Linux 6.7 Introduces "make hardening.config" To Help Build A Hardened Kernel

The hardening updates for the Linux 6.7 kernel bring a new hardening configuration profile to help in building a security hardened kernel with some sane defaults.

As part of the hardening updates merged this week for Linux 6.7, there is now a Kconfig fragment with some basic hardening options that get enabled. Running make hardening.config can be used for applying the hardening options that are recommended.

These hardening options for the Linux kernel build amount to "a basic set of kernel hardening options that have the least (or no) performance impact and remove a reasonable set of legacy APIs."

The hardening options include basic kernel memory permission enforcement, address space layout randomization, randomizing allocator freelists, hardening metadata, randomizing the kernel stack offset on syscall entry, basic frame overflow protection, basic buffer length bounds checking, basic array index bounds checking, linked list integrity checking, not allowing direct physical memory access to non-device memory, disabling user-space VDSO ASLR, only enabling the modern PTY interface, and a number of other security tunables enabled as well as some architecture-specific options. It's overall a nice list of various recommended defaults in the name of hardening while not thrashing performance. Most Linux distribution vendor kernels have most or all of these options already enabled but it should be nice for those rolling their own Linux kernel builds.