nixos/profiles/security.nix

   1 {
   2   pkgs,
   3   lib,
   4   config,
   5   ...
   6 }:
   7 with lib;
   8 {
   9   options = {
  10     security.kernel.mitigations = mkOption {
  11       type = types.str;
  12       default = "auto,nosmt";
  13       example = "off";
  14       description = ''
  15         Control optional mitigations for CPU vulnerabilities.  This is a set of
  16         curated, arch-independent options, each of which is an aggregation of
  17         existing arch-specific options.
  18       '';
  19     };
  20   };
  21   config = {
  22     boot.kernelPackages = mkDefault pkgs.linuxPackages;
  23     #boot.kernelPackages = pkgs.linuxPackages_latest;
  24     #boot.kernelPackages = pkgs.linuxPackages_hardened;
  25     #boot.kernelPackages = pkgs.linuxPackages_latest_hardened;
  26     #environment.memoryAllocator.provider = "libc";
  27     nix.settings.allowed-users = [ "@users" ];
  28     /*
  29       nix.settings.substituters = [
  30       "https://nix-community.cachix.org"
  31       ];
  32       nix.settings.trusted-public-keys = [
  33       "nix-community.cachix.org:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
  34       ];
  35     */
  36     nix.settings.trusted-users = [
  37       "root"
  38       "@wheel"
  39     ];
  40     networking.firewall.pingLimit = "--limit 60/minute --limit-burst 5";
  41     security.allowSimultaneousMultithreading = false;
  42     security.apparmor.enable = mkDefault true;
  43     security.forcePageTableIsolation = true;
  44     security.lockKernelModules = mkDefault true;
  45     security.protectKernelImage = true;
  46     security.virtualisation.flushL1DataCache = "always";
  47     # Only allow members of the wheel group to execute sudo by setting
  48     # the executable’s permissions accordingly.
  49     # This prevents users that are not members of wheel
  50     # from exploiting vulnerabilities in sudo such as CVE-2021-3156.
  51     security.sudo.execWheelOnly = true;
  52     boot.blacklistedKernelModules = [
  53       # Obscure network protocols
  54       "ax25"
  55       "netrom"
  56       "rose"
  57
  58       # Old or rare or insufficiently audited filesystems
  59       "adfs"
  60       "affs"
  61       "bfs"
  62       "befs"
  63       "cramfs"
  64       "efs"
  65       "erofs"
  66       "exofs"
  67       "freevxfs"
  68       "f2fs"
  69       "hfs"
  70       "hpfs"
  71       "jfs"
  72       "minix"
  73       "nilfs2"
  74       "ntfs"
  75       "omfs"
  76       "qnx4"
  77       "qnx6"
  78       "sysv"
  79       "ufs"
  80     ];
  81     # kernel-hardening-checker -c /proc/config.gz -l /proc/cmdline -s <(sudo sysctl -a) -m show_fail
  82     boot.kernel.sysctl = {
  83       # Mitigate kernel pointer leaks
  84       "kernel.kptr_restrict" = 2;
  85       # Restricts the kernel log to the CAP_SYSLOG capability
  86       "kernel.dmesg_restrict" = 1;
  87       # Prevent information leaks
  88       #kernel.printk = "3 3 3 3";
  89       # Restrict eBPF to the CAP_BPF capability
  90       # and enable JIT hardening techniques
  91       # such as constant blinding.
  92       "kernel.unprivileged_bpf_disabled" = 1;
  93       "net.core.bpf_jit_harden" = 2;
  94       # Restricts loading TTY line disciplines
  95       # to the CAP_SYS_MODULE capability to prevent
  96       # unprivileged attackers from loading vulnerable
  97       # line disciplines with the TIOCSETD ioctl
  98       "dev.tty.ldisc_autoload" = 0;
  99       # The userfaultfd() syscall is often abused to exploit
 100       # use-after-free flaws.
 101       # Due to this, this sysctl is used to restrict
 102       # this syscall to the CAP_SYS_PTRACE capability.
 103       "vm.unprivileged_userfaultfd" = 0;
 104       # kexec is a system call that is used
 105       # to boot another kernel during runtime.
 106       "kernel.kexec_load_disabled" = 1;
 107       # User namespaces are a feature in the kernel which aim to
 108       # improve sandboxing and make it easily accessible for
 109       # unprivileged users however, this feature exposes
 110       # significant kernel attack surface for privilege
 111       # escalation so this sysctl restricts the usage of user
 112       # namespaces to the CAP_SYS_ADMIN capability.
 113       "kernel.unprivileged_userns_clone" = 0;
 114       # Restricts all usage of performance events to the
 115       # CAP_PERFMON capability
 116       "kernel.perf_event_paranoid" = 3;
 117       # Helps protect against SYN flood attacks
 118       "net.ipv4.tcp_syncookies" = 1;
 119       # Protects against time-wait assassination
 120       # by dropping RST packets for sockets
 121       # in the time-wait state.
 122       "net.ipv4.tcp_rfc1337" = 1;
 123       # Disable ICMP redirect acceptance and sending to prevent
 124       # man-in-the-middle attacks and minimize information disclosure.
 125       "net.ipv4.conf.all.accept_redirects" = 0;
 126       "net.ipv4.conf.default.accept_redirects" = 0;
 127       "net.ipv4.conf.all.secure_redirects" = 0;
 128       "net.ipv4.conf.default.secure_redirects" = 0;
 129       "net.ipv6.conf.all.accept_redirects" = 0;
 130       "net.ipv6.conf.default.accept_redirects" = 0;
 131       "net.ipv4.conf.all.send_redirects" = 0;
 132       "net.ipv4.conf.default.send_redirects" = 0;
 133       # Disable source routing, a mechanism
 134       # that allows users to redirect network traffic.
 135       "net.ipv4.conf.all.accept_source_route" = 0;
 136       "net.ipv4.conf.default.accept_source_route" = 0;
 137       "net.ipv6.conf.all.accept_source_route" = 0;
 138       "net.ipv6.conf.default.accept_source_route" = 0;
 139       /*
 140         # Disable TCP SACK, which is commonly exploited
 141         # and unnecessary for many circumstances.
 142         # https://serverfault.com/questions/10955/when-to-turn-tcp-sack-off
 143         "net.ipv4.tcp_sack" = 0;
 144         "net.ipv4.tcp_dsack" = 0;
 145         "net.ipv4.tcp_fack" = 0;
 146       */
 147       # Generate a random IPv6 address
 148       "net.ipv6.conf.all.use_tempaddr" = mkForce 2;
 149       "net.ipv6.conf.default.use_tempaddr" = mkForce 2;
 150       # Restricts usage of ptrace to only processes
 151       # with the CAP_SYS_PTRACE capability
 152       "kernel.yama.ptrace_scope" = 2;
 153       # Do source validation by confirming reverse path
 154       "net.ipv4.conf.all.rp_filter" = 1;
 155       "net.ipv4.conf.default.rp_filter" = 1;
 156       # Any process which has changed privilege levels or is execute only will not be dumped.
 157       "fs.suid_dumpable" = 0;
 158       "fs.protected_fifos" = 2;
 159       "fs.protected_regular" = 2;
 160       # TIOCSTI is a dangerous legacy operation that can be disabled on most systems.
 161       "dev.tty.legacy_tiocsti" = 0;
 162       # User namespaces are used primarily for Linux containers. If containers are in use, this requirement is not applicable.
 163       #"user.max_user_namespaces" = mkDefault 0;
 164     };
 165     # DOC: https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html
 166     boot.kernelParams = [
 167       "oops=panic"
 168       #"quiet"
 169       #"loglevel=0"
 170       # Disable merging of slabs with similar size. May be necessary if there is
 171       # some reason to distinguish allocs to different slabs, especially in
 172       # hardened environments where the risk of heap overflows and layout control
 173       # by attackers can usually be frustrated by disabling merging. This will
 174       # reduce most of the exposure of a heap attack to a single cache (risks via
 175       # metadata attacks are mostly unchanged). Debug options disable merging on
 176       # their own.
 177       "slab_nomerge"
 178       # See slub_debug
 179       # https://gitlab.tails.boum.org/tails/tails/-/issues/19613#note_215741
 180       "slub_debug=FZ"
 181       # Control whether the page allocator should randomize its free lists.
 182       "page_alloc.shuffle=1"
 183       # Kernel detects whether your CPU model is vulnerable to issues that PTI mitigates
 184       # Disabling this feature removes hardening, but improves performance of system calls and interrupts.
 185       "pti=auto"
 186       # Controls the behavior of vsyscalls
 187       # (i.e. calls to fixed addresses of 0xffffffffff600x00 from legacy code).
 188       # Most statically-linked binaries and older versions of glibc use these calls.
 189       # With none, vsyscalls don't work at all.
 190       # This makes them quite hard to use for exploits but might break your system.
 191       "vsyscall=none"
 192       # Filesystem is not registered and clients get a -EPERM as result
 193       # when trying to register files or directories within debugfs.
 194       "debugfs=off"
 195       # Disabled because the wireguard module is not signed
 196       "module.sig_enforce=0"
 197       # Disable kernel features that allow userland to modify the running kernel
 198       # or to extract confidential information from the kernel.
 199       "lockdown=confidentiality"
 200       # https://www.kernel.org/doc/Documentation/x86/x86_64/boot-options.rst
 201       "mce=bootlog"
 202       "mitigations=${config.security.kernel.mitigations}" # kspp   | self_protection
 203       #"spectre_v2=on" # defconfig | self_protection
 204       #"spectre_v2_user=on" # defconfig | self_protection
 205       #"spec_store_bypass_disable=on" # defconfig | self_protection
 206       #"l1tf=on" # defconfig | self_protection
 207       #"mds=on" # defconfig | self_protection
 208       #"tsx_async_abort=on" # defconfig | self_protection
 209       #"srbds=on" # defconfig | self_protection
 210       #"mmio_stale_data=on" # defconfig | self_protection
 211       #"retbleed=on" # defconfig | self_protection
 212       #"spec_rstack_overflow=on" # defconfig | self_protection
 213       # Disable AVX to mitigate systems without microcode mitigation. No effect if the microcode mitigation is present. Known to cause crashes in userspace with buggy AVX enumeration.
 214       #"gather_data_sampling=force" # defconfig | self_protection
 215       # https://www.phoronix.com/news/randomize_kstack_offset-perf
 216       "randomize_kstack_offset=1" # kspp   | self_protection
 217       # See https://unix.stackexchange.com/questions/592538/what-are-the-implication-of-using-iommu-force-in-the-boot-kernel-options
 218       "iommu=force" # clipos  | self_protection
 219       # DMA unmap operations invalidate IOMMU hardware TLBs synchronously.
 220       "iommu.strict=1" # kspp   | self_protection
 221       "kfence.sample_interval=100" # a13xp0p0v | self_protection
 222       "kfence.deferrable=1"
 223
 224       # Unconditionally disables IA32 emulation
 225       # CompatibilityNode: steam-run-free needs it,
 226       # see https://github.com/NixOS/nixpkgs/pull/442783
 227       #"ia32_emulation=0" # a13xp0p0v |cut_attack_surface
 228
 229       # A bit too much
 230       # https://patchwork.kernel.org/project/linux-security-module/patch/20190626121943.131390-2-glider@google.com/#22731857
 231       #"init_on_alloc=1" #    kspp   | self_protection
 232       #"init_on_free=1" #    kspp   | self_protection
 233     ];
 234     services.journald.extraConfig = ''
 235       Compress=true
 236       MaxRetentionSec=1month
 237       Storage=persistent
 238       SystemMaxUse=100M
 239     '';
 240     systemd.coredump = {
 241       enable = mkDefault false;
 242       extraConfig = ''
 243         Compress=true
 244         MaxUse=1024M
 245         Storage=external
 246       '';
 247     };
 248     services.openssh = {
 249       # Avoid TOFU MITM by providing well known public keys here.
 250       knownHosts = {
 251         "git.sr.ht".hostNames = [ "git.sr.ht" ];
 252         "git.sr.ht".publicKey =
 253           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60";
 254
 255         "github.com".hostNames = [ "github.com" ];
 256         "github.com".publicKey =
 257           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
 258
 259         "gitlab.com".hostNames = [ "gitlab.com" ];
 260         "gitlab.com".publicKey =
 261           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
 262       };
 263       openFirewall = mkDefault true;
 264       settings = {
 265         Ciphers = [
 266           # Not hardware accelerated, but fast enough and somehow more secure
 267           # (packet sizes are encrypted and less vulnerable to timing attacks).
 268           "chacha20-poly1305@openssh.com"
 269           # A bit more throughput.
 270           "aes128-gcm@openssh.com"
 271           "aes256-gcm@openssh.com"
 272         ];
 273         KbdInteractiveAuthentication = mkDefault false;
 274         # Use key exchange algorithms recommended by `nixpkgs#ssh-audit`
 275         KexAlgorithms = [
 276           "curve25519-sha256"
 277           "curve25519-sha256@libssh.org"
 278           "diffie-hellman-group16-sha512"
 279           "diffie-hellman-group18-sha512"
 280           "sntrup761x25519-sha512@openssh.com"
 281         ];
 282         PasswordAuthentication = false;
 283         # Remove any remote gpg-agent's socket.
 284         StreamLocalBindUnlink = true;
 285         UseDns = mkDefault false;
 286         X11Forwarding = mkDefault false;
 287       };
 288     };
 289   };
 290   /*
 291     TODO: https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings
 292     =========================================================================================================================
 293                 option_name               | type  |desired_val | decision |      reason      | check_result
 294     =========================================================================================================================
 295     CONFIG_WERROR                           |kconfig|     y      |defconfig | self_protection  | FAIL: "is not set"
 296     CONFIG_X86_KERNEL_IBT                   |kconfig|     y      |defconfig | self_protection  | FAIL: "is not set"
 297     CONFIG_BUG_ON_DATA_CORRUPTION           |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 298     CONFIG_SHUFFLE_PAGE_ALLOCATOR           |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 299     CONFIG_DEBUG_VIRTUAL                    |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 300     CONFIG_DEBUG_SG                         |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 301     CONFIG_INIT_ON_ALLOC_DEFAULT_ON         |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 302     CONFIG_STATIC_USERMODEHELPER            |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 303     CONFIG_SECURITY_LOCKDOWN_LSM            |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 304     CONFIG_SECURITY_LOCKDOWN_LSM_EARLY      |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 305     CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY|kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 306     CONFIG_DEBUG_CREDENTIALS                |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 307     CONFIG_DEBUG_NOTIFIERS                  |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 308     CONFIG_KFENCE                           |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 309     CONFIG_KFENCE_SAMPLE_INTERVAL           |kconfig| is not off |a13xp0p0v | self_protection  | FAIL: CONFIG_KFENCE is not "y"
 310     CONFIG_RANDSTRUCT_FULL                  |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 311     CONFIG_RANDSTRUCT_PERFORMANCE           |kconfig| is not set |   kspp   | self_protection  | FAIL: CONFIG_RANDSTRUCT_FULL is not "y"
 312     CONFIG_GCC_PLUGIN_LATENT_ENTROPY        |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 313     CONFIG_MODULE_SIG                       |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 314     CONFIG_MODULE_SIG_ALL                   |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 315     CONFIG_MODULE_SIG_SHA512                |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 316     CONFIG_MODULE_SIG_FORCE                 |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 317     CONFIG_INIT_ON_FREE_DEFAULT_ON          |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 318     CONFIG_EFI_DISABLE_PCI_DMA              |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 319     CONFIG_RESET_ATTACK_MITIGATION          |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 320     CONFIG_UBSAN_BOUNDS                     |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 321     CONFIG_UBSAN_LOCAL_BOUNDS               |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 322     CONFIG_UBSAN_TRAP                       |kconfig|     y      |   kspp   | self_protection  | FAIL: CONFIG_UBSAN_BOUNDS is not "y"
 323     CONFIG_UBSAN_SANITIZE_ALL               |kconfig|     y      |   kspp   | self_protection  | FAIL: CONFIG_UBSAN_BOUNDS is not "y"
 324     CONFIG_GCC_PLUGIN_STACKLEAK             |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 325     CONFIG_STACKLEAK_METRICS                |kconfig| is not set |   kspp   | self_protection  | FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is not "y"
 326     CONFIG_STACKLEAK_RUNTIME_DISABLE        |kconfig| is not set |   kspp   | self_protection  | FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is not "y"
 327     CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT  |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 328     CONFIG_CFI_CLANG                        |kconfig|     y      |   kspp   | self_protection  | FAIL: CONFIG_CC_IS_CLANG is not "y"
 329     CONFIG_CFI_PERMISSIVE                   |kconfig| is not set |   kspp   | self_protection  | FAIL: CONFIG_CC_IS_CLANG is not "y"
 330     CONFIG_DEFAULT_MMAP_MIN_ADDR            |kconfig|   65536    |   kspp   | self_protection  | FAIL: "4096"
 331     CONFIG_IOMMU_DEFAULT_DMA_STRICT         |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 332     CONFIG_INTEL_IOMMU_DEFAULT_ON           |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 333     CONFIG_SLS                              |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 334     CONFIG_INTEL_IOMMU_SVM                  |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 335     CONFIG_AMD_IOMMU_V2                     |kconfig|     y      |   kspp   | self_protection  | FAIL: "m"
 336     CONFIG_SLAB_MERGE_DEFAULT               |kconfig| is not set |  clipos  | self_protection  | FAIL: "y"
 337     CONFIG_LIST_HARDENED                    |kconfig|     y      |a13xp0p0v | self_protection  | FAIL: is not found
 338     CONFIG_RANDOM_KMALLOC_CACHES            |kconfig|     y      |a13xp0p0v | self_protection  | FAIL: is not found
 339     CONFIG_SECURITY_SELINUX_DISABLE         |kconfig| is not set |   kspp   | security_policy  | FAIL: "y"
 340     CONFIG_SECURITY_SELINUX_BOOTPARAM       |kconfig| is not set |   kspp   | security_policy  | FAIL: "y"
 341     CONFIG_SECURITY_SELINUX_DEVELOP         |kconfig| is not set |   kspp   | security_policy  | FAIL: "y"
 342     CONFIG_SECURITY_WRITABLE_HOOKS          |kconfig| is not set |   kspp   | security_policy  | FAIL: "y"
 343     CONFIG_SECURITY_DMESG_RESTRICT          |kconfig|     y      |   kspp   |cut_attack_surface| FAIL: "is not set"
 344     CONFIG_ACPI_CUSTOM_METHOD               |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "m"
 345     CONFIG_BINFMT_MISC                      |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 346     CONFIG_INET_DIAG                        |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "m"
 347     CONFIG_KEXEC                            |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 348     CONFIG_PROC_KCORE                       |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 349     CONFIG_HIBERNATION                      |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 350     CONFIG_COMPAT                           |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 351     CONFIG_IA32_EMULATION                   |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 352     CONFIG_MODIFY_LDT_SYSCALL               |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 353     CONFIG_X86_MSR                          |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "m"
 354     CONFIG_MODULES                          |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 355     CONFIG_DEVMEM                           |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 356     CONFIG_LDISC_AUTOLOAD                   |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 357     CONFIG_X86_VSYSCALL_EMULATION           |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 358     CONFIG_KPROBE_EVENTS                    |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 359     CONFIG_UPROBE_EVENTS                    |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 360     CONFIG_GENERIC_TRACER                   |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 361     CONFIG_FUNCTION_TRACER                  |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 362     CONFIG_STACK_TRACER                     |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 363     CONFIG_BLK_DEV_IO_TRACE                 |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 364     CONFIG_PROC_PAGE_MONITOR                |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 365     CONFIG_CHECKPOINT_RESTORE               |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 366     CONFIG_USERFAULTFD                      |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 367     CONFIG_DEVPORT                          |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 368     CONFIG_DEBUG_FS                         |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 369     CONFIG_PUNIT_ATOM_DEBUG                 |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "m"
 370     CONFIG_ACPI_CONFIGFS                    |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "m"
 371     CONFIG_MTD_SLRAM                        |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "m"
 372     CONFIG_MTD_PHRAM                        |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "m"
 373     CONFIG_IO_URING                         |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 374     CONFIG_KCMP                             |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 375     CONFIG_RSEQ                             |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 376     CONFIG_PROVIDE_OHCI1394_DMA_INIT        |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 377     CONFIG_SUNRPC_DEBUG                     |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 378     CONFIG_FB                               |kconfig| is not set |maintainer|cut_attack_surface| FAIL: "y"
 379     CONFIG_VT                               |kconfig| is not set |maintainer|cut_attack_surface| FAIL: "y"
 380     CONFIG_BLK_DEV_FD                       |kconfig| is not set |maintainer|cut_attack_surface| FAIL: "m"
 381     CONFIG_STAGING                          |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 382     CONFIG_KSM                              |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 383     CONFIG_KALLSYMS                         |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 384     CONFIG_MAGIC_SYSRQ                      |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 385     CONFIG_KEXEC_FILE                       |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 386     CONFIG_USER_NS                          |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 387     CONFIG_X86_CPUID                        |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "m"
 388     CONFIG_X86_IOPL_IOPERM                  |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 389     CONFIG_ACPI_TABLE_UPGRADE               |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 390     CONFIG_EFI_CUSTOM_SSDT_OVERLAYS         |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 391     CONFIG_AIO                              |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 392     CONFIG_KPROBES                          |kconfig| is not set | lockdown |cut_attack_surface| FAIL: "y"
 393     CONFIG_BPF_SYSCALL                      |kconfig| is not set | lockdown |cut_attack_surface| FAIL: "y"
 394     CONFIG_IP_DCCP                          |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "m"
 395     CONFIG_IP_SCTP                          |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "m"
 396     CONFIG_FTRACE                           |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "y"
 397     CONFIG_INPUT_EVBUG                      |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "m"
 398     CONFIG_XFS_SUPPORT_V4                   |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "y"
 399     CONFIG_TRIM_UNUSED_KSYMS                |kconfig|     y      |a13xp0p0v |cut_attack_surface| FAIL: "is not set"
 400     CONFIG_COREDUMP                         |kconfig| is not set |  clipos  | harden_userspace | FAIL: "y"
 401     CONFIG_ARCH_MMAP_RND_BITS               |kconfig|     32     |a13xp0p0v | harden_userspace | FAIL: "28"
 402     CONFIG_X86_USER_SHADOW_STACK            |kconfig|     y      |a13xp0p0v | harden_userspace | FAIL: is not found
 403   */
 404 }