About this project

This repository provides tools, scripts, and best-known configurations (BKC) for hardening Linux guest kernels within the Confidential Cloud Computing threat model, particularly for Intel TDX. It includes: - **bkc/audit**: Static analysis for threat surface enumeration. - **bkc/kafl**: Configurations and tools for Linux fuzzing using kAFL. - **bkc/syzkaller**: Configurations and tools for generating guest activity with Syzkaller. - **bkc/coverage**: Tools for matching coverage and trace data against audit lists. **Requirements**: Intel Skylake or newer CPU, a patched host kernel for TDX emulation, recent Debian/Ubuntu, and working knowledge of Linux kernel building and booting. **Installation**: Clone the repo, run `make deploy` (uses Ansible to install a patched host kernel and dependencies), then reboot into the kAFL/SDV emulation kernel. Activate the environment with `make env`. **Workflow**: After installation, users can review campaign workflows, generate smatch audit lists, launch predefined harnesses, define new harnesses, or target custom guest kernels. The project is intended for research and validation purposes only.