X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig-hardened-check.py;h=9cdf182f0911061e7295bdf02173300dcee8f32e;hb=bbe10a31b8e16834c77de539fc17e0d52bc8ba62;hp=ec03bf4044aa2cf7314327196a49b01bc94be442;hpb=c3569adf21f32884a1b5beb67f31cc57651b20f4;p=kconfig-hardened-check.git diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py index ec03bf4..9cdf182 100755 --- a/kconfig-hardened-check.py +++ b/kconfig-hardened-check.py @@ -8,13 +8,18 @@ # # Please don't cry if my Python code looks like C. # - +# # N.B Hardening command line parameters: # page_poison=1 -# slub_debug=P +# slub_debug=FZP # slab_nomerge # pti=on # kernel.kptr_restrict=1 +# lockdown=1 +# +# N.B. Hardening sysctl's: +# net.core.bpf_jit_harden +# import sys from argparse import ArgumentParser @@ -97,13 +102,14 @@ class OR: def construct_checklist(): modules_not_set = OptCheck('MODULES', 'is not set', 'kspp', 'cut_attack_surface') - devmem_not_set = OptCheck('DEVMEM', 'is not set', 'kspp', 'cut_attack_surface') + devmem_not_set = OptCheck('DEVMEM', 'is not set', 'kspp', 'cut_attack_surface') # refers to LOCK_DOWN_KERNEL checklist.append(OptCheck('BUG', 'y', 'ubuntu18', 'self_protection')) checklist.append(OptCheck('PAGE_TABLE_ISOLATION', 'y', 'ubuntu18', 'self_protection')) checklist.append(OptCheck('RETPOLINE', 'y', 'ubuntu18', 'self_protection')) checklist.append(OptCheck('X86_64', 'y', 'ubuntu18', 'self_protection')) - checklist.append(OptCheck('STRICT_KERNEL_RWX', 'y', 'ubuntu18', 'self_protection')) + checklist.append(OR(OptCheck('STRICT_KERNEL_RWX', 'y', 'ubuntu18', 'self_protection'), \ + OptCheck('DEBUG_RODATA', 'y', 'before_v4.11', 'self_protection'))) checklist.append(OptCheck('DEBUG_WX', 'y', 'ubuntu18', 'self_protection')) checklist.append(OptCheck('RANDOMIZE_BASE', 'y', 'ubuntu18', 'self_protection')) checklist.append(OptCheck('RANDOMIZE_MEMORY', 'y', 'ubuntu18', 'self_protection')) @@ -117,6 +123,7 @@ def construct_checklist(): checklist.append(OptCheck('SLAB_FREELIST_RANDOM', 'y', 'ubuntu18', 'self_protection')) checklist.append(OptCheck('HARDENED_USERCOPY', 'y', 'ubuntu18', 'self_protection')) checklist.append(OptCheck('FORTIFY_SOURCE', 'y', 'ubuntu18', 'self_protection')) + checklist.append(OptCheck('LOCK_DOWN_KERNEL', 'y', 'ubuntu18', 'self_protection')) # remember about LOCK_DOWN_MANDATORY checklist.append(OR(OptCheck('STRICT_MODULE_RWX', 'y', 'ubuntu18', 'self_protection'), \ OptCheck('DEBUG_SET_MODULE_RONX', 'y', 'before_v4.11', 'self_protection'), \ modules_not_set)) @@ -141,7 +148,7 @@ def construct_checklist(): checklist.append(OptCheck('DEBUG_SG', 'y', 'kspp', 'self_protection')) checklist.append(OptCheck('DEBUG_CREDENTIALS', 'y', 'kspp', 'self_protection')) checklist.append(OptCheck('DEBUG_NOTIFIERS', 'y', 'kspp', 'self_protection')) - checklist.append(OptCheck('MODULE_SIG_FORCE', 'y', 'kspp', 'self_protection')) + checklist.append(OptCheck('MODULE_SIG_FORCE', 'y', 'kspp', 'self_protection')) # refers to LOCK_DOWN_KERNEL checklist.append(OptCheck('HARDENED_USERCOPY_FALLBACK', 'is not set', 'kspp', 'self_protection')) checklist.append(OptCheck('GCC_PLUGIN_STACKLEAK', 'y', 'my', 'self_protection')) @@ -150,6 +157,7 @@ def construct_checklist(): checklist.append(OptCheck('STATIC_USERMODEHELPER', 'y', 'my', 'self_protection')) # breaks systemd? checklist.append(OptCheck('PAGE_POISONING_NO_SANITY', 'is not set', 'my', 'self_protection')) checklist.append(OptCheck('PAGE_POISONING_ZERO', 'is not set', 'my', 'self_protection')) + checklist.append(OptCheck('SLAB_MERGE_DEFAULT', 'is not set', 'my', 'self_protection')) # slab_nomerge checklist.append(OptCheck('SECURITY', 'y', 'ubuntu18', 'security_policy')) checklist.append(OptCheck('SECURITY_YAMA', 'y', 'ubuntu18', 'security_policy')) @@ -158,8 +166,8 @@ def construct_checklist(): checklist.append(OptCheck('SECCOMP', 'y', 'ubuntu18', 'cut_attack_surface')) checklist.append(OptCheck('SECCOMP_FILTER', 'y', 'ubuntu18', 'cut_attack_surface')) checklist.append(OR(OptCheck('STRICT_DEVMEM', 'y', 'ubuntu18', 'cut_attack_surface'), \ - devmem_not_set)) - checklist.append(OptCheck('ACPI_CUSTOM_METHOD', 'is not set', 'ubuntu18', 'cut_attack_surface')) + devmem_not_set)) # refers to LOCK_DOWN_KERNEL + checklist.append(OptCheck('ACPI_CUSTOM_METHOD', 'is not set', 'ubuntu18', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL checklist.append(OptCheck('COMPAT_BRK', 'is not set', 'ubuntu18', 'cut_attack_surface')) checklist.append(OptCheck('DEVKMEM', 'is not set', 'ubuntu18', 'cut_attack_surface')) checklist.append(OptCheck('COMPAT_VDSO', 'is not set', 'ubuntu18', 'cut_attack_surface')) @@ -168,21 +176,22 @@ def construct_checklist(): checklist.append(OptCheck('PAGE_OWNER', 'is not set', 'ubuntu18', 'cut_attack_surface')) checklist.append(OptCheck('DEBUG_KMEMLEAK', 'is not set', 'ubuntu18', 'cut_attack_surface')) checklist.append(OptCheck('BINFMT_AOUT', 'is not set', 'ubuntu18', 'cut_attack_surface')) + checklist.append(OptCheck('MMIOTRACE_TEST', 'is not set', 'ubuntu18', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL checklist.append(OR(OptCheck('IO_STRICT_DEVMEM', 'y', 'kspp', 'cut_attack_surface'), \ - devmem_not_set)) + devmem_not_set)) # refers to LOCK_DOWN_KERNEL checklist.append(OptCheck('LEGACY_VSYSCALL_NONE', 'y', 'kspp', 'cut_attack_surface')) # 'vsyscall=none' checklist.append(OptCheck('BINFMT_MISC', 'is not set', 'kspp', 'cut_attack_surface')) checklist.append(OptCheck('INET_DIAG', 'is not set', 'kspp', 'cut_attack_surface')) - checklist.append(OptCheck('KEXEC', 'is not set', 'kspp', 'cut_attack_surface')) - checklist.append(OptCheck('PROC_KCORE', 'is not set', 'kspp', 'cut_attack_surface')) + checklist.append(OptCheck('KEXEC', 'is not set', 'kspp', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL + checklist.append(OptCheck('PROC_KCORE', 'is not set', 'kspp', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL checklist.append(OptCheck('LEGACY_PTYS', 'is not set', 'kspp', 'cut_attack_surface')) checklist.append(OptCheck('IA32_EMULATION', 'is not set', 'kspp', 'cut_attack_surface')) checklist.append(OptCheck('X86_X32', 'is not set', 'kspp', 'cut_attack_surface')) checklist.append(OptCheck('MODIFY_LDT_SYSCALL', 'is not set', 'kspp', 'cut_attack_surface')) - checklist.append(OptCheck('HIBERNATION', 'is not set', 'kspp', 'cut_attack_surface')) + checklist.append(OptCheck('HIBERNATION', 'is not set', 'kspp', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL - checklist.append(OptCheck('KPROBES', 'is not set', 'grsecurity', 'cut_attack_surface')) + checklist.append(OptCheck('KPROBES', 'is not set', 'grsecurity', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL checklist.append(OptCheck('UPROBES', 'is not set', 'grsecurity', 'cut_attack_surface')) checklist.append(OptCheck('GENERIC_TRACER', 'is not set', 'grsecurity', 'cut_attack_surface')) checklist.append(OptCheck('PROC_VMCORE', 'is not set', 'grsecurity', 'cut_attack_surface')) @@ -192,19 +201,23 @@ def construct_checklist(): checklist.append(OptCheck('USERFAULTFD', 'is not set', 'grsecurity', 'cut_attack_surface')) checklist.append(OptCheck('HWPOISON_INJECT', 'is not set', 'grsecurity', 'cut_attack_surface')) checklist.append(OptCheck('MEM_SOFT_DIRTY', 'is not set', 'grsecurity', 'cut_attack_surface')) - checklist.append(OptCheck('DEVPORT', 'is not set', 'grsecurity', 'cut_attack_surface')) - checklist.append(OptCheck('DEBUG_FS', 'is not set', 'grsecurity', 'cut_attack_surface')) + checklist.append(OptCheck('DEVPORT', 'is not set', 'grsecurity', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL + checklist.append(OptCheck('DEBUG_FS', 'is not set', 'grsecurity', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL checklist.append(OptCheck('NOTIFIER_ERROR_INJECTION','is not set', 'grsecurity', 'cut_attack_surface')) - checklist.append(OptCheck('KEXEC_FILE', 'is not set', 'my', 'cut_attack_surface')) + checklist.append(OptCheck('ACPI_TABLE_UPGRADE', 'is not set', 'lockdown', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL + checklist.append(OptCheck('ACPI_APEI_EINJ', 'is not set', 'lockdown', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL + checklist.append(OptCheck('PROFILING', 'is not set', 'lockdown', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL + checklist.append(OptCheck('BPF_SYSCALL', 'is not set', 'lockdown', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL + + checklist.append(OptCheck('MMIOTRACE', 'is not set', 'my', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL (permissive) + checklist.append(OptCheck('KEXEC_FILE', 'is not set', 'my', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL (permissive) checklist.append(OptCheck('LIVEPATCH', 'is not set', 'my', 'cut_attack_surface')) checklist.append(OptCheck('USER_NS', 'is not set', 'my', 'cut_attack_surface')) # user.max_user_namespaces=0 checklist.append(OptCheck('IP_DCCP', 'is not set', 'my', 'cut_attack_surface')) checklist.append(OptCheck('IP_SCTP', 'is not set', 'my', 'cut_attack_surface')) checklist.append(OptCheck('FTRACE', 'is not set', 'my', 'cut_attack_surface')) - checklist.append(OptCheck('PROFILING', 'is not set', 'my', 'cut_attack_surface')) checklist.append(OptCheck('BPF_JIT', 'is not set', 'my', 'cut_attack_surface')) - checklist.append(OptCheck('BPF_SYSCALL', 'is not set', 'my', 'cut_attack_surface')) checklist.append(OptCheck('ARCH_MMAP_RND_BITS', '32', 'my', 'userspace_protection')) @@ -213,23 +226,27 @@ def construct_checklist(): def print_checklist(): print('[+] Printing kernel hardening preferences...') - print(' {:<39}|{:^13}|{:^10}|{:^20}'.format('option name', 'desired val', 'decision', 'reason')) - print(' ======================================================================================') + print(' {:<39}|{:^13}|{:^10}|{:^20}'.format( + 'option name', 'desired val', 'decision', 'reason')) + print(' ' + '=' * 86) for opt in checklist: - print(' CONFIG_{:<32}|{:^13}|{:^10}|{:^20}'.format(opt.name, opt.expected, opt.decision, opt.reason)) + print(' CONFIG_{:<32}|{:^13}|{:^10}|{:^20}'.format( + opt.name, opt.expected, opt.decision, opt.reason)) print() def print_check_results(): - print(' {:<39}|{:^13}|{:^10}|{:^20}||{:^28}'.format('option name', 'desired val', 'decision', 'reason', 'check result')) - print(' ===================================================================================================================') + print(' {:<39}|{:^13}|{:^10}|{:^20}||{:^28}'.format( + 'option name', 'desired val', 'decision', 'reason', 'check result')) + print(' ' + '=' * 115) for opt in checklist: - print(' CONFIG_{:<32}|{:^13}|{:^10}|{:^20}||{:^28}'.format(opt.name, opt.expected, opt.decision, opt.reason, opt.result)) + print(' CONFIG_{:<32}|{:^13}|{:^10}|{:^20}||{:^28}'.format( + opt.name, opt.expected, opt.decision, opt.reason, opt.result)) print() def get_option_state(options, name): - return options[name] if name in options else None + return options.get(name, None) def perform_checks(parsed_options):