AL2027 kernel hardening
AL2027 Preview
AL2027 is currently available for preview. It is intended for evaluation and testing only and is not recommended for production workloads.
The 7.1 Linux kernel in AL2027 is configured and built with a number of
hardening options and features. Many of these follow the Kernel Self Protection Project (KSPP)
Recommended Settings
The following table lists notable kernel hardening configuration options and their status
in the AL2027 7.1 kernel for both the x86_64 and aarch64
architectures. The values have the following meaning.
y– the option is built into the kernel.m– the option is built as a loadable kernel module.n– the option exists in this kernel but is disabled.A number or string (for example
0,65536, orsha512) – the configured value of the option.N/A– the configuration symbol is not present in this kernel on this architecture. This happens when the option was removed or renamed upstream, when it belongs to the other architecture, or when a different choice within the same option group is selected.
CONFIG option |
AL2027/7.1/aarch64 | AL2027/7.1/x86_64 |
|---|---|---|
CONFIG_ACPI_CUSTOM_METHOD
|
N/A | N/A |
CONFIG_AMD_IOMMU
|
N/A |
y
|
CONFIG_AMD_IOMMU_V2
|
N/A | N/A |
CONFIG_ARM64_BTI
|
y
|
N/A |
CONFIG_ARM64_BTI_KERNEL
|
N/A | N/A |
CONFIG_ARM64_E0PD
|
y
|
N/A |
CONFIG_ARM64_EPAN
|
y
|
N/A |
CONFIG_ARM64_MTE
|
y
|
N/A |
CONFIG_ARM64_PTR_AUTH
|
y
|
N/A |
CONFIG_ARM64_PTR_AUTH_KERNEL
|
y
|
N/A |
CONFIG_ARM64_SW_TTBR0_PAN
|
y
|
N/A |
CONFIG_BINFMT_MISC
|
m
|
m
|
CONFIG_BUG
|
y
|
y
|
CONFIG_BUG_ON_DATA_CORRUPTION
|
y
|
y
|
CONFIG_CFI_CLANG
|
N/A | N/A |
CONFIG_CFI_PERMISSIVE
|
N/A | N/A |
CONFIG_COMPAT
|
y
|
y
|
CONFIG_COMPAT_BRK
|
n
|
n
|
CONFIG_COMPAT_VDSO
|
N/A |
n
|
CONFIG_DEBUG_KERNEL
|
y
|
y
|
CONFIG_DEBUG_LIST
|
y
|
y
|
CONFIG_DEBUG_NOTIFIERS
|
n
|
n
|
CONFIG_DEBUG_SG
|
n
|
n
|
CONFIG_DEBUG_VIRTUAL
|
n
|
n
|
CONFIG_DEBUG_WX
|
n
|
n
|
CONFIG_DEFAULT_MMAP_MIN_ADDR
|
65536
|
65536
|
CONFIG_DEVKMEM
|
N/A | N/A |
CONFIG_DEVMEM
|
n
|
n
|
CONFIG_EFI_DISABLE_PCI_DMA
|
n
|
n
|
CONFIG_FORTIFY_SOURCE
|
y
|
y
|
CONFIG_HARDENED_USERCOPY
|
y
|
y
|
CONFIG_HIBERNATION
|
y
|
y
|
CONFIG_HW_RANDOM_TPM
|
N/A | N/A |
CONFIG_IA32_EMULATION
|
N/A |
y
|
CONFIG_INET_DIAG
|
m
|
m
|
CONFIG_INIT_ON_ALLOC_DEFAULT_ON
|
n
|
n
|
CONFIG_INIT_ON_FREE_DEFAULT_ON
|
n
|
n
|
CONFIG_INIT_STACK_ALL_ZERO
|
N/A | N/A |
CONFIG_INTEL_IOMMU
|
N/A |
y
|
CONFIG_INTEL_IOMMU_DEFAULT_ON
|
N/A |
n
|
CONFIG_INTEL_IOMMU_SVM
|
N/A |
n
|
CONFIG_IOMMU_DEFAULT_DMA_STRICT
|
n
|
n
|
CONFIG_IOMMU_SUPPORT
|
y
|
y
|
CONFIG_IO_STRICT_DEVMEM
|
N/A | N/A |
CONFIG_KASAN_HW_TAGS
|
N/A | N/A |
CONFIG_KEXEC
|
y
|
y
|
CONFIG_KFENCE
|
n
|
n
|
CONFIG_LDISC_AUTOLOAD
|
n
|
n
|
CONFIG_LEGACY_PTYS
|
n
|
n
|
CONFIG_LEGACY_TIOCSTI
|
n
|
n
|
CONFIG_LEGACY_VSYSCALL_NONE
|
N/A |
n
|
CONFIG_LIST_HARDENED
|
y
|
y
|
CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY
|
n
|
n
|
CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE
|
0x1
|
0x1
|
CONFIG_MITIGATION_PAGE_TABLE_ISOLATION
|
N/A |
y
|
CONFIG_MITIGATION_SLS
|
N/A |
n
|
CONFIG_MODIFY_LDT_SYSCALL
|
N/A |
n
|
CONFIG_MODULE_FORCE_LOAD
|
y
|
y
|
CONFIG_MODULES
|
y
|
y
|
CONFIG_MODULE_SIG
|
y
|
y
|
CONFIG_MODULE_SIG_ALL
|
y
|
y
|
CONFIG_MODULE_SIG_FORCE
|
n
|
n
|
CONFIG_MODULE_SIG_HASH
|
sha512
|
sha512
|
CONFIG_MODULE_SIG_KEY
|
certs/signing_key.pem
|
certs/signing_key.pem
|
CONFIG_MODULE_SIG_SHA512
|
y
|
y
|
CONFIG_PAGE_TABLE_CHECK
|
n
|
n
|
CONFIG_PANIC_ON_OOPS
|
y
|
y
|
CONFIG_PANIC_TIMEOUT
|
0
|
0
|
CONFIG_PROC_KCORE
|
y
|
y
|
CONFIG_PROC_MEM_ALWAYS_FORCE
|
n
|
n
|
CONFIG_PROC_MEM_FORCE_PTRACE
|
y
|
y
|
CONFIG_PROC_MEM_NO_FORCE
|
n
|
n
|
CONFIG_RANDOMIZE_BASE
|
n
|
y
|
CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT
|
n
|
n
|
CONFIG_RANDOMIZE_MEMORY
|
N/A |
y
|
CONFIG_RANDOM_KMALLOC_CACHES
|
n
|
n
|
CONFIG_RANDOM_TRUST_BOOTLOADER
|
N/A | N/A |
CONFIG_RANDOM_TRUST_CPU
|
N/A | N/A |
CONFIG_RANDSTRUCT_FULL
|
N/A | N/A |
CONFIG_RESET_ATTACK_MITIGATION
|
n
|
n
|
CONFIG_SCHED_CORE
|
N/A |
y
|
CONFIG_SCHED_STACK_END_CHECK
|
y
|
y
|
CONFIG_SECCOMP
|
y
|
y
|
CONFIG_SECCOMP_FILTER
|
y
|
y
|
CONFIG_SECURITY
|
y
|
y
|
CONFIG_SECURITY_DMESG_RESTRICT
|
y
|
y
|
CONFIG_SECURITY_LANDLOCK
|
y
|
y
|
CONFIG_SECURITY_LOCKDOWN_LSM
|
y
|
y
|
CONFIG_SECURITY_LOCKDOWN_LSM_EARLY
|
y
|
y
|
CONFIG_SECURITY_SELINUX_BOOTPARAM
|
y
|
y
|
CONFIG_SECURITY_SELINUX_DEBUG
|
n
|
n
|
CONFIG_SECURITY_SELINUX_DEVELOP
|
y
|
y
|
CONFIG_SECURITY_SELINUX_DISABLE
|
N/A | N/A |
CONFIG_SECURITY_WRITABLE_HOOKS
|
N/A | N/A |
CONFIG_SECURITY_YAMA
|
y
|
y
|
CONFIG_SHADOW_CALL_STACK
|
N/A | N/A |
CONFIG_SHUFFLE_PAGE_ALLOCATOR
|
y
|
y
|
CONFIG_SLAB_BUCKETS
|
y
|
y
|
CONFIG_SLAB_FREELIST_HARDENED
|
y
|
y
|
CONFIG_SLAB_FREELIST_RANDOM
|
y
|
y
|
CONFIG_SLAB_MERGE_DEFAULT
|
y
|
y
|
CONFIG_SLUB_DEBUG
|
y
|
y
|
CONFIG_STACKPROTECTOR
|
y
|
y
|
CONFIG_STACKPROTECTOR_STRONG
|
y
|
y
|
CONFIG_STATIC_USERMODEHELPER
|
n
|
n
|
CONFIG_STRICT_DEVMEM
|
n
|
n
|
CONFIG_STRICT_KERNEL_RWX
|
y
|
y
|
CONFIG_STRICT_MODULE_RWX
|
y
|
y
|
CONFIG_SYN_COOKIES
|
y
|
y
|
CONFIG_UBSAN
|
n
|
n
|
CONFIG_UNMAP_KERNEL_AT_EL0
|
y
|
N/A |
CONFIG_VMAP_STACK
|
y
|
y
|
CONFIG_WERROR
|
n
|
n
|
CONFIG_X86_64
|
N/A |
y
|
CONFIG_X86_KERNEL_IBT
|
N/A |
n
|
CONFIG_X86_MSR
|
N/A |
y
|
CONFIG_X86_USER_SHADOW_STACK
|
N/A |
n
|
CONFIG_X86_VSYSCALL_EMULATION
|
N/A |
y
|
CONFIG_X86_X32
|
N/A | N/A |
CONFIG_X86_X32_ABI
|
N/A |
n
|
CONFIG_ZERO_CALL_USED_REGS
|
n
|
n
|
