NAME¶

kernel-hardening-checker - tool for checking the security hardening options of the Linux kernel

SYNOPSIS¶

kernel-hardening-checker [OPTIONS]

DESCRIPTION¶

kernel-hardening-checker is a tool for checking the security hardening options of the Linux kernel. It can analyze Kconfig options (compile-time), kernel command line arguments (boot-time), and sysctl parameters (runtime) for the following architectures: X86_64, X86_32, ARM64, ARM, RISC-V.

Please note that changing the Linux kernel security parameters may also affect system performance and functionality of userspace software. Therefore, when setting these parameters, consider the threat model of your Linux-based information system and thoroughly test its typical workload.

OPTIONS¶

-h, --help

Show the help message and exit.

--version

Show program's version number and exit.

-m {verbose,json,show_ok,show_fail}, --mode {verbose,json,show_ok,show_fail}

Select a special output mode instead of the default one:

-a, --autodetect

Autodetect and check the security hardening options of the running kernel.

-c CONFIG, --config CONFIG

Check the security hardening options in a Kconfig file (also supports *.gz files).

-v KERNEL_VERSION, --kernel-version KERNEL_VERSION

Extract the kernel version from a version file (such as /proc/version) instead of using a Kconfig file.

-l CMDLINE, --cmdline CMDLINE

Check the security hardening options in a kernel command line file (such as /proc/cmdline).

-s SYSCTL, --sysctl SYSCTL

Check the security hardening options in a sysctl output file (the result of "sudo sysctl -a > file").

-p {X86_64,X86_32,ARM64,ARM,RISCV}, --print {X86_64,X86_32,ARM64,ARM,RISCV}

Print security hardening recommendations for the selected architecture.

-g {X86_64,X86_32,ARM64,ARM,RISCV}, --generate {X86_64,X86_32,ARM64,ARM,RISCV}

Generate a Kconfig fragment containing the security hardening options for the selected architecture.

AUTHOR¶

Written by Alexander Popov with help from the contributors.

REPORTING BUGS¶

Report bugs at: <https://github.com/a13xp0p0v/kernel-hardening-checker/issues>

COPYRIGHT¶

Copyright: 2018-2025, Alexander Popov <alex.popov@linux.com>
License: GPL-3.0