X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig-hardened-check.py;h=26afc40324ce39dec03bf0f77ebc9d756a5d9432;hb=07687dfb97c20dbb80948cc059029165b3689df3;hp=b149567fb1317d64eaada195e01e49bfe264c49d;hpb=becad4962ffd613aabcf8a317b2c779ff95d4545;p=kconfig-hardened-check.git

diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py
index b149567..26afc40 100755
--- a/kconfig-hardened-check.py
+++ b/kconfig-hardened-check.py
@@ -18,14 +18,23 @@
 #    kernel.kptr_restrict=1
 #    lockdown=1
 #
-#    spectre_v2=on
-#    pti=on
-#    spec_store_bypass_disable=on
-#    l1tf=full,force
-#
+#    Mitigations of CPU vulnerabilities:
+#       Аrch-independent:
+#           mitigations=auto,nosmt
+#       X86:
+#           spectre_v2=on
+#           pti=on
+#           spec_store_bypass_disable=on
+#           l1tf=full,force
+#           mds=full,nosmt
+#       ARM64:
+#           ? CONFIG_HARDEN_BRANCH_PREDICTOR
+#           kpti=on
+#           ssbd=force-on
 #
 # N.B. Hardening sysctl's:
 #    net.core.bpf_jit_harden
+#    kptr_restrict=2
 
 import sys
 from argparse import ArgumentParser
@@ -322,6 +331,8 @@ def construct_checklist(arch):
     if debug_mode or arch == 'X86_32':
         checklist.append(OptCheck('MODIFY_LDT_SYSCALL', 'is not set', 'my', 'cut_attack_surface'))
 
+    if debug_mode or arch == 'ARM64':
+        checklist.append(OptCheck('ARM64_PTR_AUTH',       'y', 'defconfig', 'userspace_protection'))
     if debug_mode or arch == 'X86_64' or arch == 'ARM64':
         checklist.append(OptCheck('ARCH_MMAP_RND_BITS',   '32', 'my', 'userspace_protection'))
     if debug_mode or arch == 'X86_32' or arch == 'ARM':
@@ -332,21 +343,21 @@ def construct_checklist(arch):
 
 def print_checklist(arch):
     print('[+] Printing kernel hardening preferences for {}...'.format(arch))
-    print('  {:<39}|{:^13}|{:^10}|{:^20}'.format(
+    print('{:^40}|{:^13}|{:^10}|{:^20}'.format(
         'option name', 'desired val', 'decision', 'reason'))
-    print('  ' + '=' * 86)
+    print('=' * 87)
     for opt in checklist:
-        print('  CONFIG_{:<32}|{:^13}|{:^10}|{:^20}'.format(
+        print('CONFIG_{:<33}|{:^13}|{:^10}|{:^20}'.format(
             opt.name, opt.expected, opt.decision, opt.reason))
     print()
 
 
 def print_check_results():
-    print('  {:<39}|{:^13}|{:^10}|{:^20}||{:^28}'.format(
+    print('{:^40}|{:^13}|{:^10}|{:^20}||{:^28}'.format(
         'option name', 'desired val', 'decision', 'reason', 'check result'))
-    print('  ' + '=' * 115)
+    print('=' * 116)
     for opt in checklist:
-        print('  CONFIG_{:<32}|{:^13}|{:^10}|{:^20}||{:^28}'.format(
+        print('CONFIG_{:<33}|{:^13}|{:^10}|{:^20}||{:^28}'.format(
             opt.name, opt.expected, opt.decision, opt.reason, opt.result))
     print()