X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig_hardened_check%2F__init__.py;h=3b3b415ec12612ebef605dddd59cda786d094132;hb=b73ae3cf7ad0a85a72739bdf961605279fd45d1b;hp=e1b5a5e82b5ee3bb87914a5337ba1b459d45087e;hpb=b7d33ca9a9c8d324d8da9d9bc652febb063fb7be;p=kconfig-hardened-check.git diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py index e1b5a5e..3b3b415 100644 --- a/kconfig_hardened_check/__init__.py +++ b/kconfig_hardened_check/__init__.py @@ -19,6 +19,7 @@ # init_on_free=1 (since v5.3, otherwise slub_debug=P and page_poison=1) # loadpin.enforce=1 # debugfs=no-mount (or off if possible) +# randomize_kstack_offset=1 # # Mitigations of CPU vulnerabilities: # Аrch-independent: @@ -34,6 +35,16 @@ # kpti=on # ssbd=force-on # +# Should NOT be set: +# nokaslr +# arm64.nobti +# arm64.nopauth +# +# Hardware tag-based KASAN with arm64 Memory Tagging Extension (MTE): +# kasan=on +# kasan.stacktrace=off +# kasan.fault=panic +# # N.B. Hardening sysctls: # kernel.kptr_restrict=2 (or 1?) # kernel.dmesg_restrict=1 (also see the kconfig option) @@ -274,6 +285,9 @@ def detect_version(fname): def construct_checklist(l, arch): + # Calling the OptCheck class constructor: + # OptCheck(reason, decision, name, expected) + modules_not_set = OptCheck('cut_attack_surface', 'kspp', 'MODULES', 'is not set') devmem_not_set = OptCheck('cut_attack_surface', 'kspp', 'DEVMEM', 'is not set') # refers to LOCKDOWN @@ -315,6 +329,7 @@ def construct_checklist(l, arch): iommu_support_is_set)] if arch == 'ARM64': l += [OptCheck('self_protection', 'defconfig', 'ARM64_PAN', 'y')] + l += [OptCheck('self_protection', 'defconfig', 'ARM64_EPAN', 'y')] l += [OptCheck('self_protection', 'defconfig', 'UNMAP_KERNEL_AT_EL0', 'y')] l += [OR(OptCheck('self_protection', 'defconfig', 'HARDEN_EL2_VECTORS', 'y'), AND(OptCheck('self_protection', 'defconfig', 'RANDOMIZE_BASE', 'y'), @@ -324,6 +339,7 @@ def construct_checklist(l, arch): l += [OptCheck('self_protection', 'defconfig', 'ARM64_BTI_KERNEL', 'y')] l += [OR(OptCheck('self_protection', 'defconfig', 'HARDEN_BRANCH_PREDICTOR', 'y'), VerCheck((5, 10)))] # HARDEN_BRANCH_PREDICTOR is enabled by default since v5.10 + l += [OptCheck('self_protection', 'defconfig', 'ARM64_MTE', 'y')] if arch == 'ARM': l += [OptCheck('self_protection', 'defconfig', 'CPU_SW_DOMAIN_PAN', 'y')] l += [OptCheck('self_protection', 'defconfig', 'HARDEN_BRANCH_PREDICTOR', 'y')] @@ -349,6 +365,8 @@ def construct_checklist(l, arch): l += [hardened_usercopy_is_set] l += [AND(OptCheck('self_protection', 'kspp', 'HARDENED_USERCOPY_FALLBACK', 'is not set'), hardened_usercopy_is_set)] + l += [AND(OptCheck('self_protection', 'kspp', 'HARDENED_USERCOPY_PAGESPAN', 'is not set'), + hardened_usercopy_is_set)] l += [OR(OptCheck('self_protection', 'kspp', 'MODULE_SIG', 'y'), modules_not_set)] l += [OR(OptCheck('self_protection', 'kspp', 'MODULE_SIG_ALL', 'y'), @@ -369,6 +387,7 @@ def construct_checklist(l, arch): if arch in ('X86_64', 'ARM64', 'X86_32'): stackleak_is_set = OptCheck('self_protection', 'kspp', 'GCC_PLUGIN_STACKLEAK', 'y') l += [stackleak_is_set] + l += [OptCheck('self_protection', 'kspp', 'RANDOMIZE_KSTACK_OFFSET_DEFAULT', 'y')] if arch in ('X86_64', 'X86_32'): l += [OptCheck('self_protection', 'kspp', 'DEFAULT_MMAP_MIN_ADDR', '65536')] if arch in ('ARM64', 'ARM'): @@ -381,6 +400,14 @@ def construct_checklist(l, arch): l += [OptCheck('self_protection', 'kspp', 'HIGHMEM64G', 'y')] l += [OptCheck('self_protection', 'kspp', 'X86_PAE', 'y')] + # 'self_protection', 'maintainer' + ubsan_bounds_is_set = OptCheck('self_protection', 'maintainer', 'UBSAN_BOUNDS', 'y') # only array index bounds checking + l += [ubsan_bounds_is_set] # recommended by Kees Cook in /issues/53 + l += [AND(OptCheck('self_protection', 'maintainer', 'UBSAN_SANITIZE_ALL', 'y'), + ubsan_bounds_is_set)] # recommended by Kees Cook in /issues/53 + l += [AND(OptCheck('self_protection', 'maintainer', 'UBSAN_TRAP', 'y'), + ubsan_bounds_is_set)] # recommended by Kees Cook in /issues/53 + # 'self_protection', 'clipos' l += [OptCheck('self_protection', 'clipos', 'DEBUG_VIRTUAL', 'y')] l += [OptCheck('self_protection', 'clipos', 'STATIC_USERMODEHELPER', 'y')] # needs userspace support @@ -406,15 +433,17 @@ def construct_checklist(l, arch): iommu_support_is_set)] # 'self_protection', 'my' - l += [AND(OptCheck('self_protection', 'my', 'UBSAN_BOUNDS', 'y'), - OptCheck('self_protection', 'my', 'UBSAN_MISC', 'is not set'), - OptCheck('self_protection', 'my', 'UBSAN_TRAP', 'y'))] l += [OptCheck('self_protection', 'my', 'RESET_ATTACK_MITIGATION', 'y')] # needs userspace support (systemd) if arch == 'X86_64': l += [AND(OptCheck('self_protection', 'my', 'AMD_IOMMU_V2', 'y'), iommu_support_is_set)] if arch == 'ARM64': l += [OptCheck('self_protection', 'my', 'SHADOW_CALL_STACK', 'y')] # depends on clang, maybe it's alternative to STACKPROTECTOR_STRONG + l += [OptCheck('self_protection', 'my', 'KASAN_HW_TAGS', 'y')] + cfi_clang_is_set = OptCheck('self_protection', 'my', 'CFI_CLANG', 'y') + l += [cfi_clang_is_set] + l += [AND(OptCheck('self_protection', 'my', 'CFI_PERMISSIVE', 'is not set'), + cfi_clang_is_set)] # 'security_policy' if arch in ('X86_64', 'ARM64', 'X86_32'): @@ -470,7 +499,6 @@ def construct_checklist(l, arch): l += [OptCheck('cut_attack_surface', 'grsecurity', 'PAGE_OWNER', 'is not set')] l += [OptCheck('cut_attack_surface', 'grsecurity', 'DEBUG_KMEMLEAK', 'is not set')] l += [OptCheck('cut_attack_surface', 'grsecurity', 'BINFMT_AOUT', 'is not set')] - l += [OptCheck('cut_attack_surface', 'grsecurity', 'KPROBES', 'is not set')] # refers to LOCKDOWN l += [OptCheck('cut_attack_surface', 'grsecurity', 'UPROBES', 'is not set')] l += [OptCheck('cut_attack_surface', 'grsecurity', 'GENERIC_TRACER', 'is not set')] # refers to LOCKDOWN l += [OptCheck('cut_attack_surface', 'grsecurity', 'PROC_VMCORE', 'is not set')] @@ -487,9 +515,10 @@ def construct_checklist(l, arch): OptCheck('cut_attack_surface', 'my', 'PTDUMP_DEBUGFS', 'is not set'))] # 'cut_attack_surface', 'maintainer' - l += [OptCheck('cut_attack_surface', 'maintainer', 'DRM_LEGACY', 'is not set')] - l += [OptCheck('cut_attack_surface', 'maintainer', 'FB', 'is not set')] - l += [OptCheck('cut_attack_surface', 'maintainer', 'VT', 'is not set')] + l += [OptCheck('cut_attack_surface', 'maintainer', 'DRM_LEGACY', 'is not set')] # recommended by Daniel Vetter in /issues/38 + l += [OptCheck('cut_attack_surface', 'maintainer', 'FB', 'is not set')] # recommended by Daniel Vetter in /issues/38 + l += [OptCheck('cut_attack_surface', 'maintainer', 'VT', 'is not set')] # recommended by Daniel Vetter in /issues/38 + l += [OptCheck('cut_attack_surface', 'maintainer', 'BLK_DEV_FD', 'is not set')] # recommended by Denis Efremov in /pull/54 # 'cut_attack_surface', 'grapheneos' l += [OptCheck('cut_attack_surface', 'grapheneos', 'AIO', 'is not set')] @@ -518,6 +547,7 @@ def construct_checklist(l, arch): l += [OptCheck('cut_attack_surface', 'lockdown', 'EFI_TEST', 'is not set')] # refers to LOCKDOWN l += [OptCheck('cut_attack_surface', 'lockdown', 'BPF_SYSCALL', 'is not set')] # refers to LOCKDOWN l += [OptCheck('cut_attack_surface', 'lockdown', 'MMIOTRACE_TEST', 'is not set')] # refers to LOCKDOWN + l += [OptCheck('cut_attack_surface', 'lockdown', 'KPROBES', 'is not set')] # refers to LOCKDOWN # 'cut_attack_surface', 'my' l += [OptCheck('cut_attack_surface', 'my', 'TRIM_UNUSED_KSYMS', 'y')]