X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig-hardened-check.py;h=975c87446ff764b0059a1bb02c0445cc591b2866;hb=03115ad11d4349cc834598c2b5954d662303a620;hp=90e61e70056a81b9e8287bf176049eb7af86d789;hpb=4de80103b72ee3d7842b032c5513ab1aee5b6129;p=kconfig-hardened-check.git

diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py
index 90e61e7..975c874 100755
--- a/kconfig-hardened-check.py
+++ b/kconfig-hardened-check.py
@@ -14,9 +14,10 @@
 #    page_poison=1
 #    slub_debug=FZP
 #    slab_nomerge
-#    pti=on
 #    kernel.kptr_restrict=1
-#    lockdown=1
+#    lockdown=1 (is it changed?)
+#    page_alloc.shuffle=1
+#    iommu=force (does it help against DMA attacks?)
 #
 #    Mitigations of CPU vulnerabilities:
 #       Аrch-independent:
@@ -185,15 +186,22 @@ def construct_checklist(checklist, arch):
     checklist.append(OR(OptCheck('STRICT_MODULE_RWX',        'y', 'defconfig', 'self_protection'), \
                         OptCheck('DEBUG_SET_MODULE_RONX',    'y', 'defconfig', 'self_protection'), \
                         modules_not_set)) # DEBUG_SET_MODULE_RONX was before v4.11
-    if debug_mode or arch == 'X86_64':
-        checklist.append(OptCheck('PAGE_TABLE_ISOLATION',        'y', 'defconfig', 'self_protection'))
-        checklist.append(OptCheck('RANDOMIZE_MEMORY',            'y', 'defconfig', 'self_protection'))
     if debug_mode or arch == 'X86_64' or arch == 'X86_32':
-        checklist.append(OptCheck('RANDOMIZE_BASE',              'y', 'defconfig', 'self_protection'))
+        checklist.append(OptCheck('MICROCODE',                   'y', 'defconfig', 'self_protection')) # is needed for mitigating CPU bugs
         checklist.append(OptCheck('RETPOLINE',                   'y', 'defconfig', 'self_protection'))
         checklist.append(OptCheck('X86_SMAP',                    'y', 'defconfig', 'self_protection'))
-        checklist.append(OptCheck('X86_INTEL_UMIP',              'y', 'defconfig', 'self_protection'))
+        checklist.append(OR(OptCheck('X86_UMIP',                 'y', 'defconfig', 'self_protection'), \
+                            OptCheck('X86_INTEL_UMIP',           'y', 'defconfig', 'self_protection')))
+        iommu_support_is_set = OptCheck('IOMMU_SUPPORT',         'y', 'defconfig', 'self_protection') # is needed for mitigating DMA attacks
+        checklist.append(iommu_support_is_set)
         checklist.append(OptCheck('SYN_COOKIES',                 'y', 'defconfig', 'self_protection')) # another reason?
+    if debug_mode or arch == 'X86_64':
+        checklist.append(OptCheck('PAGE_TABLE_ISOLATION',        'y', 'defconfig', 'self_protection'))
+        checklist.append(OptCheck('RANDOMIZE_MEMORY',            'y', 'defconfig', 'self_protection'))
+        checklist.append(AND(OptCheck('INTEL_IOMMU',             'y', 'defconfig', 'self_protection'), \
+                             iommu_support_is_set))
+        checklist.append(AND(OptCheck('AMD_IOMMU',               'y', 'defconfig', 'self_protection'), \
+                             iommu_support_is_set))
     if debug_mode or arch == 'ARM64':
         checklist.append(OptCheck('UNMAP_KERNEL_AT_EL0',         'y', 'defconfig', 'self_protection'))
         checklist.append(OptCheck('HARDEN_EL2_VECTORS',          'y', 'defconfig', 'self_protection'))
@@ -201,6 +209,7 @@ def construct_checklist(checklist, arch):
     if debug_mode or arch == 'X86_64' or arch == 'ARM64':
         checklist.append(OptCheck('VMAP_STACK',                  'y', 'defconfig', 'self_protection'))
     if debug_mode or arch == 'X86_64' or arch == 'ARM64' or arch == 'X86_32':
+        checklist.append(OptCheck('RANDOMIZE_BASE',              'y', 'defconfig', 'self_protection'))
         checklist.append(OptCheck('THREAD_INFO_IN_TASK',         'y', 'defconfig', 'self_protection'))
     if debug_mode or arch == 'ARM':
         checklist.append(OptCheck('VMSPLIT_3G',                  'y', 'defconfig', 'self_protection'))
@@ -246,7 +255,6 @@ def construct_checklist(checklist, arch):
         checklist.append(OptCheck('X86_PAE',                          'y', 'kspp', 'self_protection'))
     if debug_mode or arch == 'ARM64':
         checklist.append(OptCheck('ARM64_SW_TTBR0_PAN',               'y', 'kspp', 'self_protection'))
-        checklist.append(OptCheck('RANDOMIZE_BASE',                   'y', 'kspp', 'self_protection'))
     if debug_mode or arch == 'ARM64' or arch == 'ARM':
         checklist.append(OptCheck('SYN_COOKIES',                      'y', 'kspp', 'self_protection')) # another reason?
         checklist.append(OptCheck('DEFAULT_MMAP_MIN_ADDR',            '32768', 'kspp', 'self_protection'))
@@ -270,11 +278,6 @@ def construct_checklist(checklist, arch):
                              stackleak_is_set))
     if debug_mode or arch == 'X86_64' or arch == 'X86_32':
         checklist.append(OptCheck('RANDOM_TRUST_CPU',                      'is not set', 'clipos', 'self_protection'))
-        checklist.append(OptCheck('MICROCODE',                             'y', 'clipos', 'self_protection')) # is needed for mitigating CPU bugs
-        iommu_support_is_set = OptCheck('IOMMU_SUPPORT',                   'y', 'clipos', 'self_protection') # is needed for mitigating DMA attacks
-        checklist.append(iommu_support_is_set)
-        checklist.append(AND(OptCheck('INTEL_IOMMU',                       'y', 'clipos', 'self_protection'), \
-                             iommu_support_is_set))
         checklist.append(AND(OptCheck('INTEL_IOMMU_SVM',                   'y', 'clipos', 'self_protection'), \
                              iommu_support_is_set))
         checklist.append(AND(OptCheck('INTEL_IOMMU_DEFAULT_ON',            'y', 'clipos', 'self_protection'), \
@@ -287,8 +290,6 @@ def construct_checklist(checklist, arch):
     checklist.append(AND(OptCheck('PAGE_POISONING_ZERO',            'is not set', 'my', 'self_protection'), \
                          page_poisoning_is_set))
     if debug_mode or arch == 'X86_64':
-        checklist.append(AND(OptCheck('AMD_IOMMU',                      'y', 'my', 'self_protection'), \
-                             iommu_support_is_set))
         checklist.append(AND(OptCheck('AMD_IOMMU_V2',                   'y', 'my', 'self_protection'), \
                              iommu_support_is_set))
     if debug_mode or arch == 'X86_32':