X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig-hardened-check.py;h=a1a8de2485c4de8676df5eb40071212ff2c113c6;hb=06932a460eb091d7cb701692a228c73edadba8be;hp=d5215b19f4ddd670efec27d5b414890e31a519dc;hpb=981bd163fa19fccbc5ce5d4182e639d67e484475;p=kconfig-hardened-check.git

diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py
index d5215b1..a1a8de2 100755
--- a/kconfig-hardened-check.py
+++ b/kconfig-hardened-check.py
@@ -11,13 +11,13 @@
 #
 #
 # N.B Hardening command line parameters:
-#    page_poison=1
 #    slub_debug=FZP
 #    slab_nomerge
 #    kernel.kptr_restrict=1
 #    lockdown=1 (is it changed?)
 #    page_alloc.shuffle=1
 #    iommu=force (does it help against DMA attacks?)
+#    page_poison=1 (if enabled)
 #
 #    Mitigations of CPU vulnerabilities:
 #       Аrch-independent:
@@ -186,6 +186,7 @@ def construct_checklist(checklist, arch):
     checklist.append(OR(OptCheck('STRICT_MODULE_RWX',        'y', 'defconfig', 'self_protection'), \
                         OptCheck('DEBUG_SET_MODULE_RONX',    'y', 'defconfig', 'self_protection'), \
                         modules_not_set)) # DEBUG_SET_MODULE_RONX was before v4.11
+    checklist.append(OptCheck('GCC_PLUGINS',                 'y', 'defconfig', 'self_protection'))
     if debug_mode or arch == 'X86_64' or arch == 'X86_32':
         checklist.append(OptCheck('MICROCODE',                   'y', 'defconfig', 'self_protection')) # is needed for mitigating CPU bugs
         checklist.append(OptCheck('RETPOLINE',                   'y', 'defconfig', 'self_protection'))
@@ -225,7 +226,6 @@ def construct_checklist(checklist, arch):
     checklist.append(OptCheck('SLAB_FREELIST_RANDOM',             'y', 'kspp', 'self_protection'))
     checklist.append(OptCheck('SHUFFLE_PAGE_ALLOCATOR',           'y', 'kspp', 'self_protection'))
     checklist.append(OptCheck('FORTIFY_SOURCE',                   'y', 'kspp', 'self_protection'))
-    checklist.append(OptCheck('GCC_PLUGINS',                      'y', 'kspp', 'self_protection'))
     randstruct_is_set = OptCheck('GCC_PLUGIN_RANDSTRUCT',         'y', 'kspp', 'self_protection')
     checklist.append(randstruct_is_set)
     checklist.append(OptCheck('GCC_PLUGIN_LATENT_ENTROPY',        'y', 'kspp', 'self_protection'))
@@ -233,8 +233,6 @@ def construct_checklist(checklist, arch):
     checklist.append(OptCheck('DEBUG_SG',                         'y', 'kspp', 'self_protection'))
     checklist.append(OptCheck('DEBUG_CREDENTIALS',                'y', 'kspp', 'self_protection'))
     checklist.append(OptCheck('DEBUG_NOTIFIERS',                  'y', 'kspp', 'self_protection'))
-    page_poisoning_is_set = OptCheck('PAGE_POISONING',            'y', 'kspp', 'self_protection')
-    checklist.append(page_poisoning_is_set)
     hardened_usercopy_is_set = OptCheck('HARDENED_USERCOPY',      'y', 'kspp', 'self_protection')
     checklist.append(hardened_usercopy_is_set)
     checklist.append(AND(OptCheck('HARDENED_USERCOPY_FALLBACK',   'is not set', 'kspp', 'self_protection'), \
@@ -262,7 +260,8 @@ def construct_checklist(checklist, arch):
     checklist.append(OR(OptCheck('INIT_STACK_ALL',                     'y', 'clipos', 'self_protection'), \
                         OptCheck('GCC_PLUGIN_STRUCTLEAK_BYREF_ALL',    'y', 'kspp', 'self_protection')))
     checklist.append(OptCheck('INIT_ON_ALLOC_DEFAULT_ON',              'y', 'clipos', 'self_protection'))
-    checklist.append(OptCheck('INIT_ON_FREE_DEFAULT_ON',               'y', 'clipos', 'self_protection'))
+    checklist.append(OR(OptCheck('INIT_ON_FREE_DEFAULT_ON',            'y', 'clipos', 'self_protection'), \
+                        OptCheck('PAGE_POISONING',                     'y', 'kspp', 'self_protection')))
     checklist.append(OptCheck('SECURITY_DMESG_RESTRICT',               'y', 'clipos', 'self_protection'))
     checklist.append(OptCheck('DEBUG_VIRTUAL',                         'y', 'clipos', 'self_protection'))
     checklist.append(OptCheck('STATIC_USERMODEHELPER',                 'y', 'clipos', 'self_protection')) # needs userspace support (systemd)
@@ -285,10 +284,6 @@ def construct_checklist(checklist, arch):
 
     checklist.append(OptCheck('SLUB_DEBUG_ON',                      'y', 'my', 'self_protection'))
     checklist.append(OptCheck('RESET_ATTACK_MITIGATION',            'y', 'my', 'self_protection')) # needs userspace support (systemd)
-    checklist.append(AND(OptCheck('PAGE_POISONING_NO_SANITY',       'is not set', 'my', 'self_protection'), \
-                         page_poisoning_is_set))
-    checklist.append(AND(OptCheck('PAGE_POISONING_ZERO',            'is not set', 'my', 'self_protection'), \
-                         page_poisoning_is_set))
     if debug_mode or arch == 'X86_64':
         checklist.append(AND(OptCheck('AMD_IOMMU_V2',                   'y', 'my', 'self_protection'), \
                              iommu_support_is_set))