hardened-amd64.config

## https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings

## Disallow allocating the first 64k of memory.
CONFIG_DEFAULT_MMAP_MIN_ADDR=65536

# Disable Model-Specific Register writes.
# CONFIG_X86_MSR is not set

## Randomize position of kernel and memory.
CONFIG_RANDOMIZE_BASE=y
CONFIG_RANDOMIZE_MEMORY=y

## Modern libc no longer needs a fixed-position mapping in userspace, remove it as a possible target.
CONFIG_LEGACY_VSYSCALL_NONE=y

## Enable Kernel Page Table Isolation to remove an entire class of cache timing side-channels.
CONFIG_PAGE_TABLE_ISOLATION=y

## Remove additional attack surface, unless you really need them.
# CONFIG_X86_X32 is not set
# CONFIG_X86_X32_ABI is not set
# CONFIG_MODIFY_LDT_SYSCALL is not set

# Enforce CET Indirect Branch Tracking in the kernel. (Since v5.18)
CONFIG_X86_KERNEL_IBT=y

# Support userspace CET Shadow Stack
CONFIG_X86_USER_SHADOW_STACK=y