AWS linux documentation change
Summary
Updated kernel hardening documentation to add support for AL2023/6.18 kernel versions (both aarch64 and x86_64) by extending configuration tables to include new columns for these versions while maintaining existing security settings
Security assessment
This change documents kernel hardening configurations for a new kernel version (6.18) but does not address any specific security vulnerability or incident. The documentation update maintains existing security hardening settings (like CONFIG_FORTIFY_SOURCE, CONFIG_HARDENED_USERCOPY, CONFIG_SECCOMP, etc.) for the new kernel version without changing their values. This is a routine documentation update to reflect support for newer kernel versions.
Diff
diff --git a/linux/al2023/ug/kernel-hardening.md b/linux/al2023/ug/kernel-hardening.md index 13d44a77d..cc44ed5f6 100644 --- a//linux/al2023/ug/kernel-hardening.md +++ b//linux/al2023/ug/kernel-hardening.md @@ -13,84 +13,84 @@ The 6.1 Linux kernel in AL2023 is configured and built with several hardening op -`CONFIG` option | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 | AL2023/6.12/aarch64 | AL2023/6.12/x86_64 ----|---|---|---|--- -CONFIG_ACPI_CUSTOM_METHOD | `n` | `n` | N/A | N/A -CONFIG_BINFMT_MISC | `m` | `m` | `m` | `m` -CONFIG_BUG | `y` | `y` | `y` | `y` -CONFIG_BUG_ON_DATA_CORRUPTION | `y` | `y` | `y` | `y` -CONFIG_CFI_CLANG | N/A | N/A | N/A | N/A -CONFIG_CFI_PERMISSIVE | N/A | N/A | N/A | N/A -CONFIG_COMPAT | `y` | `y` | `y` | `y` -CONFIG_COMPAT_BRK | `n` | `n` | `n` | `n` -CONFIG_COMPAT_VDSO | N/A | `n` | N/A | `n` -CONFIG_DEBUG_CREDENTIALS | `n` | `n` | N/A | N/A -CONFIG_DEBUG_LIST | `y` | `y` | `y` | `y` -CONFIG_DEBUG_NOTIFIERS | `n` | `n` | `n` | `n` -CONFIG_DEBUG_SG | `n` | `n` | `n` | `n` -CONFIG_DEBUG_VIRTUAL | `n` | `n` | `n` | `n` -CONFIG_DEBUG_WX | `n` | `n` | `n` | `n` -CONFIG_DEFAULT_MMAP_MIN_ADDR | `65536` | `65536` | `65536` | `65536` -[CONFIG_DEVKMEM](./compare-with-al2-kernel.html#CONFIG_DEVKMEM) | N/A | N/A | N/A | N/A -[CONFIG_DEVMEM](./compare-with-al2-kernel.html#CONFIG_DEVMEM) | `n` | `n` | `n` | `n` -CONFIG_EFI_DISABLE_PCI_DMA | `n` | `n` | `n` | `n` -[CONFIG_FORTIFY_SOURCE](./compare-with-al2-kernel.html#CONFIG_FORTIFY_SOURCE) | `y` | `y` | `y` | `y` -CONFIG_HARDENED_USERCOPY | `y` | `y` | `y` | `y` -CONFIG_HARDENED_USERCOPY_FALLBACK | N/A | N/A | N/A | N/A -CONFIG_HARDENED_USERCOPY_PAGESPAN | N/A | N/A | N/A | N/A -CONFIG_HIBERNATION | `y` | `y` | `y` | `y` -CONFIG_HW_RANDOM_TPM | N/A | N/A | N/A | N/A -CONFIG_INET_DIAG | `m` | `m` | `m` | `m` -CONFIG_INIT_ON_ALLOC_DEFAULT_ON | `n` | `n` | `n` | `n` -CONFIG_INIT_ON_FREE_DEFAULT_ON | `n` | `n` | `n` | `n` -CONFIG_INIT_STACK_ALL_ZERO | N/A | N/A | N/A | N/A -CONFIG_IOMMU_DEFAULT_DMA_STRICT | `n` | `n` | `n` | `n` -CONFIG_IOMMU_SUPPORT | `y` | `y` | `y` | `y` -[CONFIG_IO_STRICT_DEVMEM](./compare-with-al2-kernel.html#CONFIG_IO_STRICT_DEVMEM) | N/A | N/A | N/A | N/A -CONFIG_KEXEC | `y` | `y` | `y` | `y` -CONFIG_KFENCE | `n` | `n` | `n` | `n` -[CONFIG_LDISC_AUTOLOAD](./compare-with-al2-kernel.html#CONFIG_LDISC_AUTOLOAD) | `n` | `n` | `n` | `n` -CONFIG_LEGACY_PTYS | `n` | `n` | `n` | `n` -CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY | `n` | `n` | `n` | `n` -CONFIG_MODULES | `y` | `y` | `y` | `y` -CONFIG_MODULE_SIG | `y` | `y` | `y` | `y` -CONFIG_MODULE_SIG_ALL | `y` | `y` | `y` | `y` -CONFIG_MODULE_SIG_FORCE | `n` | `n` | `n` | `n` -CONFIG_MODULE_SIG_HASH | `sha512` | `sha512` | `sha512` | `sha512` -CONFIG_MODULE_SIG_KEY | `certs/signing_key.pem` | `certs/signing_key.pem` | `certs/signing_key.pem` | `certs/signing_key.pem` -CONFIG_MODULE_SIG_SHA512 | `y` | `y` | `y` | `y` -CONFIG_PAGE_POISONING | `n` | `n` | `n` | `n` -CONFIG_PAGE_POISONING_NO_SANITY | N/A | N/A | N/A | N/A -CONFIG_PAGE_POISONING_ZERO | N/A | N/A | N/A | N/A -[CONFIG_PANIC_ON_OOPS](./compare-with-al2-kernel.html#CONFIG_PANIC_ON_OOPS) | `y` | `y` | `y` | `y` -CONFIG_PANIC_TIMEOUT | `0` | `0` | `0` | `0` -CONFIG_PROC_KCORE | `y` | `y` | `y` | `y` -CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT | `n` | `n` | `n` | `n` -CONFIG_RANDOM_TRUST_BOOTLOADER | `y` | `y` | N/A | N/A -CONFIG_RANDOM_TRUST_CPU | `y` | `y` | N/A | N/A -CONFIG_REFCOUNT_FULL | N/A | N/A | N/A | N/A -CONFIG_SCHED_CORE | N/A | `y` | N/A | `y` -CONFIG_SCHED_STACK_END_CHECK | `y` | `y` | `y` | `y` -CONFIG_SECCOMP | `y` | `y` | `y` | `y` -CONFIG_SECCOMP_FILTER | `y` | `y` | `y` | `y` -CONFIG_SECURITY | `y` | `y` | `y` | `y` -[CONFIG_SECURITY_DMESG_RESTRICT](./compare-with-al2-kernel.html#CONFIG_SECURITY_DMESG_RESTRICT) | `y` | `y` | `y` | `y` -CONFIG_SECURITY_LANDLOCK | `y` | `y` | `y` | `y` -CONFIG_SECURITY_LOCKDOWN_LSM | `y` | `y` | `y` | `y` -CONFIG_SECURITY_LOCKDOWN_LSM_EARLY | `y` | `y` | `y` | `y` -CONFIG_SECURITY_SELINUX_BOOTPARAM | `y` | `y` | `y` | `y` -CONFIG_SECURITY_SELINUX_DEVELOP | `y` | `y` | `y` | `y` -[CONFIG_SECURITY_SELINUX_DISABLE](./compare-with-al2-kernel.html#CONFIG_SECURITY_SELINUX_DISABLE) | `n` | `n` | N/A | N/A -CONFIG_SECURITY_WRITABLE_HOOKS | N/A | N/A | N/A | N/A -CONFIG_SECURITY_YAMA | `y` | `y` | `y` | `y` -CONFIG_SHUFFLE_PAGE_ALLOCATOR | `y` | `y` | `y` | `y` -CONFIG_SLAB_FREELIST_HARDENED | `y` | `y` | `y` | `y` -CONFIG_SLAB_FREELIST_RANDOM | `y` | `y` | `y` | `y` -CONFIG_SLUB_DEBUG | `y` | `y` | `y` | `y` -CONFIG_STACKPROTECTOR | `y` | `y` | `y` | `y` -CONFIG_STACKPROTECTOR_STRONG | `y` | `y` | `y` | `y` -CONFIG_STATIC_USERMODEHELPER | `n` | `n` | `n` | `n` -[CONFIG_STRICT_DEVMEM](./compare-with-al2-kernel.html#CONFIG_STRICT_DEVMEM) | `n` | `n` | `n` | `n` -CONFIG_STRICT_KERNEL_RWX | `y` | `y` | `y` | `y` -CONFIG_STRICT_MODULE_RWX | `y` | `y` | `y` | `y` -CONFIG_SYN_COOKIES | `y` | `y` | `y` | `y` -CONFIG_VMAP_STACK | `y` | `y` | `y` | `y` -CONFIG_WERROR | `n` | `n` | `n` | `n` -CONFIG_ZERO_CALL_USED_REGS | `n` | `n` | `n` | `n` +`CONFIG` option | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 | AL2023/6.12/aarch64 | AL2023/6.12/x86_64 | AL2023/6.18/aarch64 | AL2023/6.18/x86_64 +---|---|---|---|---|---|--- +CONFIG_ACPI_CUSTOM_METHOD | `n` | `n` | N/A | N/A | N/A | N/A +CONFIG_BINFMT_MISC | `m` | `m` | `m` | `m` | `m` | `m` +CONFIG_BUG | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_BUG_ON_DATA_CORRUPTION | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_CFI_CLANG | N/A | N/A | N/A | N/A | N/A | N/A +CONFIG_CFI_PERMISSIVE | N/A | N/A | N/A | N/A | N/A | N/A +CONFIG_COMPAT | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_COMPAT_BRK | `n` | `n` | `n` | `n` | `n` | `n` +CONFIG_COMPAT_VDSO | N/A | `n` | N/A | `n` | N/A | `n` +CONFIG_DEBUG_CREDENTIALS | `n` | `n` | N/A | N/A | N/A | N/A +CONFIG_DEBUG_LIST | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_DEBUG_NOTIFIERS | `n` | `n` | `n` | `n` | `n` | `n` +CONFIG_DEBUG_SG | `n` | `n` | `n` | `n` | `n` | `n` +CONFIG_DEBUG_VIRTUAL | `n` | `n` | `n` | `n` | `n` | `n` +CONFIG_DEBUG_WX | `n` | `n` | `n` | `n` | `n` | `n` +CONFIG_DEFAULT_MMAP_MIN_ADDR | `65536` | `65536` | `65536` | `65536` | `65536` | `65536` +[CONFIG_DEVKMEM](./compare-with-al2-kernel.html#CONFIG_DEVKMEM) | N/A | N/A | N/A | N/A | N/A | N/A +[CONFIG_DEVMEM](./compare-with-al2-kernel.html#CONFIG_DEVMEM) | `n` | `n` | `n` | `n` | `n` | `n` +CONFIG_EFI_DISABLE_PCI_DMA | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_FORTIFY_SOURCE](./compare-with-al2-kernel.html#CONFIG_FORTIFY_SOURCE) | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_HARDENED_USERCOPY | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_HARDENED_USERCOPY_FALLBACK | N/A | N/A | N/A | N/A | N/A | N/A +CONFIG_HARDENED_USERCOPY_PAGESPAN | N/A | N/A | N/A | N/A | N/A | N/A +CONFIG_HIBERNATION | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_HW_RANDOM_TPM | N/A | N/A | N/A | N/A | N/A | N/A +CONFIG_INET_DIAG | `m` | `m` | `m` | `m` | `m` | `m` +CONFIG_INIT_ON_ALLOC_DEFAULT_ON | `n` | `n` | `n` | `n` | `n` | `n` +CONFIG_INIT_ON_FREE_DEFAULT_ON | `n` | `n` | `n` | `n` | `n` | `n` +CONFIG_INIT_STACK_ALL_ZERO | N/A | N/A | N/A | N/A | N/A | N/A +CONFIG_IOMMU_DEFAULT_DMA_STRICT | `n` | `n` | `n` | `n` | `n` | `n` +CONFIG_IOMMU_SUPPORT | `y` | `y` | `y` | `y` | `y` | `y` +[CONFIG_IO_STRICT_DEVMEM](./compare-with-al2-kernel.html#CONFIG_IO_STRICT_DEVMEM) | N/A | N/A | N/A | N/A | N/A | N/A +CONFIG_KEXEC | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_KFENCE | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_LDISC_AUTOLOAD](./compare-with-al2-kernel.html#CONFIG_LDISC_AUTOLOAD) | `n` | `n` | `n` | `n` | `n` | `n` +CONFIG_LEGACY_PTYS | `n` | `n` | `n` | `n` | `n` | `n` +CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY | `n` | `n` | `n` | `n` | `n` | `n` +CONFIG_MODULES | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_MODULE_SIG | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_MODULE_SIG_ALL | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_MODULE_SIG_FORCE | `n` | `n` | `n` | `n` | `n` | `n` +CONFIG_MODULE_SIG_HASH | `sha512` | `sha512` | `sha512` | `sha512` | `sha512` | `sha512` +CONFIG_MODULE_SIG_KEY | `certs/signing_key.pem` | `certs/signing_key.pem` | `certs/signing_key.pem` | `certs/signing_key.pem` | `certs/signing_key.pem` | `certs/signing_key.pem` +CONFIG_MODULE_SIG_SHA512 | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_PAGE_POISONING | `n` | `n` | `n` | `n` | `n` | `n` +CONFIG_PAGE_POISONING_NO_SANITY | N/A | N/A | N/A | N/A | N/A | N/A +CONFIG_PAGE_POISONING_ZERO | N/A | N/A | N/A | N/A | N/A | N/A +[CONFIG_PANIC_ON_OOPS](./compare-with-al2-kernel.html#CONFIG_PANIC_ON_OOPS) | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_PANIC_TIMEOUT | `0` | `0` | `0` | `0` | `0` | `0` +CONFIG_PROC_KCORE | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT | `n` | `n` | `n` | `n` | `n` | `n` +CONFIG_RANDOM_TRUST_BOOTLOADER | `y` | `y` | N/A | N/A | N/A | N/A +CONFIG_RANDOM_TRUST_CPU | `y` | `y` | N/A | N/A | N/A | N/A +CONFIG_REFCOUNT_FULL | N/A | N/A | N/A | N/A | N/A | N/A +CONFIG_SCHED_CORE | N/A | `y` | N/A | `y` | N/A | `y` +CONFIG_SCHED_STACK_END_CHECK | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_SECCOMP | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_SECCOMP_FILTER | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_SECURITY | `y` | `y` | `y` | `y` | `y` | `y` +[CONFIG_SECURITY_DMESG_RESTRICT](./compare-with-al2-kernel.html#CONFIG_SECURITY_DMESG_RESTRICT) | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_SECURITY_LANDLOCK | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_SECURITY_LOCKDOWN_LSM | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_SECURITY_LOCKDOWN_LSM_EARLY | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_SECURITY_SELINUX_BOOTPARAM | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_SECURITY_SELINUX_DEVELOP | `y` | `y` | `y` | `y` | `y` | `y` +[CONFIG_SECURITY_SELINUX_DISABLE](./compare-with-al2-kernel.html#CONFIG_SECURITY_SELINUX_DISABLE) | `n` | `n` | N/A | N/A | N/A | N/A +CONFIG_SECURITY_WRITABLE_HOOKS | N/A | N/A | N/A | N/A | N/A | N/A +CONFIG_SECURITY_YAMA | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_SHUFFLE_PAGE_ALLOCATOR | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_SLAB_FREELIST_HARDENED | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_SLAB_FREELIST_RANDOM | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_SLUB_DEBUG | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_STACKPROTECTOR | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_STACKPROTECTOR_STRONG | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_STATIC_USERMODEHELPER | `n` | `n` | `n` | `n` | `n` | `n` +[CONFIG_STRICT_DEVMEM](./compare-with-al2-kernel.html#CONFIG_STRICT_DEVMEM) | `n` | `n` | `n` | `n` | `n` | `n` +CONFIG_STRICT_KERNEL_RWX | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_STRICT_MODULE_RWX | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_SYN_COOKIES | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_VMAP_STACK | `y` | `y` | `y` | `y` | `y` | `y` +CONFIG_WERROR | `n` | `n` | `n` | `n` | `n` | `n` +CONFIG_ZERO_CALL_USED_REGS | `n` | `n` | `n` | `n` | `n` | `n` @@ -286,17 +286,17 @@ The AL2023 kernel is built with GCC rather than clang, so the `CONFIG_CFI_CLANG` -`CONFIG` option | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 | AL2023/6.12/aarch64 | AL2023/6.12/x86_64 ----|---|---|---|--- -CONFIG_AMD_IOMMU | N/A | `y` | N/A | `y` -CONFIG_AMD_IOMMU_V2 | N/A | `y` | N/A | N/A -CONFIG_IA32_EMULATION | N/A | `y` | N/A | `y` -CONFIG_INTEL_IOMMU | N/A | `y` | N/A | `y` -CONFIG_INTEL_IOMMU_DEFAULT_ON | N/A | `n` | N/A | `n` -CONFIG_INTEL_IOMMU_SVM | N/A | `n` | N/A | `n` -CONFIG_LEGACY_VSYSCALL_NONE | N/A | `n` | N/A | `n` -CONFIG_MODIFY_LDT_SYSCALL | N/A | `n` | N/A | `n` -CONFIG_PAGE_TABLE_ISOLATION | N/A | `y` | N/A | N/A -CONFIG_RANDOMIZE_MEMORY | N/A | `y` | N/A | `y` -CONFIG_X86_64 | N/A | `y` | N/A | `y` -CONFIG_X86_MSR | N/A | `y` | N/A | `y` -CONFIG_X86_VSYSCALL_EMULATION | N/A | `y` | N/A | `y` -CONFIG_X86_X32 | N/A | N/A | N/A | N/A -CONFIG_X86_X32_ABI | N/A | `n` | N/A | `n` +`CONFIG` option | AL2023/6.1/aarch64 | AL2023/6.1/x86_64 | AL2023/6.12/aarch64 | AL2023/6.12/x86_64 | AL2023/6.18/aarch64 | AL2023/6.18/x86_64 +---|---|---|---|---|---|--- +CONFIG_AMD_IOMMU | N/A | `y` | N/A | `y` | N/A | `y` +CONFIG_AMD_IOMMU_V2 | N/A | `y` | N/A | N/A | N/A | N/A +CONFIG_IA32_EMULATION | N/A | `y` | N/A | `y` | N/A | `y` +CONFIG_INTEL_IOMMU | N/A | `y` | N/A | `y` | N/A | `y` +CONFIG_INTEL_IOMMU_DEFAULT_ON | N/A | `n` | N/A | `n` | N/A | `n` +CONFIG_INTEL_IOMMU_SVM | N/A | `n` | N/A | `n` | N/A | `n` +CONFIG_LEGACY_VSYSCALL_NONE | N/A | `n` | N/A | `n` | N/A | `n`