HardenedLinux’s announcement:
PaX/Grsecurity相关
- PaX/Grsecurity for Nexus 7 2013, May 11 2015
- PaX的技术考古之旅, May 23 2015
- PAGEEXEC的最早设计文档, May 25 2015
- SEGMEXEC设计文档, May 26 2015
- PaX/Grsecurity配置选项, Aug 17 2015
- PaX 早期设计文档概述, Mar 9 2016
- MPROTECT早期设计文档, Mar 14 2016
- 关于RAP的FAQ, May 1 2016
- 面向桌面的 PaX/Grsecurity 内核配置注释与评论
- Linux kernel mitigation checklist( WIP)
- The Unseen Benefits of a Security Mindset(自Grsecurity的blog), Apr 10 2017
Secops/安全运维
- Debian GNU/Linux security checklist and hardening, June 9 2015
- STIG-4-Debian, June 19 2015
- 社区最佳实践：基于PaX/Grsecurity & STIG & Sheild针对es的Docker场景化加固, Sept 6 2015
- Hardening your desktop: Linux Mint with PaX/Grsecurity, Jan 10 2015
- (A/T/KT) - Sanitized GNU/Linux: a new way of bug hunter in FLOSS Community, Apr 1 2016
- Mission impossible: Hardening the x86 based core infrastructures, Mar 17 2017
Compiler/编译器相关
- How to build Clang toolchains for Android, Apr 1 2016
- NX(No-eXecute)的实现分析, June 1 2016
- PIC/PIE&ASLR分析, July 1 2016
- Reproducible builds for PaX/Grsecurity, Aug 1 2016
- Build debug environment for the dynamic linker of Glibc, Aug 25 2016
- shared library wrinkle, Sept 21 2016
- RELRO分析, Nov 25 2016
- canary分析, Nov 27 2016
- ARMv8.3-A PA在GCC里的相关实现, Jun 2017
- SRCINV-源码审计系统的简要介绍, Dec 2018
Kernel security/内核安全相关
- 漏洞利用”BadIRET”分析(CVE-2014-9322, Linux内核提权), July 5 2015
- 后续故事：数字军火级别的”BadIRET”漏洞利用(CVE-2014-9322), July 5 2015
- Bypassing SMEP Using vDSO Overwrites(使用vDSO重写来绕过SMEP防护), Nov 25 2015
- CVE-2015-8088: 华为智能手机HiFi驱动堆溢出, Dec 12 2015
- An Introduction to Linux Kernel Exploitation, Jan 19 2016
- Linux内核自防护项目的初始文档, May 23 2016
- linux kernel double-free类型漏洞的利用, Aug 8 2017
- Exploiting on CVE-2016-6787, Oct 16 2017
- Linux kernel 4.14 SLAB_FREELIST_HARDENED 简单分析, Dec 2 2017
- Nightmares( Meltdown/Spectre/L1TF) never goes away, Aug 16 2018
Firmware security/固件安全相关
- Neutralize ME firmware on SandyBridge and IvyBridge platforms, Nov 17 2016
- 云基础架构之固件安全合规, Jun 15 2017
- 云基础架构之CHIPSEC固件安全基线, Jul 31 2017
- 隐蔽战争纪元之猎杀暗影：固件自由战争之阻击”Ring -3”世界的恶魔, July 4 2018
- 用于企业系统管理员和蓝队的平台固件安全防御, Oct 3 2018
Crypto engineering/密码工程相关
- SSL/TLS部署最佳实践v1.4, July 28 2015
- Debian/Ubuntu用户使用基于XMPP即时通信协议的OTR保护隐私的标准化部署流程, Feb 1 2018
NIST文档
- NIST SP 800-147: BIOS固件保护指南, Oct 31 2018
- NIST SP 800-147B: 服务器BIOS保护指南, Nov 6 2018
- NIST SP 800-155: BIOS 完整性测定指南, Nov 19 2018
- NIST SP 800-193: BIOS 平台固件弹性指南, Dec 12 2018
- NIST SP 800-125A: 基于服务器的虚拟机监视器平台的安全性建议, Apr 9 2019
- NIST IR 8176: 用于 Linux 应用容器部署的安全性担保要求), Apr 25 2019