X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig-hardened-check.py;h=c1a48b8be2bc000815d5e947b7b546156b33ec17;hb=555b588e7b8a620ee57d53ef771e3b128590de45;hp=3ed0f9e9c1cf26a8e4dff19f19ab09a407c9abf8;hpb=60a83b77a98aeb52dd1cb262febee0e15a99f302;p=kconfig-hardened-check.git

diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py
index 3ed0f9e..c1a48b8 100755
--- a/kconfig-hardened-check.py
+++ b/kconfig-hardened-check.py
@@ -68,14 +68,11 @@ class OptCheck:
         return '{} = {}'.format(self.name, self.state)
 
 
-class OR:
+class ComplexOptCheck:
     def __init__(self, *opts):
         self.opts = opts
         self.result = None
 
-    # self.opts[0] is the option which this OR-check is about.
-    # Use case: OR(<X_is_hardened>, <X_is_disabled>)
-
     @property
     def name(self):
         return self.opts[0].name
@@ -96,19 +93,47 @@ class OR:
     def reason(self):
         return self.opts[0].reason
 
+
+class OR(ComplexOptCheck):
+    # self.opts[0] is the option which this OR-check is about.
+    # Use case:
+    #     OR(<X_is_hardened>, <X_is_disabled>)
+    #     OR(<X_is_hardened>, <X_is_hardened_old>)
+
     def check(self):
+        if not self.opts:
+            sys.exit('[!] ERROR: invalid OR check')
+
         for i, opt in enumerate(self.opts):
-            result, msg = opt.check()
-            if result:
+            ret, msg = opt.check()
+            if ret:
                 if i == 0:
                     self.result = opt.result
                 else:
-                    self.result = 'CONFIG_{}: {} ("{}")'.format(opt.name, opt.result, opt.expected)
+                    self.result = 'OK: CONFIG_{} "{}"'.format(opt.name, opt.expected)
                 return True, self.result
         self.result = self.opts[0].result
         return False, self.result
 
 
+class AND(ComplexOptCheck):
+    # self.opts[0] is the option which this AND-check is about.
+    # Use case: AND(<suboption>, <main_option>)
+    # Suboption is not checked if checking of the main_option is failed.
+
+    def check(self):
+        for i, opt in reversed(list(enumerate(self.opts))):
+            ret, msg = opt.check()
+            if i == 0:
+                self.result = opt.result
+                return ret, self.result
+            elif not ret:
+                # The requirement is not met. Skip the check.
+                return False, ''
+
+        sys.exit('[!] ERROR: invalid AND check')
+
+
 def detect_arch(fname):
     with open(fname, 'r') as f:
         arch_pattern = re.compile("CONFIG_[a-zA-Z0-9_]*=y")
@@ -187,7 +212,8 @@ def construct_checklist(arch):
                         modules_not_set))
     checklist.append(OR(OptCheck('MODULE_SIG_SHA512',             'y', 'kspp', 'self_protection'), \
                         modules_not_set))
-    checklist.append(OptCheck('MODULE_SIG_FORCE',                 'y', 'kspp', 'self_protection')) # refers to LOCK_DOWN_KERNEL
+    checklist.append(OR(OptCheck('MODULE_SIG_FORCE',              'y', 'kspp', 'self_protection'), \
+                        modules_not_set)) # refers to LOCK_DOWN_KERNEL
     if debug_mode or arch == 'X86_64' or arch == 'X86_32':
         checklist.append(OptCheck('DEFAULT_MMAP_MIN_ADDR',        '65536', 'kspp', 'self_protection'))
         checklist.append(OptCheck('REFCOUNT_FULL',                'y', 'kspp', 'self_protection'))
@@ -206,8 +232,9 @@ def construct_checklist(arch):
     checklist.append(OptCheck('LOCK_DOWN_KERNEL',                 'y', 'my', 'self_protection')) # remember about LOCK_DOWN_MANDATORY
     checklist.append(OptCheck('SLUB_DEBUG_ON',                    'y', 'my', 'self_protection'))
     checklist.append(OptCheck('SECURITY_DMESG_RESTRICT',          'y', 'my', 'self_protection'))
-    checklist.append(OptCheck('STATIC_USERMODEHELPER',            'y', 'my', 'self_protection')) # breaks systemd?
-    checklist.append(OptCheck('SECURITY_LOADPIN',                 'y', 'my', 'self_protection'))
+    checklist.append(OptCheck('STATIC_USERMODEHELPER',            'y', 'my', 'self_protection')) # needs userspace support (systemd)
+    checklist.append(OptCheck('SECURITY_LOADPIN',                 'y', 'my', 'self_protection')) # needs userspace support
+    checklist.append(OptCheck('RESET_ATTACK_MITIGATION',          'y', 'my', 'self_protection')) # needs userspace support (systemd)
     checklist.append(OptCheck('PAGE_POISONING_NO_SANITY',         'is not set', 'my', 'self_protection'))
     checklist.append(OptCheck('PAGE_POISONING_ZERO',              'is not set', 'my', 'self_protection'))
     checklist.append(OptCheck('SLAB_MERGE_DEFAULT',               'is not set', 'my', 'self_protection')) # slab_nomerge
@@ -227,6 +254,8 @@ def construct_checklist(arch):
         checklist.append(OR(OptCheck('STRICT_DEVMEM',     'y', 'defconfig', 'cut_attack_surface'), \
                             devmem_not_set)) # refers to LOCK_DOWN_KERNEL
 
+    checklist.append(modules_not_set)
+    checklist.append(devmem_not_set)
     checklist.append(OR(OptCheck('IO_STRICT_DEVMEM',  'y', 'kspp', 'cut_attack_surface'), \
                         devmem_not_set)) # refers to LOCK_DOWN_KERNEL
     if debug_mode or arch == 'ARM':
@@ -310,8 +339,9 @@ def print_check_results():
         'option name', 'desired val', 'decision', 'reason', 'check result'))
     print('  ' + '=' * 115)
     for opt in checklist:
-        print('  CONFIG_{:<32}|{:^13}|{:^10}|{:^20}||{:^28}'.format(
-            opt.name, opt.expected, opt.decision, opt.reason, opt.result))
+        if opt.result:
+            print('  CONFIG_{:<32}|{:^13}|{:^10}|{:^20}||{:^28}'.format(
+                opt.name, opt.expected, opt.decision, opt.reason, opt.result))
     print()
 
 
@@ -387,7 +417,7 @@ if __name__ == '__main__':
 
         construct_checklist(arch)
         check_config_file(args.config)
-        error_count = len(list(filter(lambda opt: opt.result.startswith('FAIL'), checklist)))
+        error_count = len(list(filter(lambda opt: opt.result and opt.result.startswith('FAIL'), checklist)))
         if debug_mode:
             sys.exit(0)
         if error_count == 0: