# kpti=on
# ssbd=force-on
#
-# N.B. Hardening sysctl's:
-# net.core.bpf_jit_harden
+# N.B. Hardening sysctls:
+# net.core.bpf_jit_harden=2
# kptr_restrict=2
+# vm.unprivileged_userfaultfd=0
+# kernel.perf_event_paranoid=3
+# kernel.yama.ptrace_scope=1
+# kernel.unprivileged_bpf_disabled=1
import sys
from argparse import ArgumentParser
from collections import OrderedDict
import re
+import json
debug_mode = False # set it to True to print the unknown options from the config
json_mode = False # if True, print results in JSON format
checklist.append(OptCheck('SCHED_STACK_END_CHECK', 'y', 'kspp', 'self_protection'))
checklist.append(OptCheck('SLAB_FREELIST_HARDENED', 'y', 'kspp', 'self_protection'))
checklist.append(OptCheck('SLAB_FREELIST_RANDOM', 'y', 'kspp', 'self_protection'))
+ checklist.append(OptCheck('SHUFFLE_PAGE_ALLOCATOR', 'y', 'kspp', 'self_protection'))
checklist.append(OptCheck('FORTIFY_SOURCE', 'y', 'kspp', 'self_protection'))
checklist.append(OptCheck('GCC_PLUGINS', 'y', 'kspp', 'self_protection'))
randstruct_is_set = OptCheck('GCC_PLUGIN_RANDSTRUCT', 'y', 'kspp', 'self_protection')
checklist.append(randstruct_is_set)
- checklist.append(OptCheck('GCC_PLUGIN_STRUCTLEAK', 'y', 'kspp', 'self_protection'))
- checklist.append(OptCheck('GCC_PLUGIN_STRUCTLEAK_BYREF_ALL', 'y', 'kspp', 'self_protection'))
checklist.append(OptCheck('GCC_PLUGIN_LATENT_ENTROPY', 'y', 'kspp', 'self_protection'))
checklist.append(OptCheck('DEBUG_LIST', 'y', 'kspp', 'self_protection'))
checklist.append(OptCheck('DEBUG_SG', 'y', 'kspp', 'self_protection'))
checklist.append(AND(OptCheck('INTEL_IOMMU_DEFAULT_ON', 'y', 'clipos', 'self_protection'), \
iommu_support_is_set))
+ checklist.append(OR(OptCheck('INIT_STACK_ALL', 'y', 'my', 'self_protection'), \
+ OptCheck('GCC_PLUGIN_STRUCTLEAK_BYREF_ALL', 'y', 'kspp', 'self_protection')))
if debug_mode or arch == 'X86_64':
checklist.append(AND(OptCheck('AMD_IOMMU', 'y', 'my', 'self_protection'), \
iommu_support_is_set))
if with_results:
opt.append(o.result)
opts.append(opt)
- print(opts)
+ print(json.dumps(opts))
return
# header