What are all the possible hardening settings under Menuconfig? I found a few listed in Config-build.in but I'm only seeing four in menuconfig (ASLR, user SSP, kernel SSP, buffer overflow detection, RELRO).
Any guides or info on where to find the rest? I found a couple listed here but again they're for the Config-build.in file, not menuconfig.
Thanks. I think I found all the ones mentioned in the article I linked, except this one:
CONFIG_PKG_FORTIFY_SOURCE_2=y
Where do I find that one in menuconfig?
Edit: Also, in Kernel Build Options, I'm not seeing much regarding hardening except for some logging features. Which ones are you talking about specifically? The undefined behavior sanity checker?
I was simply saying those were all I was aware of within the facility for which you were inquiring. If using the search function "/" does not yield what you are seeking than I guess you will have to step out to kernel_menuconfig.
I'm aware of the potential for breakage, but I'm only going to run 1 program on it.
And thanks for the script, but assuming it showed that sources were not fortified, then what? I still don't know where to find anything in menuconfig.
It would be nice if someone just had a list of corresponding kernel-config.in values for each menuconfig option. Or even a guide on menuconfig. There's got to be at least a thousand options in there.
Seems the help function on Enable buffer-overflows detection... provides the answer you seek. It changes the CLI compile options for generated code from 1 to 2. I would suggest that an eye to the environs in which the kernel is running on a router is important in regard kernel hardening.
Nothing in those directories matches the options in menuconfig. The names are all different. How am I supposed to match an entry to its menuconfig name?
As mentioned earlier, you can issue the / key inside menuconfig, and do a case-insensitive string search.
That will also display the available package description. Essentially searching thru the packages, but doing it from inside menuconfig and kernel_menuconfig