X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig-hardened-check.py;h=692d1922a3d8c6b635daa540ab7102134f2cbe94;hb=4d3138f62afa719ec5bf696ced214f7342d98dec;hp=c1a48b8be2bc000815d5e947b7b546156b33ec17;hpb=555b588e7b8a620ee57d53ef771e3b128590de45;p=kconfig-hardened-check.git

diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py
index c1a48b8..692d192 100755
--- a/kconfig-hardened-check.py
+++ b/kconfig-hardened-check.py
@@ -26,6 +26,7 @@
 #
 # N.B. Hardening sysctl's:
 #    net.core.bpf_jit_harden
+#    kptr_restrict=2
 
 import sys
 from argparse import ArgumentParser
@@ -128,8 +129,8 @@ class AND(ComplexOptCheck):
                 self.result = opt.result
                 return ret, self.result
             elif not ret:
-                # The requirement is not met. Skip the check.
-                return False, ''
+                self.result = 'FAIL: CONFIG_{} is needed'.format(opt.name)
+                return False, self.result
 
         sys.exit('[!] ERROR: invalid AND check')
 
@@ -191,11 +192,8 @@ def construct_checklist(arch):
     checklist.append(OptCheck('BUG_ON_DATA_CORRUPTION',           'y', 'kspp', 'self_protection'))
     checklist.append(OptCheck('DEBUG_WX',                         'y', 'kspp', 'self_protection'))
     checklist.append(OptCheck('SCHED_STACK_END_CHECK',            'y', 'kspp', 'self_protection'))
-    checklist.append(OptCheck('PAGE_POISONING',                   'y', 'kspp', 'self_protection'))
     checklist.append(OptCheck('SLAB_FREELIST_HARDENED',           'y', 'kspp', 'self_protection'))
     checklist.append(OptCheck('SLAB_FREELIST_RANDOM',             'y', 'kspp', 'self_protection'))
-    checklist.append(OptCheck('HARDENED_USERCOPY',                'y', 'kspp', 'self_protection'))
-    checklist.append(OptCheck('HARDENED_USERCOPY_FALLBACK',       'is not set', 'kspp', 'self_protection'))
     checklist.append(OptCheck('FORTIFY_SOURCE',                   'y', 'kspp', 'self_protection'))
     checklist.append(OptCheck('GCC_PLUGINS',                      'y', 'kspp', 'self_protection'))
     checklist.append(OptCheck('GCC_PLUGIN_RANDSTRUCT',            'y', 'kspp', 'self_protection'))
@@ -206,6 +204,12 @@ def construct_checklist(arch):
     checklist.append(OptCheck('DEBUG_SG',                         'y', 'kspp', 'self_protection'))
     checklist.append(OptCheck('DEBUG_CREDENTIALS',                'y', 'kspp', 'self_protection'))
     checklist.append(OptCheck('DEBUG_NOTIFIERS',                  'y', 'kspp', 'self_protection'))
+    page_poisoning_is_set = OptCheck('PAGE_POISONING',            'y', 'kspp', 'self_protection')
+    checklist.append(page_poisoning_is_set)
+    hardened_usercopy_is_set = OptCheck('HARDENED_USERCOPY',      'y', 'kspp', 'self_protection')
+    checklist.append(hardened_usercopy_is_set)
+    checklist.append(AND(OptCheck('HARDENED_USERCOPY_FALLBACK',   'is not set', 'kspp', 'self_protection'), \
+                         hardened_usercopy_is_set))
     checklist.append(OR(OptCheck('MODULE_SIG',                    'y', 'kspp', 'self_protection'), \
                         modules_not_set))
     checklist.append(OR(OptCheck('MODULE_SIG_ALL',                'y', 'kspp', 'self_protection'), \
@@ -235,11 +239,15 @@ def construct_checklist(arch):
     checklist.append(OptCheck('STATIC_USERMODEHELPER',            'y', 'my', 'self_protection')) # needs userspace support (systemd)
     checklist.append(OptCheck('SECURITY_LOADPIN',                 'y', 'my', 'self_protection')) # needs userspace support
     checklist.append(OptCheck('RESET_ATTACK_MITIGATION',          'y', 'my', 'self_protection')) # needs userspace support (systemd)
-    checklist.append(OptCheck('PAGE_POISONING_NO_SANITY',         'is not set', 'my', 'self_protection'))
-    checklist.append(OptCheck('PAGE_POISONING_ZERO',              'is not set', 'my', 'self_protection'))
     checklist.append(OptCheck('SLAB_MERGE_DEFAULT',               'is not set', 'my', 'self_protection')) # slab_nomerge
+    checklist.append(AND(OptCheck('PAGE_POISONING_NO_SANITY',     'is not set', 'my', 'self_protection'), \
+                         page_poisoning_is_set))
+    checklist.append(AND(OptCheck('PAGE_POISONING_ZERO',          'is not set', 'my', 'self_protection'), \
+                         page_poisoning_is_set))
     if debug_mode or arch == 'X86_32':
         checklist.append(OptCheck('PAGE_TABLE_ISOLATION',         'y', 'my', 'self_protection'))
+    if debug_mode or arch == 'ARM':
+        checklist.append(OptCheck('STACKPROTECTOR_PER_TASK',      'y', 'my', 'self_protection'))
 
     if debug_mode or arch == 'X86_64' or arch == 'ARM64' or arch == 'X86_32':
         checklist.append(OptCheck('SECURITY',                'y', 'defconfig', 'security_policy'))
@@ -315,6 +323,8 @@ def construct_checklist(arch):
     if debug_mode or arch == 'X86_32':
         checklist.append(OptCheck('MODIFY_LDT_SYSCALL', 'is not set', 'my', 'cut_attack_surface'))
 
+    if debug_mode or arch == 'ARM64':
+        checklist.append(OptCheck('ARM64_PTR_AUTH',       'y', 'defconfig', 'userspace_protection'))
     if debug_mode or arch == 'X86_64' or arch == 'ARM64':
         checklist.append(OptCheck('ARCH_MMAP_RND_BITS',   '32', 'my', 'userspace_protection'))
     if debug_mode or arch == 'X86_32' or arch == 'ARM':
@@ -339,9 +349,8 @@ def print_check_results():
         'option name', 'desired val', 'decision', 'reason', 'check result'))
     print('  ' + '=' * 115)
     for opt in checklist:
-        if opt.result:
-            print('  CONFIG_{:<32}|{:^13}|{:^10}|{:^20}||{:^28}'.format(
-                opt.name, opt.expected, opt.decision, opt.reason, opt.result))
+        print('  CONFIG_{:<32}|{:^13}|{:^10}|{:^20}||{:^28}'.format(
+            opt.name, opt.expected, opt.decision, opt.reason, opt.result))
     print()
 
 
@@ -417,14 +426,12 @@ if __name__ == '__main__':
 
         construct_checklist(arch)
         check_config_file(args.config)
-        error_count = len(list(filter(lambda opt: opt.result and opt.result.startswith('FAIL'), checklist)))
+        error_count = len(list(filter(lambda opt: opt.result.startswith('FAIL'), checklist)))
+        ok_count = len(list(filter(lambda opt: opt.result.startswith('OK'), checklist)))
         if debug_mode:
             sys.exit(0)
-        if error_count == 0:
-            print('[+] config check is PASSED')
-            sys.exit(0)
-        else:
-            sys.exit('[-] config check is NOT PASSED: {} errors'.format(error_count))
+        print('[+] config check is finished: \'OK\' - {} / \'FAIL\' - {}'.format(ok_count, error_count))
+        sys.exit(0)
 
     if args.print:
         arch = args.print