Create documentation describing Linux kernel security options

[a13xp0p0v]

No description provided.

[o8opi]

Would love to see this, even if it's just a list of links and pointers to other resources :)

[krishjainx]

@a13xp0p0v @o8opi Are you looking for something like this? https://www.kernelconfig.io/CONFIG_BUG

The general form is https://www.kernelconfig.io/**CONFIG_NAME**

[jbmaillet]

https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings

Especially this page, but actually the whole site, an initiative from Kernel security maintainer Kees Cook:
https://lore.kernel.org/kernel-hardening/CAGXu5jJ3FgxXK9WuOLRwnEq=y4dS+CTm+WQBxWe3sYZ7e9p6Gg@mail.gmail.com/

[a13xp0p0v]

@krishjainx, @jbmaillet, yes, I mean creating the documentation describing how the checked parameters influence Linux kernel security.

Another good example is CLIP OS documentation: https://docs.clip-os.org/clipos/kernel.html#configuration

I think of creating doc directory with markdown files describing Kconfig options, kernel cmdline arguments, and sysctl parameters.

[krishjainx]

@a13xp0p0v That sounds like a great idea! That's a lot of checked parameters, however, we should try to automate it so we can do it at scale. What do you think? There's reliable kernel documentation out there we could parse?

[a13xp0p0v]

@krishjainx , yes, some part of this work can be automated.

For self_protection, security_policy, and harden_userspace parameters, the Kconfig descriptions and kernel documentation contain some security-relevant info.
Example: https://cateee.net/lkddb/web-lkddb/CFI_CLANG.html

But for cut_attack_surface parameters, the kernel documentation doesn't say much about the security implications.

[jvoisin]

But for cut_attack_surface parameters, the kernel documentation doesn't say much about the security implications.

I think it would make sense to add some info upstream in the Kconfig description. Ideally we should be able to run a glorified grep on the Kconfig and generate proper documentation.