X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig_hardened_check%2F__init__.py;h=ec858f0c1afee9cdb77831d990351753cfe7a998;hb=759ed4e9ad84dbdff8a5b6d62067125d63fec951;hp=fa7cc3537fbae67355b3d8d886aea6e1a4786801;hpb=bdedd20bd35c7f2f538fd974be527aa01e5e81c9;p=kconfig-hardened-check.git

diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py
index fa7cc35..ec858f0 100644
--- a/kconfig_hardened_check/__init__.py
+++ b/kconfig_hardened_check/__init__.py
@@ -77,12 +77,30 @@ SIMPLE_OPTION_TYPES = ('kconfig', 'version', 'cmdline')
 class OptCheck:
     # Constructor without the 'expected' parameter is for option presence checks (any value is OK)
     def __init__(self, reason, decision, name, expected=None):
-        assert(reason and decision and name), \
-               'invalid {} check for "{}"'.format(self.__class__.__name__, name)
+        assert(name and name == name.strip() and len(name.split()) == 1), \
+               'invalid name "{}" for {}'.format(name, self.__class__.__name__)
         self.name = name
-        self.expected = expected
+
+        assert(decision and decision == decision.strip() and len(decision.split()) == 1), \
+               'invalid decision "{}" for "{}" check'.format(decision, name)
         self.decision = decision
+
+        assert(reason and reason == reason.strip() and len(reason.split()) == 1), \
+               'invalid reason "{}" for "{}" check'.format(reason, name)
         self.reason = reason
+
+        if expected:
+            assert(expected == expected.strip()), \
+                   'invalid expected value "{}" for "{}" check (1)'.format(expected, name)
+            val_len = len(expected.split())
+            if val_len == 3:
+                assert(expected == 'is not set'), \
+                   'invalid expected value "{}" for "{}" check (2)'.format(expected, name)
+            else:
+                assert(val_len == 1), \
+                   'invalid expected value "{}" for "{}" check (3)'.format(expected, name)
+        self.expected = expected
+
         self.state = None
         self.result = None
 
@@ -144,6 +162,8 @@ class CmdlineCheck(OptCheck):
 
 class VersionCheck:
     def __init__(self, ver_expected):
+        assert(ver_expected and isinstance(ver_expected, tuple) and len(ver_expected) == 2), \
+               'invalid version "{}" for VersionCheck'.format(ver_expected)
         self.ver_expected = ver_expected
         self.ver = ()
         self.result = None
@@ -387,6 +407,7 @@ def add_kconfig_checks(l, arch):
         l += [KconfigCheck('self_protection', 'defconfig', 'ARM64_PAN', 'y')]
         l += [KconfigCheck('self_protection', 'defconfig', 'ARM64_EPAN', 'y')]
         l += [KconfigCheck('self_protection', 'defconfig', 'UNMAP_KERNEL_AT_EL0', 'y')]
+        l += [KconfigCheck('self_protection', 'defconfig', 'ARM64_E0PD', 'y')]
         l += [OR(KconfigCheck('self_protection', 'defconfig', 'HARDEN_EL2_VECTORS', 'y'),
                  AND(KconfigCheck('self_protection', 'defconfig', 'RANDOMIZE_BASE', 'y'),
                      VersionCheck((5, 9))))] # HARDEN_EL2_VECTORS was included in RANDOMIZE_BASE in v5.9
@@ -426,6 +447,7 @@ def add_kconfig_checks(l, arch):
     l += [KconfigCheck('self_protection', 'kspp', 'ZERO_CALL_USED_REGS', 'y')]
     l += [KconfigCheck('self_protection', 'kspp', 'HW_RANDOM_TPM', 'y')]
     l += [KconfigCheck('self_protection', 'kspp', 'STATIC_USERMODEHELPER', 'y')] # needs userspace support
+    l += [KconfigCheck('self_protection', 'kspp', 'SCHED_CORE', 'y')]
     randstruct_is_set = OR(KconfigCheck('self_protection', 'kspp', 'RANDSTRUCT_FULL', 'y'),
                            KconfigCheck('self_protection', 'kspp', 'GCC_PLUGIN_RANDSTRUCT', 'y'))
     l += [randstruct_is_set]
@@ -484,8 +506,12 @@ def add_kconfig_checks(l, arch):
                   stackleak_is_set,
                   gcc_plugins_support_is_set)]
         l += [KconfigCheck('self_protection', 'kspp', 'RANDOMIZE_KSTACK_OFFSET_DEFAULT', 'y')]
+    if arch in ('X86_64', 'ARM64'):
+        cfi_clang_is_set = KconfigCheck('self_protection', 'kspp', 'CFI_CLANG', 'y')
+        l += [cfi_clang_is_set]
+        l += [AND(KconfigCheck('self_protection', 'kspp', 'CFI_PERMISSIVE', 'is not set'),
+                  cfi_clang_is_set)]
     if arch in ('X86_64', 'X86_32'):
-        l += [KconfigCheck('self_protection', 'kspp', 'SCHED_CORE', 'y')]
         l += [KconfigCheck('self_protection', 'kspp', 'DEFAULT_MMAP_MIN_ADDR', '65536')]
         l += [AND(KconfigCheck('self_protection', 'kspp', 'INTEL_IOMMU_DEFAULT_ON', 'y'),
                   iommu_support_is_set)]
@@ -500,6 +526,8 @@ def add_kconfig_checks(l, arch):
                   iommu_support_is_set)]
     if arch == 'ARM64':
         l += [KconfigCheck('self_protection', 'kspp', 'ARM64_SW_TTBR0_PAN', 'y')]
+        l += [KconfigCheck('self_protection', 'kspp', 'SHADOW_CALL_STACK', 'y')]
+        l += [KconfigCheck('self_protection', 'kspp', 'KASAN_HW_TAGS', 'y')]
     if arch == 'X86_32':
         l += [KconfigCheck('self_protection', 'kspp', 'PAGE_TABLE_ISOLATION', 'y')]
         l += [KconfigCheck('self_protection', 'kspp', 'HIGHMEM64G', 'y')]
@@ -510,15 +538,6 @@ def add_kconfig_checks(l, arch):
     # 'self_protection', 'clipos'
     l += [KconfigCheck('self_protection', 'clipos', 'SLAB_MERGE_DEFAULT', 'is not set')]
 
-    # 'self_protection', 'my'
-    if arch == 'ARM64':
-        l += [KconfigCheck('self_protection', 'my', 'SHADOW_CALL_STACK', 'y')] # maybe it's alternative to STACKPROTECTOR_STRONG
-        l += [KconfigCheck('self_protection', 'my', 'KASAN_HW_TAGS', 'y')]
-        cfi_clang_is_set = KconfigCheck('self_protection', 'my', 'CFI_CLANG', 'y')
-        l += [cfi_clang_is_set]
-        l += [AND(KconfigCheck('self_protection', 'my', 'CFI_PERMISSIVE', 'is not set'),
-                  cfi_clang_is_set)]
-
     # 'security_policy'
     if arch in ('X86_64', 'ARM64', 'X86_32'):
         l += [KconfigCheck('security_policy', 'defconfig', 'SECURITY', 'y')] # and choose your favourite LSM