Skip to content
Linux Kernel Defence Map
Branch: master
Clone or download
Cannot retrieve the latest commit at this time.
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
LICENSE Add LICENSE Jan 30, 2019
README.md Update the README Dec 2, 2019
linux-kernel-defence-map.dot Add CONFIG_SHUFFLE_PAGE_ALLOCATOR Dec 2, 2019
linux-kernel-defence-map.svg Update the README Dec 2, 2019

README.md

Linux Kernel Defence Map

Intro

Linux kernel security is a very complex topic. Some defence technologies are provided by the Linux kernel mainline. Others are going out‑of‑tree for various reasons (some of them are commercial, for example). Plus there are kernel defences that depend on special hardware features.

It would certainly be convenient to have a graphical representation of the current state of Linux kernel security.

So I've created a Linux Kernel Defence Map showing the relationships between:

  • Vulnerability classes
  • Exploitation techniques
  • Bug detection mechanisms
  • Defence technologies

N.B. The node connections don't mean "full mitigation." Rather, each connection represents some kind of relationship. So this map should help to navigate the documentation and Linux kernel sources. It also provides the Common Weakness Enumeration (CWE) numbers for vulnerability classes.

How this Map is made

This map is written in the DOT language, which makes maintenance and updating in Git very convenient. The diagram is generated using GraphViz with the following command:

dot -Tsvg linux-kernel-defence-map.dot -o linux-kernel-defence-map.svg

Do you want to check your kernel config?

So there are plenty of Linux kernel hardening config options. A lot of them are not enabled by the major distros. We have to enable these options ourselves to make our systems more secure.

But nobody likes verifying configs manually. So I've created the kconfig-hardened-check.py that checks security hardening options in the Linux kernel Kconfig option list. You are welcome to try it.

Documentation

The Map for v5.3

Linux Kernel Defence Map

You can’t perform that action at this time.