#
#
# N.B Hardening command line parameters:
-# slab_nomerge
# page_alloc.shuffle=1
# iommu=force (does it help against DMA attacks?)
# iommu.passthrough=0
# init_on_free=1 (since v5.3, otherwise slub_debug=P and page_poison=1)
# loadpin.enforce=1
# debugfs=no-mount (or off if possible)
-# randomize_kstack_offset=1
#
# Mitigations of CPU vulnerabilities:
# Аrch-independent:
# mitigations=auto,nosmt (nosmt is slow)
# X86:
# spectre_v2=on
-# pti=on
# spec_store_bypass_disable=on
# l1tf=full,force
# l1d_flush=on (a part of the l1tf option)
# ssbd=force-on
#
# Should NOT be set:
+# slab_merge
# nokaslr
# rodata=off
# sysrq_always_enabled
import json
from .__about__ import __version__
-TYPES_OF_CHECKS = ('kconfig', 'version')
+SIMPLE_OPTION_TYPES = ('kconfig', 'version', 'cmdline')
class OptCheck:
# Constructor without the 'expected' parameter is for option presence checks (any value is OK)
if arch in ('X86_64', 'ARM64', 'X86_32'):
stackleak_is_set = KconfigCheck('self_protection', 'kspp', 'GCC_PLUGIN_STACKLEAK', 'y')
l += [stackleak_is_set]
- l += [KconfigCheck('self_protection', 'kspp', 'RANDOMIZE_KSTACK_OFFSET_DEFAULT', 'y')]
+ l += [OR(KconfigCheck('self_protection', 'kspp', 'RANDOMIZE_KSTACK_OFFSET_DEFAULT', 'y'),
+ CmdlineCheck('self_protection', 'kspp', 'randomize_kstack_offset', '1'))]
if arch in ('X86_64', 'X86_32'):
l += [KconfigCheck('self_protection', 'kspp', 'SCHED_CORE', 'y')]
l += [KconfigCheck('self_protection', 'kspp', 'DEFAULT_MMAP_MIN_ADDR', '65536')]
l += [KconfigCheck('self_protection', 'clipos', 'STATIC_USERMODEHELPER', 'y')] # needs userspace support
l += [OR(KconfigCheck('self_protection', 'clipos', 'EFI_DISABLE_PCI_DMA', 'y'),
efi_not_set)]
- l += [KconfigCheck('self_protection', 'clipos', 'SLAB_MERGE_DEFAULT', 'is not set')] # slab_nomerge
+ l += [OR(KconfigCheck('self_protection', 'clipos', 'SLAB_MERGE_DEFAULT', 'is not set'),
+ CmdlineCheck('self_protection', 'kspp', 'slab_nomerge'))] # option presence check
l += [KconfigCheck('self_protection', 'clipos', 'RANDOM_TRUST_BOOTLOADER', 'is not set')]
l += [KconfigCheck('self_protection', 'clipos', 'RANDOM_TRUST_CPU', 'is not set')]
l += [AND(KconfigCheck('self_protection', 'clipos', 'GCC_PLUGIN_RANDSTRUCT_PERFORMANCE', 'is not set'),
# Calling the CmdlineCheck class constructor:
# CmdlineCheck(reason, decision, name, expected)
- l += [CmdlineCheck('self_protection', 'kspp', 'randomize_kstack_offset', 'on')]
+ if arch in ('X86_64', 'X86_32'):
+ l += [CmdlineCheck('self_protection', 'kspp', 'pti', 'on')]
# TODO: add other
def populate_simple_opt_with_data(opt, data, data_type):
if opt.type == 'complex':
sys.exit('[!] ERROR: unexpected ComplexOptCheck {}: {}'.format(opt.name, vars(opt)))
- if opt.type not in TYPES_OF_CHECKS:
+ if opt.type not in SIMPLE_OPTION_TYPES:
sys.exit('[!] ERROR: invalid opt type "{}" for {}'.format(opt.type, opt.name))
- if data_type not in TYPES_OF_CHECKS:
+ if data_type not in SIMPLE_OPTION_TYPES:
sys.exit('[!] ERROR: invalid data type "{}"'.format(data_type))
if data_type != opt.type:
return
- if data_type == 'kconfig':
+ if data_type in ('kconfig', 'cmdline'):
opt.state = data.get(opt.name, None)
elif data_type == 'version':
opt.ver = data
else:
populate_simple_opt_with_data(o, data, data_type)
else:
- if opt.type != 'kconfig':
+ if opt.type not in ('kconfig', 'cmdline'):
sys.exit('[!] ERROR: bad type "{}" for a simple check {}'.format(opt.type, opt.name))
populate_simple_opt_with_data(opt, data, data_type)
parsed_options[option] = value
+def parse_cmdline_file(parsed_options, fname):
+ with open(fname, 'r') as f:
+ line = f.readline()
+ opts = line.split()
+
+ line = f.readline()
+ if line:
+ sys.exit('[!] ERROR: more than one line in "{}"'.format(fname))
+
+ for opt in opts:
+ if '=' in opt:
+ name, value = opt.split('=', 1)
+ else:
+ name = opt
+ value = '' # '' is not None
+ parsed_options[name] = value
+
+
def main():
# Report modes:
# * verbose mode for
populate_with_data(config_checklist, parsed_kconfig_options, 'kconfig')
populate_with_data(config_checklist, kernel_version, 'version')
+ if args.cmdline:
+ # add relevant cmdline checks to the checklist
+ add_cmdline_checks(config_checklist, arch)
+
+ # populate the checklist with the parsed kconfig data
+ parsed_cmdline_options = OrderedDict()
+ parse_cmdline_file(parsed_cmdline_options, args.cmdline)
+ populate_with_data(config_checklist, parsed_cmdline_options, 'cmdline')
+
# now everything is ready for performing the checks
perform_checks(config_checklist)