Skip to content
Snippets Groups Projects
Commit d529382b authored by Marta Rybczynska's avatar Marta Rybczynska
Browse files

security guide: fix table formatting 


Signed-off-by: default avatarMarta Rybczynska <marta.rybczynska@linaro.org>
parent 4e282acc
No related branches found
No related tags found
1 merge request!48security guide: fix table formatting
Pipeline #12986 passed
Stage: test
    Stage: deploy
      This commit is part of merge request !48. Comments created here will be created in the context of that merge request.
      Hide whitespace changes
      Inline Side-by-side
      Showing
      with 49 additions and 63 deletions
      security/guide.rst
      + 49
      − 63
      View file @ d529382b
      ...@@ -51,19 +51,17 @@ leaking data freed from memory, and accessing wrong memory zones. ...@@ -51,19 +51,17 @@ leaking data freed from memory, and accessing wrong memory zones.
      Source files: ``oniro/meta-oniro-core/recipes-kernel/linux/linux/hardening_allocator.cfg`` Source files: ``oniro/meta-oniro-core/recipes-kernel/linux/linux/hardening_allocator.cfg``
      and ``oniro/meta-oniro-core/recipes-kernel/linux/linux/hardening_allocator_perf.cfg``. and ``oniro/meta-oniro-core/recipes-kernel/linux/linux/hardening_allocator_perf.cfg``.
      ``` +-------------------------------------+-------------+
      +---------------------------------+-------------+ | Config option | Oniro state |
      | Config option | Oniro state | +=====================================+=============+
      +=================================+=============+ | ``CONFIG_SLAB_FREELIST_RANDOM`` | On |
      | CONFIG_SLAB_FREELIST_RANDOM | On | | ``CONFIG_SLAB_FREELIST_HARDENED`` | On |
      | CONFIG_SLAB_FREELIST_HARDENED | On | | ``CONFIG_SHUFFLE_PAGE_ALLOCATOR`` | On |
      | CONFIG_SHUFFLE_PAGE_ALLOCATOR | On | | ``CONFIG_PAGE_POISONING`` | On |
      | CONFIG_PAGE_POISONING | On | | ``CONFIG_PAGE_POISONING_NO_SANITY`` | On |
      | CONFIG_PAGE_POISONING_NO_SANITY | On | | ``CONFIG_PAGE_POISONING_ZERO`` | On |
      | CONFIG_PAGE_POISONING_ZERO | On | | ``CONFIG_INIT_ON_ALLOC_DEFAULT_ON`` | On |
      | CONFIG_INIT_ON_ALLOC_DEFAULT_ON | On | +-------------------------------------+-------------+
      +---------------------------------+-------------+
      ```
      **CONFIG_SLAB_FREELIST_RANDOM=y** **CONFIG_SLAB_FREELIST_RANDOM=y**
      ...@@ -150,15 +148,13 @@ Reducing Attack Surface ...@@ -150,15 +148,13 @@ Reducing Attack Surface
      The following options remove some obsolete or un-needed features, which could The following options remove some obsolete or un-needed features, which could
      make attacks easier: make attacks easier:
      ``` +-------------------------------------+-------------+
      +---------------------------------+-------------+ | Config option | Oniro state |
      | Config option | Oniro state | +=====================================+=============+
      +=================================+=============+ | ``CONFIG_COMPAT_BRK`` | Off |
      | CONFIG_COMPAT_BRK | Off | | ``CONFIG_PROC_KCORE`` | Off |
      | CONFIG_PROC_KCORE | Off | | ``CONFIG_BINFMT_MISC`` | Off |
      | CONFIG_BINFMT_MISC | Off | +-------------------------------------+-------------+
      +---------------------------------+-------------+
      ```
      **Option: CONFIG_COMPAT_BRK is not set** **Option: CONFIG_COMPAT_BRK is not set**
      ...@@ -200,13 +196,11 @@ Dmesg Options ...@@ -200,13 +196,11 @@ Dmesg Options
      Those options are related to the kernel log in ``dmesg``: Those options are related to the kernel log in ``dmesg``:
      ``` +-------------------------------------+-------------+
      +---------------------------------+-------------+ | Config option | Oniro state |
      | Config option | Oniro state | +=====================================+=============+
      +=================================+=============+ | ``CONFIG_SECURITY_DMESG_RESTRICT`` | On |
      | CONFIG_SECURITY_DMESG_RESTRICT | On | +-------------------------------------+-------------+
      +---------------------------------+-------------+
      ```
      Source files: ``oniro/meta-oniro-core/recipes-kernel/linux/linux/hardening_dmesg.cfg`` Source files: ``oniro/meta-oniro-core/recipes-kernel/linux/linux/hardening_dmesg.cfg``
      ...@@ -225,13 +219,11 @@ Compiler-level Hardening ...@@ -225,13 +219,11 @@ Compiler-level Hardening
      Those options enable checks done by the compiler: Those options enable checks done by the compiler:
      ``` +-------------------------------------+-------------+
      +---------------------------------+-------------+ | Config option | Oniro state |
      | Config option | Oniro state | +=====================================+=============+
      +=================================+=============+ | ``CONFIG_FORTIFY_SOURCE`` | On |
      | CONFIG_FORTIFY_SOURCE | On | +-------------------------------------+-------------+
      +---------------------------------+-------------+
      ```
      Source file: ``oniro/meta-oniro-core/recipes-kernel/linux/linux/hardening_fortify_source.cfg``. Source file: ``oniro/meta-oniro-core/recipes-kernel/linux/linux/hardening_fortify_source.cfg``.
      ...@@ -249,14 +241,12 @@ Memory Accesses ...@@ -249,14 +241,12 @@ Memory Accesses
      With those options we disable the complete physical memory access and detect With those options we disable the complete physical memory access and detect
      unsafe memory permissions: unsafe memory permissions:
      ``` +----------------------------------+-------------+
      +-------------------------------+-------------+ | Config option | Oniro state |
      | Config option | Oniro state | +==================================+=============+
      +===============================+=============+ | ``CONFIG_DEBUG_WX`` | On |
      | CONFIG_DEBUG_WX | On | | ``CONFIG_DEVMEM`` | Off |
      | CONFIG_DEVMEM | Off | +----------------------------------+-------------+
      +-------------------------------+-------------+
      ```
      Source file: ``oniro/meta-oniro-core/recipes-kernel/linux/linux/hardening_memory.cfg``. Source file: ``oniro/meta-oniro-core/recipes-kernel/linux/linux/hardening_memory.cfg``.
      ...@@ -296,14 +286,12 @@ Copying from Userspace ...@@ -296,14 +286,12 @@ Copying from Userspace
      Those options add verification when copying potentially malicious data from Those options add verification when copying potentially malicious data from
      the user space: the user space:
      ``` +---------------------------------------+-------------+
      +-----------------------------------+-------------+ | Config option | Oniro state |
      | Config option | Oniro state | +=======================================+=============+
      +===================================+=============+ | ``CONFIG_HARDENED_USERCOPY`` | On |
      | CONFIG_HARDENED_USERCOPY | On | | ``CONFIG_HARDENED_USERCOPY_FALLBACK`` | Off |
      | CONFIG_HARDENED_USERCOPY_FALLBACK | Off | +---------------------------------------+-------------+
      +-----------------------------------+-------------+
      ```
      File: ``oniro/meta-oniro-core/recipes-kernel/linux/linux/hardening_usercopy.cfg``. File: ``oniro/meta-oniro-core/recipes-kernel/linux/linux/hardening_usercopy.cfg``.
      ...@@ -345,17 +333,15 @@ Data Validation ...@@ -345,17 +333,15 @@ Data Validation
      With those options we add verification of the internal kernel data structures: With those options we add verification of the internal kernel data structures:
      ``` +-------------------------------------+-------------+
      +---------------------------------+-------------+ | Config option | Oniro state |
      | Config option | Oniro state | +=====================================+=============+
      +=================================+=============+ | ``CONFIG_DEBUG_NOTIFIERS`` | On |
      | CONFIG_DEBUG_NOTIFIERS | On | | ``CONFIG_DEBUG_LIST`` | On |
      | CONFIG_DEBUG_LIST | On | | ``CONFIG_DEBUG_SG`` | On |
      | CONFIG_DEBUG_SG | On | | ``CONFIG_BUG_ON_DATA_CORRUPTION`` | On |
      | CONFIG_BUG_ON_DATA_CORRUPTION | On | | ``CONFIG_SCHED_STACK_END_CHECK`` | On |
      | CONFIG_SCHED_STACK_END_CHECK | On | +-------------------------------------+-------------+
      +---------------------------------+-------------+
      ```
      File: ``oniro/meta-oniro-core/recipes-kernel/linux/linux/hardening_validation_checks.cfg``. File: ``oniro/meta-oniro-core/recipes-kernel/linux/linux/hardening_validation_checks.cfg``.
      ......
      0% or .
      You are about to add 0 people to the discussion. Proceed with caution.
      Finish editing this message first!
      Please register or to comment

      Copyright © Eclipse Foundation, Inc. All Rights Reserved.     Privacy Policy | Terms of Use | Copyright Agent