X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig_hardened_check%2F__init__.py;h=1132d2678b6e19e589cf8284cca60fafb09cca46;hb=7ed482ba8c3e8c9dd42691f779756772675a3dd8;hp=530c45f6021751a1e1b2df827bd55a892bd7bb9f;hpb=5a149f0d7f8ea553d509c9d4fab4f89d6472d0f5;p=kconfig-hardened-check.git diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py index 530c45f..1132d26 100644 --- a/kconfig_hardened_check/__init__.py +++ b/kconfig_hardened_check/__init__.py @@ -31,6 +31,7 @@ # l1tf=full,force # mds=full,nosmt # tsx=off +# l1d_flush=on # ARM64: # kpti=on # ssbd=force-on @@ -285,6 +286,9 @@ def detect_version(fname): def construct_checklist(l, arch): + # Calling the OptCheck class constructor: + # OptCheck(reason, decision, name, expected) + modules_not_set = OptCheck('cut_attack_surface', 'kspp', 'MODULES', 'is not set') devmem_not_set = OptCheck('cut_attack_surface', 'kspp', 'DEVMEM', 'is not set') # refers to LOCKDOWN @@ -332,7 +336,7 @@ def construct_checklist(l, arch): AND(OptCheck('self_protection', 'defconfig', 'RANDOMIZE_BASE', 'y'), VerCheck((5, 9))))] # HARDEN_EL2_VECTORS was included in RANDOMIZE_BASE in v5.9 l += [OptCheck('self_protection', 'defconfig', 'RODATA_FULL_DEFAULT_ENABLED', 'y')] - l += [OptCheck('self_protection', 'defconfig', 'ARM64_PTR_AUTH', 'y')] + l += [OptCheck('self_protection', 'defconfig', 'ARM64_PTR_AUTH_KERNEL', 'y')] l += [OptCheck('self_protection', 'defconfig', 'ARM64_BTI_KERNEL', 'y')] l += [OR(OptCheck('self_protection', 'defconfig', 'HARDEN_BRANCH_PREDICTOR', 'y'), VerCheck((5, 10)))] # HARDEN_BRANCH_PREDICTOR is enabled by default since v5.10 @@ -362,6 +366,8 @@ def construct_checklist(l, arch): l += [hardened_usercopy_is_set] l += [AND(OptCheck('self_protection', 'kspp', 'HARDENED_USERCOPY_FALLBACK', 'is not set'), hardened_usercopy_is_set)] + l += [AND(OptCheck('self_protection', 'kspp', 'HARDENED_USERCOPY_PAGESPAN', 'is not set'), + hardened_usercopy_is_set)] l += [OR(OptCheck('self_protection', 'kspp', 'MODULE_SIG', 'y'), modules_not_set)] l += [OR(OptCheck('self_protection', 'kspp', 'MODULE_SIG_ALL', 'y'), @@ -395,6 +401,14 @@ def construct_checklist(l, arch): l += [OptCheck('self_protection', 'kspp', 'HIGHMEM64G', 'y')] l += [OptCheck('self_protection', 'kspp', 'X86_PAE', 'y')] + # 'self_protection', 'maintainer' + ubsan_bounds_is_set = OptCheck('self_protection', 'maintainer', 'UBSAN_BOUNDS', 'y') # only array index bounds checking + l += [ubsan_bounds_is_set] # recommended by Kees Cook in /issues/53 + l += [AND(OptCheck('self_protection', 'maintainer', 'UBSAN_SANITIZE_ALL', 'y'), + ubsan_bounds_is_set)] # recommended by Kees Cook in /issues/53 + l += [AND(OptCheck('self_protection', 'maintainer', 'UBSAN_TRAP', 'y'), + ubsan_bounds_is_set)] # recommended by Kees Cook in /issues/53 + # 'self_protection', 'clipos' l += [OptCheck('self_protection', 'clipos', 'DEBUG_VIRTUAL', 'y')] l += [OptCheck('self_protection', 'clipos', 'STATIC_USERMODEHELPER', 'y')] # needs userspace support @@ -419,14 +433,6 @@ def construct_checklist(l, arch): l += [AND(OptCheck('self_protection', 'clipos', 'INTEL_IOMMU', 'y'), iommu_support_is_set)] - # 'self_protection', 'maintainer' - ubsan_bounds_is_set = OptCheck('self_protection', 'maintainer', 'UBSAN_BOUNDS', 'y') # only array index bounds checking - l += [ubsan_bounds_is_set] # recommended by Kees Cook in /issues/53 - l += [AND(OptCheck('self_protection', 'maintainer', 'UBSAN_SANITIZE_ALL', 'y'), - ubsan_bounds_is_set)] # recommended by Kees Cook in /issues/53 - l += [AND(OptCheck('self_protection', 'maintainer', 'UBSAN_TRAP', 'y'), - ubsan_bounds_is_set)] # recommended by Kees Cook in /issues/53 - # 'self_protection', 'my' l += [OptCheck('self_protection', 'my', 'RESET_ATTACK_MITIGATION', 'y')] # needs userspace support (systemd) if arch == 'X86_64': @@ -494,9 +500,13 @@ def construct_checklist(l, arch): l += [OptCheck('cut_attack_surface', 'grsecurity', 'PAGE_OWNER', 'is not set')] l += [OptCheck('cut_attack_surface', 'grsecurity', 'DEBUG_KMEMLEAK', 'is not set')] l += [OptCheck('cut_attack_surface', 'grsecurity', 'BINFMT_AOUT', 'is not set')] - l += [OptCheck('cut_attack_surface', 'grsecurity', 'KPROBES', 'is not set')] # refers to LOCKDOWN - l += [OptCheck('cut_attack_surface', 'grsecurity', 'UPROBES', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'KPROBE_EVENTS', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'UPROBE_EVENTS', 'is not set')] l += [OptCheck('cut_attack_surface', 'grsecurity', 'GENERIC_TRACER', 'is not set')] # refers to LOCKDOWN + l += [OptCheck('cut_attack_surface', 'grsecurity', 'FUNCTION_TRACER', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'STACK_TRACER', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'HIST_TRIGGERS', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'BLK_DEV_IO_TRACE', 'is not set')] l += [OptCheck('cut_attack_surface', 'grsecurity', 'PROC_VMCORE', 'is not set')] l += [OptCheck('cut_attack_surface', 'grsecurity', 'PROC_PAGE_MONITOR', 'is not set')] l += [OptCheck('cut_attack_surface', 'grsecurity', 'USELIB', 'is not set')] @@ -507,8 +517,24 @@ def construct_checklist(l, arch): l += [OptCheck('cut_attack_surface', 'grsecurity', 'DEVPORT', 'is not set')] # refers to LOCKDOWN l += [OptCheck('cut_attack_surface', 'grsecurity', 'DEBUG_FS', 'is not set')] # refers to LOCKDOWN l += [OptCheck('cut_attack_surface', 'grsecurity', 'NOTIFIER_ERROR_INJECTION', 'is not set')] - l += [AND(OptCheck('cut_attack_surface', 'grsecurity', 'X86_PTDUMP', 'is not set'), - OptCheck('cut_attack_surface', 'my', 'PTDUMP_DEBUGFS', 'is not set'))] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'FAIL_FUTEX', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'PUNIT_ATOM_DEBUG', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'ACPI_CONFIGFS', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'EDAC_DEBUG', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'DRM_I915_DEBUG', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'BCACHE_CLOSURES_DEBUG', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'DVB_C8SECTPFE', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'MTD_SLRAM', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'MTD_PHRAM', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'IO_URING', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'KCMP', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'RSEQ', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'LATENCYTOP', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'KCOV', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'PROVIDE_OHCI1394_DMA_INIT', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'SUNRPC_DEBUG', 'is not set')] + l += [AND(OptCheck('cut_attack_surface', 'grsecurity', 'PTDUMP_DEBUGFS', 'is not set'), + OptCheck('cut_attack_surface', 'grsecurity', 'X86_PTDUMP', 'is not set'))] # 'cut_attack_surface', 'maintainer' l += [OptCheck('cut_attack_surface', 'maintainer', 'DRM_LEGACY', 'is not set')] # recommended by Daniel Vetter in /issues/38 @@ -530,7 +556,6 @@ def construct_checklist(l, arch): l += [OptCheck('cut_attack_surface', 'clipos', 'USER_NS', 'is not set')] # user.max_user_namespaces=0 l += [OptCheck('cut_attack_surface', 'clipos', 'X86_MSR', 'is not set')] # refers to LOCKDOWN l += [OptCheck('cut_attack_surface', 'clipos', 'X86_CPUID', 'is not set')] - l += [OptCheck('cut_attack_surface', 'clipos', 'IO_URING', 'is not set')] l += [OptCheck('cut_attack_surface', 'clipos', 'X86_IOPL_IOPERM', 'is not set')] # refers to LOCKDOWN l += [OptCheck('cut_attack_surface', 'clipos', 'ACPI_TABLE_UPGRADE', 'is not set')] # refers to LOCKDOWN l += [OptCheck('cut_attack_surface', 'clipos', 'EFI_CUSTOM_SSDT_OVERLAYS', 'is not set')] @@ -543,9 +568,11 @@ def construct_checklist(l, arch): l += [OptCheck('cut_attack_surface', 'lockdown', 'EFI_TEST', 'is not set')] # refers to LOCKDOWN l += [OptCheck('cut_attack_surface', 'lockdown', 'BPF_SYSCALL', 'is not set')] # refers to LOCKDOWN l += [OptCheck('cut_attack_surface', 'lockdown', 'MMIOTRACE_TEST', 'is not set')] # refers to LOCKDOWN + l += [OptCheck('cut_attack_surface', 'lockdown', 'KPROBES', 'is not set')] # refers to LOCKDOWN # 'cut_attack_surface', 'my' - l += [OptCheck('cut_attack_surface', 'my', 'TRIM_UNUSED_KSYMS', 'y')] + l += [OR(OptCheck('cut_attack_surface', 'my', 'TRIM_UNUSED_KSYMS', 'y'), + modules_not_set)] l += [OptCheck('cut_attack_surface', 'my', 'MMIOTRACE', 'is not set')] # refers to LOCKDOWN (permissive) l += [OptCheck('cut_attack_surface', 'my', 'LIVEPATCH', 'is not set')] l += [OptCheck('cut_attack_surface', 'my', 'IP_DCCP', 'is not set')]