X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig_hardened_check%2F__init__.py;h=45e51fa8079f5a2c398d150ba17df9a757dbcea5;hb=cd559d31f74be75a4a000c6113079cdb43ffaa7c;hp=635397ea6aadbd3747bb5f8f9af5f42097981ae2;hpb=337f806fbae3aa3147ec9f8f529f94577d85288c;p=kconfig-hardened-check.git diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py index 635397e..45e51fa 100644 --- a/kconfig_hardened_check/__init__.py +++ b/kconfig_hardened_check/__init__.py @@ -13,11 +13,7 @@ # N.B Hardening command line parameters: # page_alloc.shuffle=1 # iommu=force (does it help against DMA attacks?) -# iommu.passthrough=0 -# iommu.strict=1 # slub_debug=FZ (slow) -# init_on_alloc=1 (since v5.3) -# init_on_free=1 (since v5.3, otherwise slub_debug=P and page_poison=1) # loadpin.enforce=1 # debugfs=no-mount (or off if possible) # @@ -36,9 +32,7 @@ # ssbd=force-on # # Should NOT be set: -# slab_merge # nokaslr -# rodata=off # sysrq_always_enabled # arm64.nobti # arm64.nopauth @@ -189,29 +183,21 @@ class ComplexOptCheck: 'empty {} check'.format(self.__class__.__name__) assert(len(self.opts) != 1), \ 'useless {} check: {}'.format(self.__class__.__name__, opts) - assert(isinstance(opts[0], KconfigCheck) or isinstance(opts[0], CmdlineCheck)), \ + assert(isinstance(opts[0], (KconfigCheck, CmdlineCheck))), \ 'invalid {} check: {}'.format(self.__class__.__name__, opts) self.result = None - @property - def name(self): - return self.opts[0].name - @property def type(self): return 'complex' @property - def expected(self): - return self.opts[0].expected - - @property - def decision(self): - return self.opts[0].decision + def name(self): + return self.opts[0].name @property - def reason(self): - return self.opts[0].reason + def expected(self): + return self.opts[0].expected def table_print(self, mode, with_results): if mode == 'verbose': @@ -335,7 +321,10 @@ def add_kconfig_checks(l, arch): l += [KconfigCheck('self_protection', 'defconfig', 'SLUB_DEBUG', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'GCC_PLUGINS', 'y')] l += [OR(KconfigCheck('self_protection', 'defconfig', 'STACKPROTECTOR', 'y'), - KconfigCheck('self_protection', 'defconfig', 'CC_STACKPROTECTOR', 'y'))] + KconfigCheck('self_protection', 'defconfig', 'CC_STACKPROTECTOR', 'y'), + KconfigCheck('self_protection', 'defconfig', 'CC_STACKPROTECTOR_REGULAR', 'y'), + KconfigCheck('self_protection', 'defconfig', 'CC_STACKPROTECTOR_AUTO', 'y'), + KconfigCheck('self_protection', 'defconfig', 'CC_STACKPROTECTOR_STRONG', 'y'))] l += [OR(KconfigCheck('self_protection', 'defconfig', 'STACKPROTECTOR_STRONG', 'y'), KconfigCheck('self_protection', 'defconfig', 'CC_STACKPROTECTOR_STRONG', 'y'))] l += [OR(KconfigCheck('self_protection', 'defconfig', 'STRICT_KERNEL_RWX', 'y'), @@ -406,6 +395,7 @@ def add_kconfig_checks(l, arch): l += [KconfigCheck('self_protection', 'kspp', 'KFENCE', 'y')] l += [KconfigCheck('self_protection', 'kspp', 'WERROR', 'y')] l += [KconfigCheck('self_protection', 'kspp', 'IOMMU_DEFAULT_DMA_STRICT', 'y')] + l += [KconfigCheck('self_protection', 'kspp', 'IOMMU_DEFAULT_PASSTHROUGH', 'is not set')] # true if IOMMU_DEFAULT_DMA_STRICT is set l += [KconfigCheck('self_protection', 'kspp', 'ZERO_CALL_USED_REGS', 'y')] randstruct_is_set = KconfigCheck('self_protection', 'kspp', 'GCC_PLUGIN_RANDSTRUCT', 'y') l += [randstruct_is_set] @@ -435,8 +425,7 @@ def add_kconfig_checks(l, arch): if arch in ('X86_64', 'ARM64', 'X86_32'): stackleak_is_set = KconfigCheck('self_protection', 'kspp', 'GCC_PLUGIN_STACKLEAK', 'y') l += [stackleak_is_set] - l += [OR(KconfigCheck('self_protection', 'kspp', 'RANDOMIZE_KSTACK_OFFSET_DEFAULT', 'y'), - CmdlineCheck('self_protection', 'kspp', 'randomize_kstack_offset', '1'))] + l += [KconfigCheck('self_protection', 'kspp', 'RANDOMIZE_KSTACK_OFFSET_DEFAULT', 'y')] if arch in ('X86_64', 'X86_32'): l += [KconfigCheck('self_protection', 'kspp', 'SCHED_CORE', 'y')] l += [KconfigCheck('self_protection', 'kspp', 'DEFAULT_MMAP_MIN_ADDR', '65536')] @@ -464,8 +453,7 @@ def add_kconfig_checks(l, arch): l += [KconfigCheck('self_protection', 'clipos', 'STATIC_USERMODEHELPER', 'y')] # needs userspace support l += [OR(KconfigCheck('self_protection', 'clipos', 'EFI_DISABLE_PCI_DMA', 'y'), efi_not_set)] - l += [OR(KconfigCheck('self_protection', 'clipos', 'SLAB_MERGE_DEFAULT', 'is not set'), - CmdlineCheck('self_protection', 'kspp', 'slab_nomerge'))] # option presence check + l += [KconfigCheck('self_protection', 'clipos', 'SLAB_MERGE_DEFAULT', 'is not set')] l += [KconfigCheck('self_protection', 'clipos', 'RANDOM_TRUST_BOOTLOADER', 'is not set')] l += [KconfigCheck('self_protection', 'clipos', 'RANDOM_TRUST_CPU', 'is not set')] l += [AND(KconfigCheck('self_protection', 'clipos', 'GCC_PLUGIN_RANDSTRUCT_PERFORMANCE', 'is not set'), @@ -644,6 +632,9 @@ def add_kconfig_checks(l, arch): l += [KconfigCheck('harden_userspace', 'defconfig', 'INTEGRITY', 'y')] if arch == 'ARM': l += [KconfigCheck('harden_userspace', 'my', 'INTEGRITY', 'y')] + if arch == 'ARM64': + l += [KconfigCheck('harden_userspace', 'defconfig', 'ARM64_PTR_AUTH', 'y')] + l += [KconfigCheck('harden_userspace', 'defconfig', 'ARM64_BTI', 'y')] if arch in ('ARM', 'X86_32'): l += [KconfigCheck('harden_userspace', 'defconfig', 'VMSPLIT_3G', 'y')] if arch in ('X86_64', 'ARM64'): @@ -651,15 +642,50 @@ def add_kconfig_checks(l, arch): if arch in ('X86_32', 'ARM'): l += [KconfigCheck('harden_userspace', 'my', 'ARCH_MMAP_RND_BITS', '16')] -# l += [KconfigCheck('feature_test', 'my', 'LKDTM', 'm')] # only for debugging! - def add_cmdline_checks(l, arch): # Calling the CmdlineCheck class constructor: # CmdlineCheck(reason, decision, name, expected) + # Don't add CmdlineChecks in add_kconfig_checks() to avoid wrong results + # when the tool doesn't check the cmdline. + if arch == 'ARM64': + l += [OR(CmdlineCheck('self_protection', 'defconfig', 'rodata', 'full'), + AND(KconfigCheck('self_protection', 'defconfig', 'RODATA_FULL_DEFAULT_ENABLED', 'y'), + CmdlineCheck('self_protection', 'defconfig', 'rodata', 'is not set')))] + + l += [OR(CmdlineCheck('self_protection', 'kspp', 'init_on_alloc', '1'), + AND(KconfigCheck('self_protection', 'kspp', 'INIT_ON_ALLOC_DEFAULT_ON', 'y'), + CmdlineCheck('self_protection', 'kspp', 'init_on_alloc', 'is not set')))] + l += [OR(CmdlineCheck('self_protection', 'kspp', 'init_on_free', '1'), + AND(KconfigCheck('self_protection', 'kspp', 'INIT_ON_FREE_DEFAULT_ON', 'y'), + CmdlineCheck('self_protection', 'kspp', 'init_on_free', 'is not set')), + AND(CmdlineCheck('self_protection', 'kspp', 'page_poison', '1'), + KconfigCheck('self_protection', 'kspp', 'PAGE_POISONING_ZERO', 'y'), + CmdlineCheck('self_protection', 'kspp', 'slub_debug', 'P')))] + l += [OR(CmdlineCheck('self_protection', 'kspp', 'slab_nomerge'), + AND(KconfigCheck('self_protection', 'clipos', 'SLAB_MERGE_DEFAULT', 'is not set'), + CmdlineCheck('self_protection', 'kspp', 'slab_merge', 'is not set')))] # option presence check + l += [OR(CmdlineCheck('self_protection', 'kspp', 'iommu.strict', '1'), + AND(KconfigCheck('self_protection', 'kspp', 'IOMMU_DEFAULT_DMA_STRICT', 'y'), + CmdlineCheck('self_protection', 'kspp', 'iommu.strict', 'is not set')))] + l += [OR(CmdlineCheck('self_protection', 'kspp', 'iommu.passthrough', '0'), + AND(KconfigCheck('self_protection', 'kspp', 'IOMMU_DEFAULT_PASSTHROUGH', 'is not set'), + CmdlineCheck('self_protection', 'kspp', 'iommu.passthrough', 'is not set')))] + l += [OR(CmdlineCheck('self_protection', 'kspp', 'slab_common.usercopy_fallback', '0'), + KconfigCheck('self_protection', 'kspp', 'HARDENED_USERCOPY_FALLBACK', 'is not set'))] + if arch in ('X86_64', 'ARM64', 'X86_32'): + l += [OR(CmdlineCheck('self_protection', 'kspp', 'randomize_kstack_offset', '1'), + AND(KconfigCheck('self_protection', 'kspp', 'RANDOMIZE_KSTACK_OFFSET_DEFAULT', 'y'), + CmdlineCheck('self_protection', 'kspp', 'randomize_kstack_offset', 'is not set')))] if arch in ('X86_64', 'X86_32'): l += [CmdlineCheck('self_protection', 'kspp', 'pti', 'on')] + + if arch == 'X86_64': + l += [OR(CmdlineCheck('cut_attack_surface', 'kspp', 'vsyscall', 'none'), + AND(KconfigCheck('cut_attack_surface', 'kspp', 'LEGACY_VSYSCALL_NONE', 'y'), + CmdlineCheck('cut_attack_surface', 'kspp', 'vsyscall', 'is not set')))] + # TODO: add other @@ -676,8 +702,8 @@ def print_unknown_options(checklist, parsed_options): known_options.append(o2.name) continue for o3 in o2.opts: - if o3.type == 'complex': - sys.exit('[!] ERROR: unexpected ComplexOptCheck inside {}'.format(o2.name)) + assert(o3.type != 'complex'), \ + 'unexpected ComplexOptCheck inside {}'.format(o2.name) if hasattr(o3, 'name'): known_options.append(o3.name) @@ -735,22 +761,22 @@ def print_checklist(mode, checklist, with_results): def populate_simple_opt_with_data(opt, data, data_type): - if opt.type == 'complex': - sys.exit('[!] ERROR: unexpected ComplexOptCheck {}: {}'.format(opt.name, vars(opt))) - if opt.type not in SIMPLE_OPTION_TYPES: - sys.exit('[!] ERROR: invalid opt type "{}" for {}'.format(opt.type, opt.name)) - if data_type not in SIMPLE_OPTION_TYPES: - sys.exit('[!] ERROR: invalid data type "{}"'.format(data_type)) + assert(opt.type != 'complex'), \ + 'unexpected ComplexOptCheck "{}"'.format(opt.name) + assert(opt.type in SIMPLE_OPTION_TYPES), \ + 'invalid opt type "{}"'.format(opt.type) + assert(data_type in SIMPLE_OPTION_TYPES), \ + 'invalid data type "{}"'.format(data_type) if data_type != opt.type: return if data_type in ('kconfig', 'cmdline'): opt.state = data.get(opt.name, None) - elif data_type == 'version': - opt.ver = data else: - sys.exit('[!] ERROR: unexpected data type "{}"'.format(data_type)) + assert(data_type == 'version'), \ + 'unexpected data type "{}"'.format(data_type) + opt.ver = data def populate_opt_with_data(opt, data, data_type): @@ -762,8 +788,8 @@ def populate_opt_with_data(opt, data, data_type): else: populate_simple_opt_with_data(o, data, data_type) else: - if opt.type not in ('kconfig', 'cmdline'): - sys.exit('[!] ERROR: bad type "{}" for a simple check {}'.format(opt.type, opt.name)) + assert(opt.type in ('kconfig', 'cmdline')), \ + 'bad type "{}" for a simple check'.format(opt.type) populate_simple_opt_with_data(opt, data, data_type) @@ -789,6 +815,8 @@ def parse_kconfig_file(parsed_options, fname): if opt_is_on.match(line): option, value = line.split('=', 1) + if value == 'is not set': + sys.exit('[!] ERROR: bad enabled kconfig option "{}"'.format(line)) elif opt_is_off.match(line): option, value = line[2:].split(' ', 1) if value != 'is not set': @@ -872,6 +900,10 @@ def main(): # add relevant kconfig checks to the checklist add_kconfig_checks(config_checklist, arch) + if args.cmdline: + # add relevant cmdline checks to the checklist + add_cmdline_checks(config_checklist, arch) + # populate the checklist with the parsed kconfig data parsed_kconfig_options = OrderedDict() parse_kconfig_file(parsed_kconfig_options, args.config) @@ -879,9 +911,6 @@ def main(): populate_with_data(config_checklist, kernel_version, 'version') if args.cmdline: - # add relevant cmdline checks to the checklist - add_cmdline_checks(config_checklist, arch) - # populate the checklist with the parsed kconfig data parsed_cmdline_options = OrderedDict() parse_cmdline_file(parsed_cmdline_options, args.cmdline) @@ -912,6 +941,3 @@ def main(): parser.print_help() sys.exit(0) - -if __name__ == '__main__': - main()