# init_on_free=1 (since v5.3, otherwise slub_debug=P and page_poison=1)
# loadpin.enforce=1
# debugfs=no-mount (or off if possible)
-# randomize_kstack_offset=1
#
# Mitigations of CPU vulnerabilities:
# Аrch-independent:
import json
from .__about__ import __version__
-TYPES_OF_CHECKS = ('kconfig', 'version')
+SIMPLE_OPTION_TYPES = ('kconfig', 'version', 'cmdline')
class OptCheck:
# Constructor without the 'expected' parameter is for option presence checks (any value is OK)
if arch in ('X86_64', 'ARM64', 'X86_32'):
stackleak_is_set = KconfigCheck('self_protection', 'kspp', 'GCC_PLUGIN_STACKLEAK', 'y')
l += [stackleak_is_set]
- l += [KconfigCheck('self_protection', 'kspp', 'RANDOMIZE_KSTACK_OFFSET_DEFAULT', 'y')]
+ l += [OR(KconfigCheck('self_protection', 'kspp', 'RANDOMIZE_KSTACK_OFFSET_DEFAULT', 'y'),
+ CmdlineCheck('self_protection', 'kspp', 'randomize_kstack_offset', '1'))]
if arch in ('X86_64', 'X86_32'):
l += [KconfigCheck('self_protection', 'kspp', 'SCHED_CORE', 'y')]
l += [KconfigCheck('self_protection', 'kspp', 'DEFAULT_MMAP_MIN_ADDR', '65536')]
# Calling the CmdlineCheck class constructor:
# CmdlineCheck(reason, decision, name, expected)
- l += [CmdlineCheck('self_protection', 'kspp', 'randomize_kstack_offset', 'on')]
# TODO: add other
def populate_simple_opt_with_data(opt, data, data_type):
if opt.type == 'complex':
sys.exit('[!] ERROR: unexpected ComplexOptCheck {}: {}'.format(opt.name, vars(opt)))
- if opt.type not in TYPES_OF_CHECKS:
+ if opt.type not in SIMPLE_OPTION_TYPES:
sys.exit('[!] ERROR: invalid opt type "{}" for {}'.format(opt.type, opt.name))
- if data_type not in TYPES_OF_CHECKS:
+ if data_type not in SIMPLE_OPTION_TYPES:
sys.exit('[!] ERROR: invalid data type "{}"'.format(data_type))
if data_type != opt.type:
return
- if data_type == 'kconfig':
+ if data_type in ('kconfig', 'cmdline'):
opt.state = data.get(opt.name, None)
elif data_type == 'version':
opt.ver = data
else:
populate_simple_opt_with_data(o, data, data_type)
else:
- if opt.type != 'kconfig':
+ if opt.type not in ('kconfig', 'cmdline'):
sys.exit('[!] ERROR: bad type "{}" for a simple check {}'.format(opt.type, opt.name))
populate_simple_opt_with_data(opt, data, data_type)
parsed_options[option] = value
+def parse_cmdline_file(parsed_options, fname):
+ with open(fname, 'r') as f:
+ line = f.readline()
+ opts = line.split()
+
+ line = f.readline()
+ if line:
+ sys.exit('[!] ERROR: more than one line in "{}"'.format(fname))
+
+ for opt in opts:
+ if '=' in opt:
+ name, value = opt.split('=', 1)
+ else:
+ name = opt
+ value = '' # '' is not None
+ parsed_options[name] = value
+
+
def main():
# Report modes:
# * verbose mode for
populate_with_data(config_checklist, parsed_kconfig_options, 'kconfig')
populate_with_data(config_checklist, kernel_version, 'version')
+ if args.cmdline:
+ # add relevant cmdline checks to the checklist
+ add_cmdline_checks(config_checklist, arch)
+
+ # populate the checklist with the parsed kconfig data
+ parsed_cmdline_options = OrderedDict()
+ parse_cmdline_file(parsed_cmdline_options, args.cmdline)
+ populate_with_data(config_checklist, parsed_cmdline_options, 'cmdline')
+
# now everything is ready for performing the checks
perform_checks(config_checklist)