nixos/profiles/security.nix

   1 {
   2   pkgs,
   3   lib,
   4   config,
   5   ...
   6 }:
   7 with lib;
   8 {
   9   options = {
  10     security.kernel.mitigations = mkOption {
  11       type = types.str;
  12       default = "auto,nosmt";
  13       example = "off";
  14       description = ''
  15         Control optional mitigations for CPU vulnerabilities.  This is a set of
  16         curated, arch-independent options, each of which is an aggregation of
  17         existing arch-specific options.
  18       '';
  19     };
  20   };
  21   config = lib.mkMerge [
  22     {
  23       boot.kernelPackages = mkDefault pkgs.linuxPackages;
  24       #boot.kernelPackages = pkgs.linuxPackages_latest;
  25       #boot.kernelPackages = pkgs.linuxPackages_hardened;
  26       #boot.kernelPackages = pkgs.linuxPackages_latest_hardened;
  27       #environment.memoryAllocator.provider = "libc";
  28       nix.settings.allowed-users = [ "@users" ];
  29       /*
  30         nix.settings.substituters = [
  31         "https://nix-community.cachix.org"
  32         ];
  33         nix.settings.trusted-public-keys = [
  34         "nix-community.cachix.org:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
  35         ];
  36       */
  37       nix.settings.trusted-users = [
  38         "root"
  39         "@wheel"
  40       ];
  41       networking.firewall.pingLimit = "--limit 60/minute --limit-burst 5";
  42       security.allowSimultaneousMultithreading = false;
  43       security.apparmor.enable = mkDefault true;
  44       security.forcePageTableIsolation = true;
  45       security.lockKernelModules = mkDefault true;
  46       security.protectKernelImage = true;
  47       security.virtualisation.flushL1DataCache = "always";
  48       # Only allow members of the wheel group to execute sudo by setting
  49       # the executable’s permissions accordingly.
  50       # This prevents users that are not members of wheel
  51       # from exploiting vulnerabilities in sudo such as CVE-2021-3156.
  52       security.sudo.execWheelOnly = true;
  53       boot.blacklistedKernelModules = [
  54         # Obscure network protocols
  55         "ax25"
  56         "netrom"
  57         "rose"
  58
  59         # Old or rare or insufficiently audited filesystems
  60         "adfs"
  61         "affs"
  62         "bfs"
  63         "befs"
  64         "cramfs"
  65         "efs"
  66         "erofs"
  67         "exofs"
  68         "freevxfs"
  69         "f2fs"
  70         "hfs"
  71         "hpfs"
  72         "jfs"
  73         "minix"
  74         "nilfs2"
  75         "ntfs"
  76         "omfs"
  77         "qnx4"
  78         "qnx6"
  79         "sysv"
  80         "ufs"
  81       ];
  82       # kernel-hardening-checker -c /proc/config.gz -l /proc/cmdline -s <(sudo sysctl -a) -m show_fail
  83       boot.kernel.sysctl = {
  84         # Mitigate kernel pointer leaks
  85         "kernel.kptr_restrict" = 2;
  86         # Restricts the kernel log to the CAP_SYSLOG capability
  87         "kernel.dmesg_restrict" = 1;
  88         # Prevent information leaks
  89         #kernel.printk = "3 3 3 3";
  90         # Restrict eBPF to the CAP_BPF capability
  91         # and enable JIT hardening techniques
  92         # such as constant blinding.
  93         "kernel.unprivileged_bpf_disabled" = 1;
  94         "net.core.bpf_jit_harden" = 2;
  95         # Restricts loading TTY line disciplines
  96         # to the CAP_SYS_MODULE capability to prevent
  97         # unprivileged attackers from loading vulnerable
  98         # line disciplines with the TIOCSETD ioctl
  99         "dev.tty.ldisc_autoload" = 0;
 100         # The userfaultfd() syscall is often abused to exploit
 101         # use-after-free flaws.
 102         # Due to this, this sysctl is used to restrict
 103         # this syscall to the CAP_SYS_PTRACE capability.
 104         "vm.unprivileged_userfaultfd" = 0;
 105         # kexec is a system call that is used
 106         # to boot another kernel during runtime.
 107         "kernel.kexec_load_disabled" = 1;
 108         # User namespaces are a feature in the kernel which aim to
 109         # improve sandboxing and make it easily accessible for
 110         # unprivileged users however, this feature exposes
 111         # significant kernel attack surface for privilege
 112         # escalation so this sysctl restricts the usage of user
 113         # namespaces to the CAP_SYS_ADMIN capability.
 114         "kernel.unprivileged_userns_clone" = 0;
 115         # Restricts all usage of performance events to the
 116         # CAP_PERFMON capability
 117         "kernel.perf_event_paranoid" = 3;
 118         # Helps protect against SYN flood attacks
 119         "net.ipv4.tcp_syncookies" = 1;
 120         # Protects against time-wait assassination
 121         # by dropping RST packets for sockets
 122         # in the time-wait state.
 123         "net.ipv4.tcp_rfc1337" = 1;
 124         # Disable ICMP redirect acceptance and sending to prevent
 125         # man-in-the-middle attacks and minimize information disclosure.
 126         "net.ipv4.conf.all.accept_redirects" = 0;
 127         "net.ipv4.conf.default.accept_redirects" = 0;
 128         "net.ipv4.conf.all.secure_redirects" = 0;
 129         "net.ipv4.conf.default.secure_redirects" = 0;
 130         "net.ipv6.conf.all.accept_redirects" = 0;
 131         "net.ipv6.conf.default.accept_redirects" = 0;
 132         "net.ipv4.conf.all.send_redirects" = 0;
 133         "net.ipv4.conf.default.send_redirects" = 0;
 134         # Disable source routing, a mechanism
 135         # that allows users to redirect network traffic.
 136         "net.ipv4.conf.all.accept_source_route" = 0;
 137         "net.ipv4.conf.default.accept_source_route" = 0;
 138         "net.ipv6.conf.all.accept_source_route" = 0;
 139         "net.ipv6.conf.default.accept_source_route" = 0;
 140         /*
 141           # Disable TCP SACK, which is commonly exploited
 142           # and unnecessary for many circumstances.
 143           # https://serverfault.com/questions/10955/when-to-turn-tcp-sack-off
 144           "net.ipv4.tcp_sack" = 0;
 145           "net.ipv4.tcp_dsack" = 0;
 146           "net.ipv4.tcp_fack" = 0;
 147         */
 148         # Generate a random IPv6 address
 149         "net.ipv6.conf.all.use_tempaddr" = mkForce 2;
 150         "net.ipv6.conf.default.use_tempaddr" = mkForce 2;
 151         # Restricts usage of ptrace to only processes
 152         # with the CAP_SYS_PTRACE capability
 153         "kernel.yama.ptrace_scope" = 2;
 154         # Do source validation by confirming reverse path
 155         "net.ipv4.conf.all.rp_filter" = 1;
 156         "net.ipv4.conf.default.rp_filter" = 1;
 157         # Any process which has changed privilege levels or is execute only will not be dumped.
 158         "fs.suid_dumpable" = 0;
 159         "fs.protected_fifos" = 2;
 160         "fs.protected_regular" = 2;
 161         # TIOCSTI is a dangerous legacy operation that can be disabled on most systems.
 162         "dev.tty.legacy_tiocsti" = 0;
 163         # User namespaces are used primarily for Linux containers. If containers are in use, this requirement is not applicable.
 164         #"user.max_user_namespaces" = mkDefault 0;
 165       };
 166       # DOC: https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html
 167       boot.kernelParams = [
 168         "oops=panic"
 169         #"quiet"
 170         #"loglevel=0"
 171         # Disable merging of slabs with similar size. May be necessary if there is
 172         # some reason to distinguish allocs to different slabs, especially in
 173         # hardened environments where the risk of heap overflows and layout control
 174         # by attackers can usually be frustrated by disabling merging. This will
 175         # reduce most of the exposure of a heap attack to a single cache (risks via
 176         # metadata attacks are mostly unchanged). Debug options disable merging on
 177         # their own.
 178         "slab_nomerge"
 179         # See slub_debug
 180         # https://gitlab.tails.boum.org/tails/tails/-/issues/19613#note_215741
 181         "slub_debug=FZ"
 182         # Control whether the page allocator should randomize its free lists.
 183         "page_alloc.shuffle=1"
 184         # Kernel detects whether your CPU model is vulnerable to issues that PTI mitigates
 185         # Disabling this feature removes hardening, but improves performance of system calls and interrupts.
 186         "pti=auto"
 187         # Controls the behavior of vsyscalls
 188         # (i.e. calls to fixed addresses of 0xffffffffff600x00 from legacy code).
 189         # Most statically-linked binaries and older versions of glibc use these calls.
 190         # With none, vsyscalls don't work at all.
 191         # This makes them quite hard to use for exploits but might break your system.
 192         "vsyscall=none"
 193         # Filesystem is not registered and clients get a -EPERM as result
 194         # when trying to register files or directories within debugfs.
 195         "debugfs=off"
 196         # Disabled because the wireguard module is not signed
 197         "module.sig_enforce=0"
 198         # Disable kernel features that allow userland to modify the running kernel
 199         # or to extract confidential information from the kernel.
 200         "lockdown=confidentiality"
 201         # https://www.kernel.org/doc/Documentation/x86/x86_64/boot-options.rst
 202         "mce=bootlog"
 203         "mitigations=${config.security.kernel.mitigations}" # kspp   | self_protection
 204         #"spectre_v2=on" # defconfig | self_protection
 205         #"spectre_v2_user=on" # defconfig | self_protection
 206         #"spec_store_bypass_disable=on" # defconfig | self_protection
 207         #"l1tf=on" # defconfig | self_protection
 208         #"mds=on" # defconfig | self_protection
 209         #"tsx_async_abort=on" # defconfig | self_protection
 210         #"srbds=on" # defconfig | self_protection
 211         #"mmio_stale_data=on" # defconfig | self_protection
 212         #"retbleed=on" # defconfig | self_protection
 213         #"spec_rstack_overflow=on" # defconfig | self_protection
 214         # Disable AVX to mitigate systems without microcode mitigation. No effect if the microcode mitigation is present. Known to cause crashes in userspace with buggy AVX enumeration.
 215         #"gather_data_sampling=force" # defconfig | self_protection
 216         # https://www.phoronix.com/news/randomize_kstack_offset-perf
 217         "randomize_kstack_offset=1" # kspp   | self_protection
 218         # See https://unix.stackexchange.com/questions/592538/what-are-the-implication-of-using-iommu-force-in-the-boot-kernel-options
 219         "iommu=force" # clipos  | self_protection
 220         # DMA unmap operations invalidate IOMMU hardware TLBs synchronously.
 221         "iommu.strict=1" # kspp   | self_protection
 222         "kfence.sample_interval=100" # a13xp0p0v | self_protection
 223         "kfence.deferrable=1"
 224
 225         # Unconditionally disables IA32 emulation
 226         # CompatibilityNode: steam-run-free needs it,
 227         # see https://github.com/NixOS/nixpkgs/pull/442783
 228         #"ia32_emulation=0" # a13xp0p0v |cut_attack_surface
 229
 230         # A bit too much
 231         # https://patchwork.kernel.org/project/linux-security-module/patch/20190626121943.131390-2-glider@google.com/#22731857
 232         #"init_on_alloc=1" #    kspp   | self_protection
 233         #"init_on_free=1" #    kspp   | self_protection
 234       ];
 235       programs.firejail = {
 236         enable = true;
 237       };
 238       services.journald.extraConfig = ''
 239         Compress=true
 240         MaxRetentionSec=1month
 241         Storage=persistent
 242         SystemMaxUse=100M
 243       '';
 244       systemd.coredump = {
 245         enable = mkDefault false;
 246         extraConfig = ''
 247           Compress=true
 248           DefaultLimitCORE=${toString config.coredumps.limit}:${toString config.coredumps.limit}
 249           MaxUse=${toString config.coredumps.limit}
 250           Storage=external
 251         '';
 252       };
 253       security.pam.loginLimits = [
 254         {
 255           domain = "*";
 256           item = "core";
 257           type = "-";
 258           value = toString config.coredumps.limit;
 259         }
 260       ];
 261       services.openssh = {
 262         # Avoid TOFU MITM by providing well known public keys here.
 263         knownHosts = {
 264           "git.sr.ht".hostNames = [ "git.sr.ht" ];
 265           "git.sr.ht".publicKey =
 266             "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60";
 267
 268           "github.com".hostNames = [ "github.com" ];
 269           "github.com".publicKey =
 270             "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
 271
 272           "gitlab.com".hostNames = [ "gitlab.com" ];
 273           "gitlab.com".publicKey =
 274             "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
 275         };
 276         openFirewall = mkDefault true;
 277         settings = {
 278           Ciphers = [
 279             # Not hardware accelerated, but fast enough and somehow more secure
 280             # (packet sizes are encrypted and less vulnerable to timing attacks).
 281             "chacha20-poly1305@openssh.com"
 282             # A bit more throughput.
 283             "aes128-gcm@openssh.com"
 284             "aes256-gcm@openssh.com"
 285           ];
 286           KbdInteractiveAuthentication = mkDefault false;
 287           # Use key exchange algorithms recommended by `nixpkgs#ssh-audit`
 288           KexAlgorithms = [
 289             "curve25519-sha256"
 290             "curve25519-sha256@libssh.org"
 291             "diffie-hellman-group16-sha512"
 292             "diffie-hellman-group18-sha512"
 293             "sntrup761x25519-sha512@openssh.com"
 294           ];
 295           PasswordAuthentication = false;
 296           # Remove any remote gpg-agent's socket.
 297           StreamLocalBindUnlink = true;
 298           UseDns = mkDefault false;
 299           X11Forwarding = mkDefault false;
 300         };
 301       };
 302     }
 303     (mkIf (!config.systemd.coredump.enable) {
 304       systemd.settings.Manager = {
 305         DefaultLimitCORE = "0:0";
 306       };
 307       security.pam.loginLimits = [
 308         {
 309           domain = "*";
 310           item = "core";
 311           type = "-";
 312           value = "0";
 313         }
 314       ];
 315       # Explanation: to prevent the kernel from ever generating core dumps,
 316       # make it try to write to a nonexistent directory.
 317       # It doesn't work to specify /dev/null;
 318       # that will cause the kernel to *replace* /dev/null with the
 319       # core dump if a process running as root dumps core.
 320       boot.kernel.sysctl."kernel.core_pattern" = "/nonexistent/core";
 321     })
 322   ];
 323   /*
 324     TODO: https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings
 325     =========================================================================================================================
 326                 option_name               | type  |desired_val | decision |      reason      | check_result
 327     =========================================================================================================================
 328     CONFIG_WERROR                           |kconfig|     y      |defconfig | self_protection  | FAIL: "is not set"
 329     CONFIG_X86_KERNEL_IBT                   |kconfig|     y      |defconfig | self_protection  | FAIL: "is not set"
 330     CONFIG_BUG_ON_DATA_CORRUPTION           |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 331     CONFIG_SHUFFLE_PAGE_ALLOCATOR           |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 332     CONFIG_DEBUG_VIRTUAL                    |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 333     CONFIG_DEBUG_SG                         |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 334     CONFIG_INIT_ON_ALLOC_DEFAULT_ON         |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 335     CONFIG_STATIC_USERMODEHELPER            |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 336     CONFIG_SECURITY_LOCKDOWN_LSM            |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 337     CONFIG_SECURITY_LOCKDOWN_LSM_EARLY      |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 338     CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY|kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 339     CONFIG_DEBUG_CREDENTIALS                |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 340     CONFIG_DEBUG_NOTIFIERS                  |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 341     CONFIG_KFENCE                           |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 342     CONFIG_KFENCE_SAMPLE_INTERVAL           |kconfig| is not off |a13xp0p0v | self_protection  | FAIL: CONFIG_KFENCE is not "y"
 343     CONFIG_RANDSTRUCT_FULL                  |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 344     CONFIG_RANDSTRUCT_PERFORMANCE           |kconfig| is not set |   kspp   | self_protection  | FAIL: CONFIG_RANDSTRUCT_FULL is not "y"
 345     CONFIG_GCC_PLUGIN_LATENT_ENTROPY        |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 346     CONFIG_MODULE_SIG                       |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 347     CONFIG_MODULE_SIG_ALL                   |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 348     CONFIG_MODULE_SIG_SHA512                |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 349     CONFIG_MODULE_SIG_FORCE                 |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 350     CONFIG_INIT_ON_FREE_DEFAULT_ON          |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 351     CONFIG_EFI_DISABLE_PCI_DMA              |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 352     CONFIG_RESET_ATTACK_MITIGATION          |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 353     CONFIG_UBSAN_BOUNDS                     |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 354     CONFIG_UBSAN_LOCAL_BOUNDS               |kconfig|     y      |   kspp   | self_protection  | FAIL: is not found
 355     CONFIG_UBSAN_TRAP                       |kconfig|     y      |   kspp   | self_protection  | FAIL: CONFIG_UBSAN_BOUNDS is not "y"
 356     CONFIG_UBSAN_SANITIZE_ALL               |kconfig|     y      |   kspp   | self_protection  | FAIL: CONFIG_UBSAN_BOUNDS is not "y"
 357     CONFIG_GCC_PLUGIN_STACKLEAK             |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 358     CONFIG_STACKLEAK_METRICS                |kconfig| is not set |   kspp   | self_protection  | FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is not "y"
 359     CONFIG_STACKLEAK_RUNTIME_DISABLE        |kconfig| is not set |   kspp   | self_protection  | FAIL: CONFIG_GCC_PLUGIN_STACKLEAK is not "y"
 360     CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT  |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 361     CONFIG_CFI_CLANG                        |kconfig|     y      |   kspp   | self_protection  | FAIL: CONFIG_CC_IS_CLANG is not "y"
 362     CONFIG_CFI_PERMISSIVE                   |kconfig| is not set |   kspp   | self_protection  | FAIL: CONFIG_CC_IS_CLANG is not "y"
 363     CONFIG_DEFAULT_MMAP_MIN_ADDR            |kconfig|   65536    |   kspp   | self_protection  | FAIL: "4096"
 364     CONFIG_IOMMU_DEFAULT_DMA_STRICT         |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 365     CONFIG_INTEL_IOMMU_DEFAULT_ON           |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 366     CONFIG_SLS                              |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 367     CONFIG_INTEL_IOMMU_SVM                  |kconfig|     y      |   kspp   | self_protection  | FAIL: "is not set"
 368     CONFIG_AMD_IOMMU_V2                     |kconfig|     y      |   kspp   | self_protection  | FAIL: "m"
 369     CONFIG_SLAB_MERGE_DEFAULT               |kconfig| is not set |  clipos  | self_protection  | FAIL: "y"
 370     CONFIG_LIST_HARDENED                    |kconfig|     y      |a13xp0p0v | self_protection  | FAIL: is not found
 371     CONFIG_RANDOM_KMALLOC_CACHES            |kconfig|     y      |a13xp0p0v | self_protection  | FAIL: is not found
 372     CONFIG_SECURITY_SELINUX_DISABLE         |kconfig| is not set |   kspp   | security_policy  | FAIL: "y"
 373     CONFIG_SECURITY_SELINUX_BOOTPARAM       |kconfig| is not set |   kspp   | security_policy  | FAIL: "y"
 374     CONFIG_SECURITY_SELINUX_DEVELOP         |kconfig| is not set |   kspp   | security_policy  | FAIL: "y"
 375     CONFIG_SECURITY_WRITABLE_HOOKS          |kconfig| is not set |   kspp   | security_policy  | FAIL: "y"
 376     CONFIG_SECURITY_DMESG_RESTRICT          |kconfig|     y      |   kspp   |cut_attack_surface| FAIL: "is not set"
 377     CONFIG_ACPI_CUSTOM_METHOD               |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "m"
 378     CONFIG_BINFMT_MISC                      |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 379     CONFIG_INET_DIAG                        |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "m"
 380     CONFIG_KEXEC                            |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 381     CONFIG_PROC_KCORE                       |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 382     CONFIG_HIBERNATION                      |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 383     CONFIG_COMPAT                           |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 384     CONFIG_IA32_EMULATION                   |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 385     CONFIG_MODIFY_LDT_SYSCALL               |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 386     CONFIG_X86_MSR                          |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "m"
 387     CONFIG_MODULES                          |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 388     CONFIG_DEVMEM                           |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 389     CONFIG_LDISC_AUTOLOAD                   |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 390     CONFIG_X86_VSYSCALL_EMULATION           |kconfig| is not set |   kspp   |cut_attack_surface| FAIL: "y"
 391     CONFIG_KPROBE_EVENTS                    |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 392     CONFIG_UPROBE_EVENTS                    |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 393     CONFIG_GENERIC_TRACER                   |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 394     CONFIG_FUNCTION_TRACER                  |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 395     CONFIG_STACK_TRACER                     |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 396     CONFIG_BLK_DEV_IO_TRACE                 |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 397     CONFIG_PROC_PAGE_MONITOR                |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 398     CONFIG_CHECKPOINT_RESTORE               |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 399     CONFIG_USERFAULTFD                      |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 400     CONFIG_DEVPORT                          |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 401     CONFIG_DEBUG_FS                         |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 402     CONFIG_PUNIT_ATOM_DEBUG                 |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "m"
 403     CONFIG_ACPI_CONFIGFS                    |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "m"
 404     CONFIG_MTD_SLRAM                        |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "m"
 405     CONFIG_MTD_PHRAM                        |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "m"
 406     CONFIG_IO_URING                         |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 407     CONFIG_KCMP                             |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 408     CONFIG_RSEQ                             |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 409     CONFIG_PROVIDE_OHCI1394_DMA_INIT        |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 410     CONFIG_SUNRPC_DEBUG                     |kconfig| is not set |  grsec   |cut_attack_surface| FAIL: "y"
 411     CONFIG_FB                               |kconfig| is not set |maintainer|cut_attack_surface| FAIL: "y"
 412     CONFIG_VT                               |kconfig| is not set |maintainer|cut_attack_surface| FAIL: "y"
 413     CONFIG_BLK_DEV_FD                       |kconfig| is not set |maintainer|cut_attack_surface| FAIL: "m"
 414     CONFIG_STAGING                          |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 415     CONFIG_KSM                              |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 416     CONFIG_KALLSYMS                         |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 417     CONFIG_MAGIC_SYSRQ                      |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 418     CONFIG_KEXEC_FILE                       |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 419     CONFIG_USER_NS                          |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 420     CONFIG_X86_CPUID                        |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "m"
 421     CONFIG_X86_IOPL_IOPERM                  |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 422     CONFIG_ACPI_TABLE_UPGRADE               |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 423     CONFIG_EFI_CUSTOM_SSDT_OVERLAYS         |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 424     CONFIG_AIO                              |kconfig| is not set |  clipos  |cut_attack_surface| FAIL: "y"
 425     CONFIG_KPROBES                          |kconfig| is not set | lockdown |cut_attack_surface| FAIL: "y"
 426     CONFIG_BPF_SYSCALL                      |kconfig| is not set | lockdown |cut_attack_surface| FAIL: "y"
 427     CONFIG_IP_DCCP                          |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "m"
 428     CONFIG_IP_SCTP                          |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "m"
 429     CONFIG_FTRACE                           |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "y"
 430     CONFIG_INPUT_EVBUG                      |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "m"
 431     CONFIG_XFS_SUPPORT_V4                   |kconfig| is not set |a13xp0p0v |cut_attack_surface| FAIL: "y"
 432     CONFIG_TRIM_UNUSED_KSYMS                |kconfig|     y      |a13xp0p0v |cut_attack_surface| FAIL: "is not set"
 433     CONFIG_COREDUMP                         |kconfig| is not set |  clipos  | harden_userspace | FAIL: "y"
 434     CONFIG_ARCH_MMAP_RND_BITS               |kconfig|     32     |a13xp0p0v | harden_userspace | FAIL: "28"
 435     CONFIG_X86_USER_SHADOW_STACK            |kconfig|     y      |a13xp0p0v | harden_userspace | FAIL: is not found
 436   */
 437 }