X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig_hardened_check%2Fchecks.py;h=af4c6e2fbf6a5efc2df4d507a709c1c453d162ec;hb=f0c9f888c46889f5313ee0ad683d56cd38f3b6b9;hp=b0b9a685049f15c29206251ce7a60ab5e2a89e6b;hpb=b69d1e8c13dd7c944182663ddbafceab78791224;p=kconfig-hardened-check.git

diff --git a/kconfig_hardened_check/checks.py b/kconfig_hardened_check/checks.py
index b0b9a68..af4c6e2 100644
--- a/kconfig_hardened_check/checks.py
+++ b/kconfig_hardened_check/checks.py
@@ -31,8 +31,9 @@ This module contains knowledge for checks.
 #    fs.protected_regular=2
 #    fs.suid_dumpable=0
 #    kernel.modules_disabled=1
-#    kernel.randomize_va_space = 2
+#    kernel.randomize_va_space=2
 #    nosmt sysfs control file
+#    dev.tty.legacy_tiocsti=0
 #
 # Think of these boot params:
 #    module.sig_enforce=1
@@ -44,7 +45,7 @@ This module contains knowledge for checks.
 #    efi=disable_early_pci_dma
 
 # pylint: disable=missing-function-docstring,line-too-long,invalid-name
-# pylint: disable=too-many-branches,too-many-statements,too-many-return-statements
+# pylint: disable=too-many-branches,too-many-statements
 
 from .engine import KconfigCheck, CmdlineCheck, VersionCheck, OR, AND
 
@@ -378,6 +379,7 @@ def add_kconfig_checks(l, arch):
     l += [bpf_syscall_not_set] # refers to LOCKDOWN
 
     # 'cut_attack_surface', 'my'
+    l += [KconfigCheck('cut_attack_surface', 'my', 'LEGACY_TIOCSTI', 'is not set')]
     l += [KconfigCheck('cut_attack_surface', 'my', 'MMIOTRACE', 'is not set')] # refers to LOCKDOWN (permissive)
     l += [KconfigCheck('cut_attack_surface', 'my', 'LIVEPATCH', 'is not set')]
     l += [KconfigCheck('cut_attack_surface', 'my', 'IP_DCCP', 'is not set')]
@@ -468,9 +470,6 @@ def add_cmdline_checks(l, arch):
     l += [OR(CmdlineCheck('self_protection', 'defconfig', 'kpti', 'is not off'),
              AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
                  CmdlineCheck('self_protection', 'defconfig', 'kpti', 'is not set')))]
-    l += [OR(CmdlineCheck('self_protection', 'defconfig', 'kvm.nx_huge_pages', 'is not off'),
-             AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
-                 CmdlineCheck('self_protection', 'defconfig', 'kvm.nx_huge_pages', 'is not set')))]
     if arch == 'ARM64':
         l += [OR(CmdlineCheck('self_protection', 'defconfig', 'ssbd', 'kernel'),
                  CmdlineCheck('self_protection', 'my', 'ssbd', 'force-on'),
@@ -486,6 +485,12 @@ def add_cmdline_checks(l, arch):
     # 'self_protection', 'kspp'
     l += [CmdlineCheck('self_protection', 'kspp', 'nosmt', 'is present')]
     l += [CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt')] # 'nosmt' by kspp + 'auto' by defconfig
+    l += [CmdlineCheck('self_protection', 'kspp', 'slab_merge', 'is not set')] # consequence of 'slab_nomerge' by kspp
+    l += [CmdlineCheck('self_protection', 'kspp', 'slub_merge', 'is not set')] # consequence of 'slab_nomerge' by kspp
+    l += [OR(CmdlineCheck('self_protection', 'kspp', 'slab_nomerge', 'is present'),
+             AND(KconfigCheck('self_protection', 'clipos', 'SLAB_MERGE_DEFAULT', 'is not set'),
+                 CmdlineCheck('self_protection', 'kspp', 'slab_merge', 'is not set'),
+                 CmdlineCheck('self_protection', 'kspp', 'slub_merge', 'is not set')))]
     l += [OR(CmdlineCheck('self_protection', 'kspp', 'init_on_alloc', '1'),
              AND(KconfigCheck('self_protection', 'kspp', 'INIT_ON_ALLOC_DEFAULT_ON', 'y'),
                  CmdlineCheck('self_protection', 'kspp', 'init_on_alloc', 'is not set')))]
@@ -495,10 +500,6 @@ def add_cmdline_checks(l, arch):
              AND(CmdlineCheck('self_protection', 'kspp', 'page_poison', '1'),
                  KconfigCheck('self_protection', 'kspp', 'PAGE_POISONING_ZERO', 'y'),
                  CmdlineCheck('self_protection', 'kspp', 'slub_debug', 'P')))]
-    l += [OR(CmdlineCheck('self_protection', 'kspp', 'slab_nomerge', 'is present'),
-             AND(KconfigCheck('self_protection', 'clipos', 'SLAB_MERGE_DEFAULT', 'is not set'),
-                 CmdlineCheck('self_protection', 'kspp', 'slab_merge', 'is not set'),
-                 CmdlineCheck('self_protection', 'clipos', 'slub_merge', 'is not set')))]
     l += [OR(CmdlineCheck('self_protection', 'kspp', 'iommu.strict', '1'),
              AND(KconfigCheck('self_protection', 'kspp', 'IOMMU_DEFAULT_DMA_STRICT', 'y'),
                  CmdlineCheck('self_protection', 'kspp', 'iommu.strict', 'is not set')))]
@@ -547,47 +548,27 @@ def add_cmdline_checks(l, arch):
     l += [CmdlineCheck('cut_attack_surface', 'my', 'sysrq_always_enabled', 'is not set')]
 
 
+no_kstrtobool_options = [
+    'debugfs', # See debugfs_kernel() in fs/debugfs/inode.c
+    'mitigations', # See mitigations_parse_cmdline() in kernel/cpu.c
+    'pti', # See pti_check_boottime_disable() in arch/x86/mm/pti.c
+    'spectre_v2', # See spectre_v2_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
+    'spectre_v2_user', # See spectre_v2_parse_user_cmdline() in arch/x86/kernel/cpu/bugs.c
+    'spec_store_bypass_disable', # See ssb_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
+    'l1tf', # See l1tf_cmdline() in arch/x86/kernel/cpu/bugs.c
+    'mds', # See mds_cmdline() in arch/x86/kernel/cpu/bugs.c
+    'tsx_async_abort', # See tsx_async_abort_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
+    'srbds', # See srbds_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
+    'mmio_stale_data', # See mmio_stale_data_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
+    'retbleed', # See retbleed_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
+    'tsx' # See tsx_init() in arch/x86/kernel/cpu/tsx.c
+]
+
+
 def normalize_cmdline_options(option, value):
     # Don't normalize the cmdline option values if
     # the Linux kernel doesn't use kstrtobool() for them
-    if option == 'debugfs':
-        # See debugfs_kernel() in fs/debugfs/inode.c
-        return value
-    if option == 'mitigations':
-        # See mitigations_parse_cmdline() in kernel/cpu.c
-        return value
-    if option == 'pti':
-        # See pti_check_boottime_disable() in arch/x86/mm/pti.c
-        return value
-    if option == 'spectre_v2':
-        # See spectre_v2_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
-        return value
-    if option == 'spectre_v2_user':
-        # See spectre_v2_parse_user_cmdline() in arch/x86/kernel/cpu/bugs.c
-        return value
-    if option == 'spec_store_bypass_disable':
-        # See ssb_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
-        return value
-    if option == 'l1tf':
-        # See l1tf_cmdline() in arch/x86/kernel/cpu/bugs.c
-        return value
-    if option == 'mds':
-        # See mds_cmdline() in arch/x86/kernel/cpu/bugs.c
-        return value
-    if option == 'tsx_async_abort':
-        # See tsx_async_abort_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
-        return value
-    if option == 'srbds':
-        # See srbds_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
-        return value
-    if option == 'mmio_stale_data':
-        # See mmio_stale_data_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
-        return value
-    if option == 'retbleed':
-        # See retbleed_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
-        return value
-    if option == 'tsx':
-        # See tsx_init() in arch/x86/kernel/cpu/tsx.c
+    if option in no_kstrtobool_options:
         return value
 
     # Implement a limited part of the kstrtobool() logic