# pylint: disable=missing-function-docstring,line-too-long,invalid-name
# pylint: disable=too-many-branches,too-many-statements
-from .engine import KconfigCheck, CmdlineCheck, VersionCheck, OR, AND
+from .engine import KconfigCheck, CmdlineCheck, SysctlCheck, VersionCheck, OR, AND
def add_kconfig_checks(l, arch):
+ assert(arch), 'empty arch'
+
# Calling the KconfigCheck class constructor:
# KconfigCheck(reason, decision, name, expected)
#
def add_cmdline_checks(l, arch):
+ assert(arch), 'empty arch'
+
# Calling the CmdlineCheck class constructor:
# CmdlineCheck(reason, decision, name, expected)
#
l += [CmdlineCheck('self_protection', 'defconfig', 'arm64.nobti', 'is not set')]
l += [CmdlineCheck('self_protection', 'defconfig', 'arm64.nopauth', 'is not set')]
l += [CmdlineCheck('self_protection', 'defconfig', 'arm64.nomte', 'is not set')]
- l += [OR(CmdlineCheck('self_protection', 'defconfig', 'spectre_v2', 'is not off'),
- AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
- CmdlineCheck('self_protection', 'defconfig', 'spectre_v2', 'is not set')))]
- l += [OR(CmdlineCheck('self_protection', 'defconfig', 'spectre_v2_user', 'is not off'),
- AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
- CmdlineCheck('self_protection', 'defconfig', 'spectre_v2_user', 'is not set')))]
- l += [OR(CmdlineCheck('self_protection', 'defconfig', 'spec_store_bypass_disable', 'is not off'),
- AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
- CmdlineCheck('self_protection', 'defconfig', 'spec_store_bypass_disable', 'is not set')))]
- l += [OR(CmdlineCheck('self_protection', 'defconfig', 'l1tf', 'is not off'),
- AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
- CmdlineCheck('self_protection', 'defconfig', 'l1tf', 'is not set')))]
- l += [OR(CmdlineCheck('self_protection', 'defconfig', 'mds', 'is not off'),
- AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
- CmdlineCheck('self_protection', 'defconfig', 'mds', 'is not set')))]
- l += [OR(CmdlineCheck('self_protection', 'defconfig', 'tsx_async_abort', 'is not off'),
- AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
- CmdlineCheck('self_protection', 'defconfig', 'tsx_async_abort', 'is not set')))]
- l += [OR(CmdlineCheck('self_protection', 'defconfig', 'srbds', 'is not off'),
- AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
- CmdlineCheck('self_protection', 'defconfig', 'srbds', 'is not set')))]
- l += [OR(CmdlineCheck('self_protection', 'defconfig', 'mmio_stale_data', 'is not off'),
- AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
- CmdlineCheck('self_protection', 'defconfig', 'mmio_stale_data', 'is not set')))]
- l += [OR(CmdlineCheck('self_protection', 'defconfig', 'retbleed', 'is not off'),
- AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
- CmdlineCheck('self_protection', 'defconfig', 'retbleed', 'is not set')))]
- l += [OR(CmdlineCheck('self_protection', 'defconfig', 'kpti', 'is not off'),
- AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
- CmdlineCheck('self_protection', 'defconfig', 'kpti', 'is not set')))]
+ if arch in ('X86_64', 'X86_32'):
+ l += [OR(CmdlineCheck('self_protection', 'defconfig', 'spectre_v2', 'is not off'),
+ AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+ CmdlineCheck('self_protection', 'defconfig', 'spectre_v2', 'is not set')))]
+ l += [OR(CmdlineCheck('self_protection', 'defconfig', 'spectre_v2_user', 'is not off'),
+ AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+ CmdlineCheck('self_protection', 'defconfig', 'spectre_v2_user', 'is not set')))]
+ l += [OR(CmdlineCheck('self_protection', 'defconfig', 'spec_store_bypass_disable', 'is not off'),
+ AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+ CmdlineCheck('self_protection', 'defconfig', 'spec_store_bypass_disable', 'is not set')))]
+ l += [OR(CmdlineCheck('self_protection', 'defconfig', 'l1tf', 'is not off'),
+ AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+ CmdlineCheck('self_protection', 'defconfig', 'l1tf', 'is not set')))]
+ l += [OR(CmdlineCheck('self_protection', 'defconfig', 'mds', 'is not off'),
+ AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+ CmdlineCheck('self_protection', 'defconfig', 'mds', 'is not set')))]
+ l += [OR(CmdlineCheck('self_protection', 'defconfig', 'tsx_async_abort', 'is not off'),
+ AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+ CmdlineCheck('self_protection', 'defconfig', 'tsx_async_abort', 'is not set')))]
+ l += [OR(CmdlineCheck('self_protection', 'defconfig', 'srbds', 'is not off'),
+ AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+ CmdlineCheck('self_protection', 'defconfig', 'srbds', 'is not set')))]
+ l += [OR(CmdlineCheck('self_protection', 'defconfig', 'mmio_stale_data', 'is not off'),
+ AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+ CmdlineCheck('self_protection', 'defconfig', 'mmio_stale_data', 'is not set')))]
+ l += [OR(CmdlineCheck('self_protection', 'defconfig', 'retbleed', 'is not off'),
+ AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+ CmdlineCheck('self_protection', 'defconfig', 'retbleed', 'is not set')))]
if arch == 'ARM64':
+ l += [OR(CmdlineCheck('self_protection', 'defconfig', 'kpti', 'is not off'),
+ AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+ CmdlineCheck('self_protection', 'defconfig', 'kpti', 'is not set')))]
l += [OR(CmdlineCheck('self_protection', 'defconfig', 'ssbd', 'kernel'),
CmdlineCheck('self_protection', 'my', 'ssbd', 'force-on'),
AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
AND(CmdlineCheck('self_protection', 'kspp', 'page_poison', '1'),
KconfigCheck('self_protection', 'kspp', 'PAGE_POISONING_ZERO', 'y'),
CmdlineCheck('self_protection', 'kspp', 'slub_debug', 'P')))]
- l += [OR(CmdlineCheck('self_protection', 'kspp', 'iommu.strict', '1'),
- AND(KconfigCheck('self_protection', 'kspp', 'IOMMU_DEFAULT_DMA_STRICT', 'y'),
- CmdlineCheck('self_protection', 'kspp', 'iommu.strict', 'is not set')))]
- l += [OR(CmdlineCheck('self_protection', 'kspp', 'iommu.passthrough', '0'),
- AND(KconfigCheck('self_protection', 'kspp', 'IOMMU_DEFAULT_PASSTHROUGH', 'is not set'),
- CmdlineCheck('self_protection', 'kspp', 'iommu.passthrough', 'is not set')))]
# The cmdline checks compatible with the kconfig recommendations of the KSPP project...
l += [OR(CmdlineCheck('self_protection', 'kspp', 'hardened_usercopy', '1'),
AND(KconfigCheck('self_protection', 'kspp', 'HARDENED_USERCOPY', 'y'),
CmdlineCheck('self_protection', 'kspp', 'slab_common.usercopy_fallback', 'is not set')))]
# ... the end
if arch in ('X86_64', 'ARM64', 'X86_32'):
+ l += [OR(CmdlineCheck('self_protection', 'kspp', 'iommu.strict', '1'),
+ AND(KconfigCheck('self_protection', 'kspp', 'IOMMU_DEFAULT_DMA_STRICT', 'y'),
+ CmdlineCheck('self_protection', 'kspp', 'iommu.strict', 'is not set')))]
+ l += [OR(CmdlineCheck('self_protection', 'kspp', 'iommu.passthrough', '0'),
+ AND(KconfigCheck('self_protection', 'kspp', 'IOMMU_DEFAULT_PASSTHROUGH', 'is not set'),
+ CmdlineCheck('self_protection', 'kspp', 'iommu.passthrough', 'is not set')))]
l += [OR(CmdlineCheck('self_protection', 'kspp', 'randomize_kstack_offset', '1'),
AND(KconfigCheck('self_protection', 'kspp', 'RANDOMIZE_KSTACK_OFFSET_DEFAULT', 'y'),
CmdlineCheck('self_protection', 'kspp', 'randomize_kstack_offset', 'is not set')))]
return value
-# def add_sysctl_checks(l, arch):
# TODO: draft of security hardening sysctls:
# kernel.kptr_restrict=2 (or 1?)
-# kernel.dmesg_restrict=1 (also see the kconfig option)
-# kernel.perf_event_paranoid=2 (or 3 with a custom patch, see https://lwn.net/Articles/696216/)
-# kernel.kexec_load_disabled=1
# kernel.yama.ptrace_scope=3
-# user.max_user_namespaces=0 (for Debian, also see kernel.unprivileged_userns_clone)
# what about bpf_jit_enable?
-# kernel.unprivileged_bpf_disabled=1
-# net.core.bpf_jit_harden=2
# vm.unprivileged_userfaultfd=0
# (at first, it disabled unprivileged userfaultfd,
# and since v5.11 it enables unprivileged userfaultfd for user-mode only)
# vm.mmap_min_addr has a good value
-# dev.tty.ldisc_autoload=0
# fs.protected_symlinks=1
# fs.protected_hardlinks=1
# fs.protected_fifos=2
# kernel.oops_limit (think about a proper value)
# kernel.warn_limit (think about a proper value)
# net.ipv4.tcp_syncookies=1 (?)
+
+def add_sysctl_checks(l, arch):
+# This function may be called with arch=None
+
+# Calling the SysctlCheck class constructor:
+# SysctlCheck(reason, decision, name, expected)
+
+ l += [SysctlCheck('self_protection', 'kspp', 'net.core.bpf_jit_harden', '2')]
+
+ l += [SysctlCheck('cut_attack_surface', 'kspp', 'kernel.dmesg_restrict', '1')]
+ l += [SysctlCheck('cut_attack_surface', 'kspp', 'kernel.perf_event_paranoid', '3')] # with a custom patch, see https://lwn.net/Articles/696216/
+ l += [SysctlCheck('cut_attack_surface', 'kspp', 'kernel.kexec_load_disabled', '1')]
+ l += [SysctlCheck('cut_attack_surface', 'kspp', 'user.max_user_namespaces', '0')]
+ l += [SysctlCheck('cut_attack_surface', 'kspp', 'dev.tty.ldisc_autoload', '0')]
+ l += [SysctlCheck('cut_attack_surface', 'kspp', 'kernel.unprivileged_bpf_disabled', '1')]