO |kconfig|cut_attack_surface| kspp | is not set | OK CONFIG_DRM_LEGACY |kconfig|cut_attack_surface|maintainer| is not set | OK CONFIG_FB |kconfig|cut_attack_surface|maintainer| is not set | OK CONFIG_VT |kconfig|cut_attack_surface|maintainer| is not set | OK CONFIG_BLK_DEV_FD |kconfig|cut_attack_surface|maintainer| is not set | OK CONFIG_BLK_DEV_FD_RAWCMD |kconfig|cut_attack_surface|maintainer| is not set | OK CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT |kconfig|cut_attack_surface|maintainer| is not set | OK CONFIG_N_GSM |kconfig|cut_attack_surface|maintainer| is not set | OK CONFIG_ZSMALLOC_STAT |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_DEBUG_KMEMLEAK |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_BINFMT_AOUT |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_KPROBE_EVENTS |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_UPROBE_EVENTS |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_GENERIC_TRACER |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_FUNCTION_TRACER |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_STACK_TRACER |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_HIST_TRIGGERS |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_BLK_DEV_IO_TRACE |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_PROC_VMCORE |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_PROC_PAGE_MONITOR |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_USELIB |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_CHECKPOINT_RESTORE |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_USERFAULTFD |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_HWPOISON_INJECT |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_MEM_SOFT_DIRTY |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_DEVPORT |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_DEBUG_FS |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_NOTIFIER_ERROR_INJECTION |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_FAIL_FUTEX |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_PUNIT_ATOM_DEBUG |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_ACPI_CONFIGFS |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_EDAC_DEBUG |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_DRM_I915_DEBUG |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_DVB_C8SECTPFE |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_MTD_SLRAM |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_MTD_PHRAM |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_IO_URING |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_KCMP |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_RSEQ |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_LATENCYTOP |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_KCOV |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_PROVIDE_OHCI1394_DMA_INIT |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_SUNRPC_DEBUG |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_X86_16BIT |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_BLK_DEV_UBLK |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_SMB_SERVER |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_XFS_ONLINE_SCRUB_STATS |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_CACHESTAT_SYSCALL |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_PREEMPTIRQ_TRACEPOINTS |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_ENABLE_DEFAULT_TRACERS |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_PROVE_LOCKING |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_TEST_DEBUG_VIRTUAL |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_MPTCP |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_TLS |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_TIPC |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_IP_SCTP |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_KGDB |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_PTDUMP_DEBUGFS |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_X86_PTDUMP |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_DEBUG_CLOSURES |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_BCACHE_CLOSURES_DEBUG |kconfig|cut_attack_surface| grsec | is not set | OK CONFIG_STAGING |kconfig|cut_attack_surface| clipos | is not set | OK CONFIG_KSM |kconfig|cut_attack_surface| clipos | is not set | OK CONFIG_KALLSYMS |kconfig|cut_attack_surface| clipos | is not set | OK CONFIG_KEXEC_FILE |kconfig|cut_attack_surface| clipos | is not set | OK CONFIG_CRASH_DUMP |kconfig|cut_attack_surface| clipos | is not set | OK CONFIG_USER_NS |kconfig|cut_attack_surface| clipos | is not set | OK CONFIG_X86_CPUID |kconfig|cut_attack_surface| clipos | is not set | OK CONFIG_X86_IOPL_IOPERM |kconfig|cut_attack_surface| clipos | is not set | OK CONFIG_ACPI_TABLE_UPGRADE |kconfig|cut_attack_surface| clipos | is not set | OK CONFIG_EFI_CUSTOM_SSDT_OVERLAYS |kconfig|cut_attack_surface| clipos | is not set | OK CONFIG_AIO |kconfig|cut_attack_surface| clipos | is not set | OK CONFIG_MAGIC_SYSRQ |kconfig|cut_attack_surface| clipos | is not set | OK CONFIG_MAGIC_SYSRQ_SERIAL |kconfig|cut_attack_surface|grapheneos| is not set | OK CONFIG_EFI_TEST |kconfig|cut_attack_surface| lockdown | is not set | OK CONFIG_MMIOTRACE_TEST |kconfig|cut_attack_surface| lockdown | is not set | OK CONFIG_KPROBES |kconfig|cut_attack_surface| lockdown | is not set | OK CONFIG_BPF_SYSCALL |kconfig|cut_attack_surface| lockdown | is not set | OK CONFIG_MMIOTRACE |kconfig|cut_attack_surface|a13xp0p0v | is not set | OK CONFIG_LIVEPATCH |kconfig|cut_attack_surface|a13xp0p0v | is not set | OK CONFIG_IP_DCCP |kconfig|cut_attack_surface|a13xp0p0v | is not set | OK CONFIG_FTRACE |kconfig|cut_attack_surface|a13xp0p0v | is not set | OK CONFIG_VIDEO_VIVID |kconfig|cut_attack_surface|a13xp0p0v | is not set | OK CONFIG_INPUT_EVBUG |kconfig|cut_attack_surface|a13xp0p0v | is not set | OK CONFIG_CORESIGHT |kconfig|cut_attack_surface|a13xp0p0v | is not set | OK CONFIG_XFS_SUPPORT_V4 |kconfig|cut_attack_surface|a13xp0p0v | is not set | OK CONFIG_BLK_DEV_WRITE_MOUNTED |kconfig|cut_attack_surface|a13xp0p0v | is not set | OK CONFIG_FAULT_INJECTION |kconfig|cut_attack_surface|a13xp0p0v | is not set | OK CONFIG_ARM_PTDUMP_DEBUGFS |kconfig|cut_attack_surface|a13xp0p0v | is not set | OK CONFIG_ARM_PTDUMP |kconfig|cut_attack_surface|a13xp0p0v | is not set | OK CONFIG_SECCOMP_CACHE_DEBUG |kconfig|cut_attack_surface|a13xp0p0v | is not set | OK CONFIG_CRASH_DM_CRYPT |kconfig|cut_attack_surface|a13xp0p0v | is not set | OK CONFIG_LKDTM |kconfig|cut_attack_surface|a13xp0p0v | is not set | OK CONFIG_TRIM_UNUSED_KSYMS |kconfig|cut_attack_surface|a13xp0p0v | y | OK CONFIG_SYN_COOKIES |kconfig| network_security |defconfig | y | OK CONFIG_COREDUMP |kconfig| harden_userspace | clipos | is not set | OK CONFIG_PROC_MEM_NO_FORCE |kconfig| harden_userspace |a13xp0p0v | y | OK CONFIG_ARCH_MMAP_RND_BITS |kconfig| harden_userspace |a13xp0p0v | 32 | FAIL: is not found CONFIG_ARCH_MMAP_RND_COMPAT_BITS |kconfig| harden_userspace |a13xp0p0v | 16 | OK: CONFIG_COMPAT is "is not set" CONFIG_X86_USER_SHADOW_STACK |kconfig| harden_userspace | kspp | y | OK nokaslr |cmdline| self_protection |defconfig | is not set | FAIL: "" no_hash_pointers |cmdline| self_protection |defconfig | is not set | OK: is not found nosmep |cmdline| self_protection |defconfig | is not set | OK: is not found nosmap |cmdline| self_protection |defconfig | is not set | OK: is not found dis_ucode_ldr |cmdline| self_protection |defconfig | is not set | OK: is not found setcpuid |cmdline| self_protection |defconfig | is not set | OK: is not found clearcpuid |cmdline| self_protection |defconfig | is not set | OK: is not found nopti |cmdline| self_protection |defconfig | is not set | OK: is not found nospec_store_bypass_disable |cmdline| self_protection |defconfig | is not set | OK: is not found nospectre_v1 |cmdline| self_protection |defconfig | is not set | OK: is not found nospectre_v2 |cmdline| self_protection |defconfig | is not set | OK: is not found nospectre_bhb |cmdline| self_protection |defconfig | is not set | OK: is not found arm64.nobti |cmdline| self_protection |defconfig | is not set | OK: is not found arm64.nopauth |cmdline| self_protection |defconfig | is not set | OK: is not found arm64.nomte |cmdline| self_protection |defconfig | is not set | OK: is not found arm64.nogcs |cmdline| self_protection |defconfig | is not set | OK: is not found iommu.passthrough |cmdline| self_protection |defconfig | 0 | OK rodata |cmdline| self_protection |defconfig | on | OK spectre_v2 |cmdline| self_protection |defconfig | is not off | FAIL: is off, not found spectre_v2_user |cmdline| self_protection |defconfig | is not off | FAIL: is off, not found spectre_bhi |cmdline| self_protection |defconfig | is not off | FAIL: is off, not found spec_store_bypass_disable |cmdline| self_protection |defconfig | is not off | FAIL: is off, not found l1tf |cmdline| self_protection |defconfig | is not off | FAIL: is off, not found mds |cmdline| self_protection |defconfig | is not off | OK: is not off, "full,nosmt" tsx_async_abort |cmdline| self_protection |defconfig | is not off | FAIL: is off, not found srbds |cmdline| self_protection |defconfig | is not off | FAIL: is off, not found mmio_stale_data |cmdline| self_protection |defconfig | is not off | FAIL: is off, not found retbleed |cmdline| self_protection |defconfig | is not off | FAIL: is off, not found spec_rstack_overflow |cmdline| self_protection |defconfig | is not off | FAIL: is off, not found gather_data_sampling |cmdline| self_protection |defconfig | is not off | FAIL: is off, not found reg_file_data_sampling |cmdline| self_protection |defconfig | is not off | FAIL: is off, not found tsa |cmdline| self_protection |defconfig | is not off | FAIL: is off, not found indirect_target_selection |cmdline| self_protection |defconfig | is not off | FAIL: is off, not found vmscape |cmdline| self_protection |defconfig | is not off | FAIL: is off, not found slab_merge |cmdline| self_protection | kspp | is not set | OK: is not found slub_merge |cmdline| self_protection | kspp | is not set | OK: is not found page_alloc.shuffle |cmdline| self_protection | kspp | 1 | FAIL: is not found hash_pointers |cmdline| self_protection | kspp | always | FAIL: is not found slab_nomerge |cmdline| self_protection | kspp | is present | OK: is present init_on_alloc |cmdline| self_protection | kspp | 1 | OK init_on_free |cmdline| self_protection | kspp | 1 | OK hardened_usercopy |cmdline| self_protection | kspp | 1 | OK: CONFIG_HARDENED_USERCOPY_DEFAULT_ON is "y" slab_common.usercopy_fallback |cmdline| self_protection | kspp | is not set | OK: is not found kfence.sample_interval |cmdline| self_protection | kspp | 100 | OK: CONFIG_KFENCE_SAMPLE_INTERVAL is "100" lockdown |cmdline| self_protection | kspp |confidentiality| OK: CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is "y" module.sig_enforce |cmdline| self_protection | kspp | 1 | OK: CONFIG_MODULE_SIG_FORCE is "y" efi |cmdline| self_protection | kspp |*disable_early_pci_dma*| OK: CONFIG_EFI is not found randomize_kstack_offset |cmdline| self_protection | kspp | 1 | OK mitigations |cmdline| self_protection | kspp | auto,nosmt | FAIL: is not found intel_iommu |cmdline| self_protection | kspp | on | OK: CONFIG_INTEL_IOMMU_DEFAULT_ON is "y" iommu.strict |cmdline| self_protection | kspp | 1 | OK: CONFIG_IOMMU_DEFAULT_DMA_STRICT is "y" pti |cmdline| self_protection | kspp | on | OK cfi |cmdline| self_protection | kspp | kcfi | OK: CONFIG_CFI_AUTO_DEFAULT is "is not set" iommu |cmdline| self_protection | clipos | force | FAIL: is not found tsx |cmdline|cut_attack_surface|defconfig | off | OK: CONFIG_X86_INTEL_TSX_MODE_OFF is "y" nosmt |cmdline|cut_attack_surface| kspp | is present | FAIL: is not present vsyscall |cmdline|cut_attack_surface| kspp | none | OK vdso32 |cmdline|cut_attack_surface| kspp | 0 | OK: CONFIG_COMPAT_VDSO is "is not set" ia32_emulation |cmdline|cut_attack_surface| kspp | 0 | OK: CONFIG_IA32_EMULATION is "is not set" debugfs |cmdline|cut_attack_surface| grsec | off | OK sysrq_always_enabled |cmdline|cut_attack_surface|grapheneos| is not set | OK: is not found bdev_allow_write_mounted |cmdline|cut_attack_surface|a13xp0p0v | 0 | OK: CONFIG_BLK_DEV_WRITE_MOUNTED is "is not set" norandmaps |cmdline| harden_userspace |defconfig | is not set | OK: is not found proc_mem.force_override |cmdline| harden_userspace |a13xp0p0v | never | OK: CONFIG_PROC_MEM_NO_FORCE is "y" net.core.bpf_jit_harden |sysctl | self_protection | kspp | 2 | OK vm.mmap_min_addr |sysctl | self_protection | kspp | 65536 | OK kernel.oops_limit |sysctl | self_protection |a13xp0p0v | 100 | OK kernel.warn_limit |sysctl | self_protection |a13xp0p0v | 100 | OK kernel.dmesg_restrict |sysctl |cut_attack_surface| kspp | 1 | OK kernel.perf_event_paranoid |sysctl |cut_attack_surface| kspp | 3 | OK dev.tty.ldisc_autoload |sysctl |cut_attack_surface| kspp | 0 | OK kernel.kptr_restrict |sysctl |cut_attack_surface| kspp | 2 | OK dev.tty.legacy_tiocsti |sysctl |cut_attack_surface| kspp | 0 | OK user.max_user_namespaces |sysctl |cut_attack_surface| kspp | 0 | OK kernel.kexec_load_disabled |sysctl |cut_attack_surface| kspp | 1 | OK kernel.unprivileged_bpf_disabled |sysctl |cut_attack_surface| kspp | 1 | OK vm.unprivileged_userfaultfd |sysctl |cut_attack_surface| kspp | 0 | OK kernel.modules_disabled |sysctl |cut_attack_surface| kspp | 1 | FAIL: "0" kernel.io_uring_disabled |sysctl |cut_attack_surface| grsec | 2 | OK kernel.sysrq |sysctl |cut_attack_surface|a13xp0p0v | 0 | OK net.ipv4.icmp_ignore_bogus_error_responses|sysctl | network_security | cis | 1 | FAIL: is not found net.ipv4.icmp_echo_ignore_broadcasts |sysctl | network_security | cis | 1 | OK net.ipv4.conf.all.accept_redirects |sysctl | network_security | cis | 0 | OK net.ipv4.conf.default.accept_redirects|sysctl | network_security | cis | 0 | FAIL: "1" net.ipv6.conf.all.accept_redirects |sysctl | network_security | cis | 0 | OK net.ipv6.conf.default.accept_redirects|sysctl | network_security | cis | 0 | OK net.ipv4.conf.all.accept_source_route |sysctl | network_security | cis | 0 | OK net.ipv4.conf.default.accept_source_route|sysctl | network_security | cis | 0 | OK net.ipv6.conf.all.accept_source_route |sysctl | network_security | cis | 0 | OK net.ipv6.conf.default.accept_source_route|sysctl | network_security | cis | 0 | OK net.ipv4.tcp_syncookies |sysctl | network_security | cis | 1 | OK net.ipv6.conf.all.accept_ra |sysctl | network_security | cis | 0 | OK net.ipv6.conf.default.accept_ra |sysctl | network_security | cis | 0 | OK fs.protected_symlinks |sysctl | harden_userspace | kspp | 1 | OK fs.protected_hardlinks |sysctl | harden_userspace | kspp | 1 | OK fs.protected_fifos |sysctl | harden_userspace | kspp | 2 | OK fs.protected_regular |sysctl | harden_userspace | kspp | 2 | OK fs.suid_dumpable |sysctl | harden_userspace | kspp | 0 | OK kernel.randomize_va_space |sysctl | harden_userspace | kspp | 2 | OK kernel.yama.ptrace_scope |sysctl | harden_userspace | kspp | 3 | OK vm.mmap_rnd_bits |sysctl | harden_userspace |a13xp0p0v | 32 | OK vm.mmap_rnd_compat_bits |sysctl | harden_userspace |a13xp0p0v | 16 | OK: CONFIG_COMPAT is "is not set" [+] Config check is finished: 'OK' - 315 / 'FAIL' - 37