X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig_hardened_check%2F__init__.py;h=5ec5c7091e3d2f68600d97d2cc20c013b84a85e1;hb=e39d50813c129c3b17a12a981167e11e96081938;hp=5050ec4424f3892a6488117e01bdaedfa3f23c6b;hpb=4f2124b5a8c8b2e231d25db86f6832beeb4238f8;p=kconfig-hardened-check.git diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py index 5050ec4..5ec5c70 100644 --- a/kconfig_hardened_check/__init__.py +++ b/kconfig_hardened_check/__init__.py @@ -19,6 +19,7 @@ # init_on_free=1 (since v5.3, otherwise slub_debug=P and page_poison=1) # loadpin.enforce=1 # debugfs=no-mount (or off if possible) +# randomize_kstack_offset=1 # # Mitigations of CPU vulnerabilities: # Аrch-independent: @@ -34,6 +35,16 @@ # kpti=on # ssbd=force-on # +# Should NOT be set: +# nokaslr +# arm64.nobti +# arm64.nopauth +# +# Hardware tag-based KASAN with arm64 Memory Tagging Extension (MTE): +# kasan=on +# kasan.stacktrace=off +# kasan.fault=panic +# # N.B. Hardening sysctls: # kernel.kptr_restrict=2 (or 1?) # kernel.dmesg_restrict=1 (also see the kconfig option) @@ -46,6 +57,8 @@ # net.core.bpf_jit_harden=2 # # vm.unprivileged_userfaultfd=0 +# (at first, it disabled unprivileged userfaultfd, +# and since v5.11 it enables unprivileged userfaultfd for user-mode only) # # dev.tty.ldisc_autoload=0 # fs.protected_symlinks=1 @@ -272,6 +285,9 @@ def detect_version(fname): def construct_checklist(l, arch): + # Calling the OptCheck class constructor: + # OptCheck(reason, decision, name, expected) + modules_not_set = OptCheck('cut_attack_surface', 'kspp', 'MODULES', 'is not set') devmem_not_set = OptCheck('cut_attack_surface', 'kspp', 'DEVMEM', 'is not set') # refers to LOCKDOWN @@ -313,6 +329,7 @@ def construct_checklist(l, arch): iommu_support_is_set)] if arch == 'ARM64': l += [OptCheck('self_protection', 'defconfig', 'ARM64_PAN', 'y')] + l += [OptCheck('self_protection', 'defconfig', 'ARM64_EPAN', 'y')] l += [OptCheck('self_protection', 'defconfig', 'UNMAP_KERNEL_AT_EL0', 'y')] l += [OR(OptCheck('self_protection', 'defconfig', 'HARDEN_EL2_VECTORS', 'y'), AND(OptCheck('self_protection', 'defconfig', 'RANDOMIZE_BASE', 'y'), @@ -322,6 +339,7 @@ def construct_checklist(l, arch): l += [OptCheck('self_protection', 'defconfig', 'ARM64_BTI_KERNEL', 'y')] l += [OR(OptCheck('self_protection', 'defconfig', 'HARDEN_BRANCH_PREDICTOR', 'y'), VerCheck((5, 10)))] # HARDEN_BRANCH_PREDICTOR is enabled by default since v5.10 + l += [OptCheck('self_protection', 'defconfig', 'ARM64_MTE', 'y')] if arch == 'ARM': l += [OptCheck('self_protection', 'defconfig', 'CPU_SW_DOMAIN_PAN', 'y')] l += [OptCheck('self_protection', 'defconfig', 'HARDEN_BRANCH_PREDICTOR', 'y')] @@ -347,6 +365,8 @@ def construct_checklist(l, arch): l += [hardened_usercopy_is_set] l += [AND(OptCheck('self_protection', 'kspp', 'HARDENED_USERCOPY_FALLBACK', 'is not set'), hardened_usercopy_is_set)] + l += [AND(OptCheck('self_protection', 'kspp', 'HARDENED_USERCOPY_PAGESPAN', 'is not set'), + hardened_usercopy_is_set)] l += [OR(OptCheck('self_protection', 'kspp', 'MODULE_SIG', 'y'), modules_not_set)] l += [OR(OptCheck('self_protection', 'kspp', 'MODULE_SIG_ALL', 'y'), @@ -367,6 +387,7 @@ def construct_checklist(l, arch): if arch in ('X86_64', 'ARM64', 'X86_32'): stackleak_is_set = OptCheck('self_protection', 'kspp', 'GCC_PLUGIN_STACKLEAK', 'y') l += [stackleak_is_set] + l += [OptCheck('self_protection', 'kspp', 'RANDOMIZE_KSTACK_OFFSET_DEFAULT', 'y')] if arch in ('X86_64', 'X86_32'): l += [OptCheck('self_protection', 'kspp', 'DEFAULT_MMAP_MIN_ADDR', '65536')] if arch in ('ARM64', 'ARM'): @@ -379,6 +400,14 @@ def construct_checklist(l, arch): l += [OptCheck('self_protection', 'kspp', 'HIGHMEM64G', 'y')] l += [OptCheck('self_protection', 'kspp', 'X86_PAE', 'y')] + # 'self_protection', 'maintainer' + ubsan_bounds_is_set = OptCheck('self_protection', 'maintainer', 'UBSAN_BOUNDS', 'y') # only array index bounds checking + l += [ubsan_bounds_is_set] # recommended by Kees Cook in /issues/53 + l += [AND(OptCheck('self_protection', 'maintainer', 'UBSAN_SANITIZE_ALL', 'y'), + ubsan_bounds_is_set)] # recommended by Kees Cook in /issues/53 + l += [AND(OptCheck('self_protection', 'maintainer', 'UBSAN_TRAP', 'y'), + ubsan_bounds_is_set)] # recommended by Kees Cook in /issues/53 + # 'self_protection', 'clipos' l += [OptCheck('self_protection', 'clipos', 'DEBUG_VIRTUAL', 'y')] l += [OptCheck('self_protection', 'clipos', 'STATIC_USERMODEHELPER', 'y')] # needs userspace support @@ -404,15 +433,17 @@ def construct_checklist(l, arch): iommu_support_is_set)] # 'self_protection', 'my' - l += [AND(OptCheck('self_protection', 'my', 'UBSAN_BOUNDS', 'y'), - OptCheck('self_protection', 'my', 'UBSAN_MISC', 'is not set'), - OptCheck('self_protection', 'my', 'UBSAN_TRAP', 'y'))] l += [OptCheck('self_protection', 'my', 'RESET_ATTACK_MITIGATION', 'y')] # needs userspace support (systemd) if arch == 'X86_64': l += [AND(OptCheck('self_protection', 'my', 'AMD_IOMMU_V2', 'y'), iommu_support_is_set)] if arch == 'ARM64': l += [OptCheck('self_protection', 'my', 'SHADOW_CALL_STACK', 'y')] # depends on clang, maybe it's alternative to STACKPROTECTOR_STRONG + l += [OptCheck('self_protection', 'my', 'KASAN_HW_TAGS', 'y')] + cfi_clang_is_set = OptCheck('self_protection', 'my', 'CFI_CLANG', 'y') + l += [cfi_clang_is_set] + l += [AND(OptCheck('self_protection', 'my', 'CFI_PERMISSIVE', 'is not set'), + cfi_clang_is_set)] # 'security_policy' if arch in ('X86_64', 'ARM64', 'X86_32'): @@ -485,9 +516,10 @@ def construct_checklist(l, arch): OptCheck('cut_attack_surface', 'my', 'PTDUMP_DEBUGFS', 'is not set'))] # 'cut_attack_surface', 'maintainer' - l += [OptCheck('cut_attack_surface', 'maintainer', 'DRM_LEGACY', 'is not set')] - l += [OptCheck('cut_attack_surface', 'maintainer', 'FB', 'is not set')] - l += [OptCheck('cut_attack_surface', 'maintainer', 'VT', 'is not set')] + l += [OptCheck('cut_attack_surface', 'maintainer', 'DRM_LEGACY', 'is not set')] # recommended by Daniel Vetter in /issues/38 + l += [OptCheck('cut_attack_surface', 'maintainer', 'FB', 'is not set')] # recommended by Daniel Vetter in /issues/38 + l += [OptCheck('cut_attack_surface', 'maintainer', 'VT', 'is not set')] # recommended by Daniel Vetter in /issues/38 + l += [OptCheck('cut_attack_surface', 'maintainer', 'BLK_DEV_FD', 'is not set')] # recommended by Denis Efremov in /pull/54 # 'cut_attack_surface', 'grapheneos' l += [OptCheck('cut_attack_surface', 'grapheneos', 'AIO', 'is not set')]