LinSpec

Lightweight kernel hardening audit tool for Linux forensic triage and security baseline verification.

---

Etymology and Origin

The name LinSpec comes from Linux + Inspection (Specification).

It was designed as a forensic entry-point — a tool that checks whether kernel-level protections are actually enforced before you move on to deeper analysis.

---

Overview

LinSpec audits the Linux kernel's security posture in real time. It pulls critical kernel parameters, hardware mitigation states, and system-level protection flags, then produces a structured security baseline report. Consider it the forensic triage step: surface the weaknesses before diving into memory analysis.

Core Audit Areas:

• Memory Protection: ASLR, NX, and DMA restrictions
• Kernel Hardening: Pointer restrictions, kexec disabled, dmesg visibility
• CPU Mitigations: Spectre and Meltdown status
• Network Stack: BPF JIT hardening and SYN Flood protection

---

Features

• Real-time kernel auditing
• CPU vulnerability detection
• Forensic Data Export (JSON/CSV)
• Minimalist terminal UI
• Pure C99 (no dependencies)
• PASS / WARN / VULN classification
• Passive inspection (read-only)
• Stateless execution

---

Example Output

[ 01 ]  MEMORY   >  Address Space Layout Randomization     [+] [   PASS   ]
[ 02 ]  KERNEL   >  Kernel Pointer Restriction             [-] [   VULN   ]
[ 03 ]  SYSTEM   >  Yama Ptrace Scope Protection           [+] [   PASS   ]
[ 04 ]  KERNEL   >  Kernel Log Dmesg Restriction           [+] [   PASS   ]
[ 05 ]  NETWORK  >  BPF JIT Compiler Hardening             [!] [   WARN   ]
[ 06 ]  NETWORK  >  TCP SYN Flood Protection (Cookies)     [+] [   PASS   ]
[ 07 ]  SYSTEM   >  Unprivileged User Namespaces           [!] [   WARN   ]

---

How It Works

LinSpec reads directly from these kernel interfaces:

• /proc/sys
• /sys/devices

The audit flow is simple:

1. Collect kernel security parameters
2. Normalize and classify the values
3. Compare against a hardened baseline
4. Assign PASS / WARN / VULN states
5. Export structured forensic reports

---

Build and Run

# 1. Clone the repository
git clone https://github.com/jeffersoncesarantunes/LinSpec.git

# 2. Enter the directory
cd LinSpec

# 3. Compile the project
make clean && make

# 4. Run with root privileges for full access
sudo ./linspec

---

Reports and Integration

After execution, LinSpec writes out structured artifacts for further analysis:

• report.json: Machine-readable data for forensic pipelines
• report.csv: Tabular format for analysis and documentation

Ecosystem Integration (S.I.R.E.N)

The report.json feeds into the larger ecosystem:

• Role: Input source for S.I.R.E.N
• Capability: Enables adaptive memory acquisition
• Benefit: Automates forensic capture decisions

---

The Forensic Ecosystem

LinSpec is the first stage in a three-stage forensic workflow:

---

Technical Validation and Evidence

You can verify the audit output yourself:

1. Check the structured reports:

column -s, -t < report.csv
cat report.json | grep -A 4 "summary"

2. Cross-check against the live kernel:

cat /proc/kallsyms | head -n 10
sysctl kernel.unprivileged_userns_clone
sysctl kernel.kexec_load_disabled
cat /proc/cmdline

---

Project in Action

System Audit Overview -- the forensic engine running a baseline triage.

Data Integrity and Reporting -- terminal output matched against structured reports.

Forensic Kernel Validation -- LinSpec results cross-checked with the live kernel state.

---

Repository Structure

├── docs/
│   ├── architecture.md
│   ├── audit_reference.md
│   ├── forensic_methodology.md
│   └── threat_model.md
├── Images/
│   ├── linspec1.png
│   ├── linspec2.png
│   └── linspec3.png
├── include/
├── src/
│   ├── checks.h
│   ├── main.c
│   ├── memory_audit.c
│   └── system_audit.c
├── report.csv
├── report.json
├── LICENSE
├── Makefile
└── README.md

---

Tech Stack

• Language: C (C99)
• Data Sources: /proc and /sys
• Build Tool: GNU Make
• Target Platforms: Linux Kernel 4.x, 5.x, 6.x

---

Roadmap

• High-performance C99 Core Engine
• Side-channel Vulnerability Detection (Spectre/Meltdown)
• Brutalist-inspired Terminal UI
• Structured Output (JSON/CSV Export)
• Ecosystem Integration (Pre-acquisition Audit for S.I.R.E.N)
• Automated Remediation (System Hardening)
• K-Scanner Deep Integration

---

Documentation

---

License

This project is licensed under the MIT License.