X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig-hardened-check.py;h=d9ffba637eec4b9ef603f74bb2b742b209bcbbfe;hb=47226fe77ab14311a172343d3e306264d9062d88;hp=35bcad78dd49e5a5107f456278bb09597fa15908;hpb=7935d6f0c6823988e26cab87cc0ff3b82709e124;p=kconfig-hardened-check.git

diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py
index 35bcad7..d9ffba6 100755
--- a/kconfig-hardened-check.py
+++ b/kconfig-hardened-check.py
@@ -2,7 +2,8 @@
 
 #
 # This script helps me to check the Linux kernel Kconfig option list
-# against my hardening preferences for x86_64. Let the computers do their job!
+# against my hardening preferences for X86_64, ARM64, X86_32, and ARM.
+# Let the computers do their job!
 #
 # Author: Alexander Popov <alex.popov@linux.com>
 #
@@ -25,9 +26,6 @@
 #
 # N.B. Hardening sysctl's:
 #    net.core.bpf_jit_harden
-#
-#
-# TODO: add hardening preferences for ARM
 
 import sys
 from argparse import ArgumentParser
@@ -105,7 +103,7 @@ class OR:
                 if i == 0:
                     self.result = opt.result
                 else:
-                    self.result = 'CONFIG_{}: {} ("{}")'.format(opt.name, opt.result, opt.expected)
+                    self.result = 'OK: CONFIG_{} "{}"'.format(opt.name, opt.expected)
                 return True, self.result
         self.result = self.opts[0].result
         return False, self.result
@@ -189,7 +187,8 @@ def construct_checklist(arch):
                         modules_not_set))
     checklist.append(OR(OptCheck('MODULE_SIG_SHA512',             'y', 'kspp', 'self_protection'), \
                         modules_not_set))
-    checklist.append(OptCheck('MODULE_SIG_FORCE',                 'y', 'kspp', 'self_protection')) # refers to LOCK_DOWN_KERNEL
+    checklist.append(OR(OptCheck('MODULE_SIG_FORCE',              'y', 'kspp', 'self_protection'), \
+                        modules_not_set)) # refers to LOCK_DOWN_KERNEL
     if debug_mode or arch == 'X86_64' or arch == 'X86_32':
         checklist.append(OptCheck('DEFAULT_MMAP_MIN_ADDR',        '65536', 'kspp', 'self_protection'))
         checklist.append(OptCheck('REFCOUNT_FULL',                'y', 'kspp', 'self_protection'))
@@ -208,8 +207,9 @@ def construct_checklist(arch):
     checklist.append(OptCheck('LOCK_DOWN_KERNEL',                 'y', 'my', 'self_protection')) # remember about LOCK_DOWN_MANDATORY
     checklist.append(OptCheck('SLUB_DEBUG_ON',                    'y', 'my', 'self_protection'))
     checklist.append(OptCheck('SECURITY_DMESG_RESTRICT',          'y', 'my', 'self_protection'))
-    checklist.append(OptCheck('STATIC_USERMODEHELPER',            'y', 'my', 'self_protection')) # breaks systemd?
-    checklist.append(OptCheck('SECURITY_LOADPIN',                 'y', 'my', 'self_protection'))
+    checklist.append(OptCheck('STATIC_USERMODEHELPER',            'y', 'my', 'self_protection')) # needs userspace support (systemd)
+    checklist.append(OptCheck('SECURITY_LOADPIN',                 'y', 'my', 'self_protection')) # needs userspace support
+    checklist.append(OptCheck('RESET_ATTACK_MITIGATION',          'y', 'my', 'self_protection')) # needs userspace support (systemd)
     checklist.append(OptCheck('PAGE_POISONING_NO_SANITY',         'is not set', 'my', 'self_protection'))
     checklist.append(OptCheck('PAGE_POISONING_ZERO',              'is not set', 'my', 'self_protection'))
     checklist.append(OptCheck('SLAB_MERGE_DEFAULT',               'is not set', 'my', 'self_protection')) # slab_nomerge