json_mode = False # if True, print results in JSON format
supported_archs = [ 'X86_64', 'X86_32', 'ARM64', 'ARM' ]
+config_checklist = []
+kernel_version = None
class OptCheck:
return '{} = {}'.format(self.name, self.state)
+class VerCheck:
+ def __init__(self, ver_expected):
+ self.ver_expected = ver_expected
+ self.result = None
+
+ def check(self):
+ if kernel_version[0] > self.ver_expected[0]:
+ self.result = 'OK: version >= ' + str(self.ver_expected[0]) + '.' + str(self.ver_expected[1])
+ return True, self.result
+ if kernel_version[0] < self.ver_expected[0]:
+ self.result = 'FAIL: version < ' + str(self.ver_expected[0]) + '.' + str(self.ver_expected[1])
+ return False, self.result
+ if kernel_version[1] >= self.ver_expected[1]:
+ self.result = 'OK: version >= ' + str(self.ver_expected[0]) + '.' + str(self.ver_expected[1])
+ return True, self.result
+ else:
+ self.result = 'FAIL: version < ' + str(self.ver_expected[0]) + '.' + str(self.ver_expected[1])
+ return False, self.result
+
+
class ComplexOptCheck:
def __init__(self, *opts):
self.opts = opts
for i, opt in enumerate(self.opts):
ret, msg = opt.check()
if ret:
- if i == 0:
+ if i == 0 or not hasattr(opt, 'name'):
self.result = opt.result
else:
self.result = 'OK: CONFIG_{} "{}"'.format(opt.name, opt.expected)
self.result = opt.result
return ret, self.result
elif not ret:
- self.result = 'FAIL: CONFIG_{} is needed'.format(opt.name)
+ if hasattr(opt, 'name'):
+ self.result = 'FAIL: CONFIG_{} is needed'.format(opt.name)
+ else:
+ self.result = opt.result
return False, self.result
sys.exit('[!] ERROR: invalid AND check')
with open(fname, 'r') as f:
arch_pattern = re.compile("CONFIG_[a-zA-Z0-9_]*=y")
arch = None
- msg = None
if not json_mode:
print('[+] Trying to detect architecture in "{}"...'.format(fname))
for line in f.readlines():
return arch, 'OK'
+def detect_version(fname):
+ with open(fname, 'r') as f:
+ ver_pattern = re.compile("# Linux/.* Kernel Configuration")
+ if not json_mode:
+ print('[+] Trying to detect kernel version in "{}"...'.format(fname))
+ for line in f.readlines():
+ if ver_pattern.match(line):
+ line = line.strip()
+ if not json_mode:
+ print('[+] Found version line: "{}"'.format(line))
+ parts = line.split()
+ ver_str = parts[2]
+ ver_numbers = ver_str.split('.')
+ if len(ver_numbers) < 3 or not ver_numbers[0].isdigit() or not ver_numbers[1].isdigit():
+ msg = 'failed to parse the version "' + ver_str + '"'
+ return None, msg
+ else:
+ return (int(ver_numbers[0]), int(ver_numbers[1])), None
+ return None, 'no kernel version detected'
+
+
def construct_checklist(checklist, arch):
modules_not_set = OptCheck('MODULES', 'is not set', 'kspp', 'cut_attack_surface')
devmem_not_set = OptCheck('DEVMEM', 'is not set', 'kspp', 'cut_attack_surface') # refers to LOCK_DOWN_KERNEL
if debug_mode or arch == 'ARM':
checklist.append(OptCheck('VMSPLIT_3G', 'y', 'defconfig', 'self_protection'))
checklist.append(OptCheck('CPU_SW_DOMAIN_PAN', 'y', 'defconfig', 'self_protection'))
+ checklist.append(OptCheck('STACKPROTECTOR_PER_TASK', 'y', 'defconfig', 'self_protection'))
if debug_mode or arch == 'ARM64' or arch == 'ARM':
checklist.append(OptCheck('REFCOUNT_FULL', 'y', 'defconfig', 'self_protection'))
checklist.append(OptCheck('HARDEN_BRANCH_PREDICTOR', 'y', 'defconfig', 'self_protection'))
iommu_support_is_set))
if debug_mode or arch == 'X86_32':
checklist.append(OptCheck('PAGE_TABLE_ISOLATION', 'y', 'my', 'self_protection'))
- if debug_mode or arch == 'ARM':
- checklist.append(OptCheck('STACKPROTECTOR_PER_TASK', 'y', 'my', 'self_protection'))
if debug_mode or arch == 'X86_64' or arch == 'ARM64' or arch == 'X86_32':
checklist.append(OptCheck('SECURITY', 'y', 'defconfig', 'security_policy')) # and choose your favourite LSM
print()
-def get_option_state(options, name):
- return options.get(name, None)
-
-
def perform_checks(checklist, parsed_options):
for opt in checklist:
if hasattr(opt, 'opts'):
+ # prepare ComplexOptCheck
for o in opt.opts:
- o.state = get_option_state(parsed_options, o.name)
+ if hasattr(o, 'name'):
+ o.state = parsed_options.get(o.name, None)
else:
- opt.state = get_option_state(parsed_options, opt.name)
+ # prepare simple OptCheck
+ if not hasattr(opt, 'name'):
+ sys.exit('[!] ERROR: bad OptCheck {}'.format(vars(opt)))
+ opt.state = parsed_options.get(opt.name, None)
opt.check()
if __name__ == '__main__':
- config_checklist = []
-
parser = ArgumentParser(description='Checks the hardening options in the Linux kernel config')
parser.add_argument('-p', '--print', choices=supported_archs,
help='print hardening preferences for selected architecture')
elif not json_mode:
print('[+] Detected architecture: {}'.format(arch))
+ kernel_version, msg = detect_version(args.config)
+ if not kernel_version:
+ sys.exit('[!] ERROR: {}'.format(msg))
+ elif not json_mode:
+ print('[+] Detected kernel version: {}.{}'.format(kernel_version[0], kernel_version[1]))
+
construct_checklist(config_checklist, arch)
check_config_file(config_checklist, args.config)
error_count = len(list(filter(lambda opt: opt.result.startswith('FAIL'), config_checklist)))
projects / kconfig-hardened-check.git / blobdiff