X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig_hardened_check%2F__init__.py;h=0ed7dd349ff4370d947e81390f0815be8c29d466;hb=c69de43ed734068c7eb1b25e47c06192c023fe58;hp=7ac709fa328e76852fe601706244c3d8142c7146;hpb=62433053ef5a70f7295881813bbfe93f4646eb81;p=kconfig-hardened-check.git diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py index 7ac709f..0ed7dd3 100644 --- a/kconfig_hardened_check/__init__.py +++ b/kconfig_hardened_check/__init__.py @@ -11,7 +11,6 @@ # # # N.B Hardening command line parameters: -# slab_nomerge # page_alloc.shuffle=1 # iommu=force (does it help against DMA attacks?) # iommu.passthrough=0 @@ -27,7 +26,6 @@ # mitigations=auto,nosmt (nosmt is slow) # X86: # spectre_v2=on -# pti=on # spec_store_bypass_disable=on # l1tf=full,force # l1d_flush=on (a part of the l1tf option) @@ -38,6 +36,7 @@ # ssbd=force-on # # Should NOT be set: +# slab_merge # nokaslr # rodata=off # sysrq_always_enabled @@ -89,8 +88,8 @@ SIMPLE_OPTION_TYPES = ('kconfig', 'version', 'cmdline') class OptCheck: # Constructor without the 'expected' parameter is for option presence checks (any value is OK) def __init__(self, reason, decision, name, expected=None): - if not reason or not decision or not name: - sys.exit('[!] ERROR: invalid {} check for "{}"'.format(self.__class__.__name__, name)) + assert(reason and decision and name), \ + 'invalid {} check for "{}"'.format(self.__class__.__name__, name) self.name = name self.expected = expected self.decision = decision @@ -186,12 +185,12 @@ class VersionCheck: class ComplexOptCheck: def __init__(self, *opts): self.opts = opts - if not self.opts: - sys.exit('[!] ERROR: empty {} check'.format(self.__class__.__name__)) - if len(self.opts) == 1: - sys.exit('[!] ERROR: useless {} check'.format(self.__class__.__name__)) - if not isinstance(opts[0], KconfigCheck) and not isinstance(opts[0], CmdlineCheck): - sys.exit('[!] ERROR: invalid {} check: {}'.format(self.__class__.__name__, opts)) + assert(self.opts), \ + 'empty {} check'.format(self.__class__.__name__) + assert(len(self.opts) != 1), \ + 'useless {} check: {}'.format(self.__class__.__name__, opts) + assert(isinstance(opts[0], KconfigCheck) or isinstance(opts[0], CmdlineCheck)), \ + 'invalid {} check: {}'.format(self.__class__.__name__, opts) self.result = None @property @@ -241,8 +240,6 @@ class OR(ComplexOptCheck): # OR(, ) # OR(, ) def check(self): - if not self.opts: - sys.exit('[!] ERROR: invalid OR check') for i, opt in enumerate(self.opts): opt.check() if opt.result.startswith('OK'): @@ -255,9 +252,10 @@ class OR(ComplexOptCheck): self.result = 'OK: {} not found'.format(opt.name) elif opt.result == 'OK: is present': self.result = 'OK: {} is present'.format(opt.name) - # VersionCheck provides enough info - elif not opt.result.startswith('OK: version'): - sys.exit('[!] ERROR: unexpected OK description "{}"'.format(opt.result)) + else: + # VersionCheck provides enough info + assert(opt.result.startswith('OK: version')), \ + 'unexpected OK description "{}"'.format(opt.result) return self.result = self.opts[0].result @@ -285,10 +283,9 @@ class AND(ComplexOptCheck): else: # VersionCheck provides enough info self.result = opt.result - if not opt.result.startswith('FAIL: version'): - sys.exit('[!] ERROR: unexpected FAIL description "{}"'.format(opt.result)) + assert(opt.result.startswith('FAIL: version')), \ + 'unexpected FAIL description "{}"'.format(opt.result) return - sys.exit('[!] ERROR: invalid AND check') def detect_arch(fname, archs): @@ -467,7 +464,8 @@ def add_kconfig_checks(l, arch): l += [KconfigCheck('self_protection', 'clipos', 'STATIC_USERMODEHELPER', 'y')] # needs userspace support l += [OR(KconfigCheck('self_protection', 'clipos', 'EFI_DISABLE_PCI_DMA', 'y'), efi_not_set)] - l += [KconfigCheck('self_protection', 'clipos', 'SLAB_MERGE_DEFAULT', 'is not set')] # slab_nomerge + l += [OR(KconfigCheck('self_protection', 'clipos', 'SLAB_MERGE_DEFAULT', 'is not set'), + CmdlineCheck('self_protection', 'kspp', 'slab_nomerge'))] # option presence check l += [KconfigCheck('self_protection', 'clipos', 'RANDOM_TRUST_BOOTLOADER', 'is not set')] l += [KconfigCheck('self_protection', 'clipos', 'RANDOM_TRUST_CPU', 'is not set')] l += [AND(KconfigCheck('self_protection', 'clipos', 'GCC_PLUGIN_RANDSTRUCT_PERFORMANCE', 'is not set'), @@ -660,6 +658,8 @@ def add_cmdline_checks(l, arch): # Calling the CmdlineCheck class constructor: # CmdlineCheck(reason, decision, name, expected) + if arch in ('X86_64', 'X86_32'): + l += [CmdlineCheck('self_protection', 'kspp', 'pti', 'on')] # TODO: add other @@ -676,8 +676,8 @@ def print_unknown_options(checklist, parsed_options): known_options.append(o2.name) continue for o3 in o2.opts: - if o3.type == 'complex': - sys.exit('[!] ERROR: unexpected ComplexOptCheck inside {}'.format(o2.name)) + assert(o3.type != 'complex'), \ + 'unexpected ComplexOptCheck inside {}'.format(o2.name) if hasattr(o3, 'name'): known_options.append(o3.name) @@ -735,12 +735,12 @@ def print_checklist(mode, checklist, with_results): def populate_simple_opt_with_data(opt, data, data_type): - if opt.type == 'complex': - sys.exit('[!] ERROR: unexpected ComplexOptCheck {}: {}'.format(opt.name, vars(opt))) - if opt.type not in SIMPLE_OPTION_TYPES: - sys.exit('[!] ERROR: invalid opt type "{}" for {}'.format(opt.type, opt.name)) - if data_type not in SIMPLE_OPTION_TYPES: - sys.exit('[!] ERROR: invalid data type "{}"'.format(data_type)) + assert(opt.type != 'complex'), \ + 'unexpected ComplexOptCheck "{}"'.format(opt.name) + assert(opt.type in SIMPLE_OPTION_TYPES), \ + 'invalid opt type "{}"'.format(opt.type) + assert(data_type in SIMPLE_OPTION_TYPES), \ + 'invalid data type "{}"'.format(data_type) if data_type != opt.type: return @@ -849,6 +849,9 @@ def main(): config_checklist = [] if args.config: + if args.print: + sys.exit('[!] ERROR: --config and --print can\'t be used together') + if mode != 'json': print('[+] Kconfig file to check: {}'.format(args.config)) if args.cmdline: