X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=kconfig_hardened_check%2Fchecks.py;h=d61473655357d8fb223dd07ed4999f5762061b34;hb=d58e674ecffe074f5210aa7300114f3fb97ed0d1;hp=5b917bfbfd41d5cc0f8dc781df6f512c0de51ea6;hpb=328a89c7703915bc9c8eb6e66eebb6944caf94bb;p=kconfig-hardened-check.git

diff --git a/kconfig_hardened_check/checks.py b/kconfig_hardened_check/checks.py
index 5b917bf..d614736 100644
--- a/kconfig_hardened_check/checks.py
+++ b/kconfig_hardened_check/checks.py
@@ -1,5 +1,15 @@
 #!/usr/bin/python3
 
+"""
+This tool helps me to check Linux kernel options against
+my security hardening preferences for X86_64, ARM64, X86_32, and ARM.
+Let the computers do their job!
+
+Author: Alexander Popov <alex.popov@linux.com>
+
+This module contains knowledge for checks.
+"""
+
 # N.B. Hardening sysctls:
 #    kernel.kptr_restrict=2 (or 1?)
 #    kernel.dmesg_restrict=1 (also see the kconfig option)
@@ -33,8 +43,8 @@
 #    amd_iommu=on
 #    efi=disable_early_pci_dma
 
-# pylint: disable=missing-module-docstring,missing-class-docstring,missing-function-docstring
-# pylint: disable=line-too-long,invalid-name,too-many-branches,too-many-statements
+# pylint: disable=missing-function-docstring,line-too-long,invalid-name
+# pylint: disable=too-many-branches,too-many-statements
 
 from .engine import KconfigCheck, CmdlineCheck, VersionCheck, OR, AND
 
@@ -429,31 +439,40 @@ def add_cmdline_checks(l, arch):
     l += [CmdlineCheck('self_protection', 'defconfig', 'arm64.nopauth', 'is not set')]
     l += [CmdlineCheck('self_protection', 'defconfig', 'arm64.nomte', 'is not set')]
     l += [OR(CmdlineCheck('self_protection', 'defconfig', 'spectre_v2', 'is not off'),
-             CmdlineCheck('self_protection', 'defconfig', 'spectre_v2', 'is not set'))]
+             AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+                 CmdlineCheck('self_protection', 'defconfig', 'spectre_v2', 'is not set')))]
     l += [OR(CmdlineCheck('self_protection', 'defconfig', 'spectre_v2_user', 'is not off'),
-             CmdlineCheck('self_protection', 'defconfig', 'spectre_v2_user', 'is not set'))]
+             AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+                 CmdlineCheck('self_protection', 'defconfig', 'spectre_v2_user', 'is not set')))]
     l += [OR(CmdlineCheck('self_protection', 'defconfig', 'spec_store_bypass_disable', 'is not off'),
-             CmdlineCheck('self_protection', 'defconfig', 'spec_store_bypass_disable', 'is not set'))]
+             AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+                 CmdlineCheck('self_protection', 'defconfig', 'spec_store_bypass_disable', 'is not set')))]
     l += [OR(CmdlineCheck('self_protection', 'defconfig', 'l1tf', 'is not off'),
-             CmdlineCheck('self_protection', 'defconfig', 'l1tf', 'is not set'))]
+             AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+                 CmdlineCheck('self_protection', 'defconfig', 'l1tf', 'is not set')))]
     l += [OR(CmdlineCheck('self_protection', 'defconfig', 'mds', 'is not off'),
-             CmdlineCheck('self_protection', 'defconfig', 'mds', 'is not set'))]
+             AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+                 CmdlineCheck('self_protection', 'defconfig', 'mds', 'is not set')))]
     l += [OR(CmdlineCheck('self_protection', 'defconfig', 'tsx_async_abort', 'is not off'),
-             CmdlineCheck('self_protection', 'defconfig', 'tsx_async_abort', 'is not set'))]
+             AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+                 CmdlineCheck('self_protection', 'defconfig', 'tsx_async_abort', 'is not set')))]
     l += [OR(CmdlineCheck('self_protection', 'defconfig', 'srbds', 'is not off'),
-             CmdlineCheck('self_protection', 'defconfig', 'srbds', 'is not set'))]
+             AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+                 CmdlineCheck('self_protection', 'defconfig', 'srbds', 'is not set')))]
     l += [OR(CmdlineCheck('self_protection', 'defconfig', 'mmio_stale_data', 'is not off'),
-             CmdlineCheck('self_protection', 'defconfig', 'mmio_stale_data', 'is not set'))]
+             AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+                 CmdlineCheck('self_protection', 'defconfig', 'mmio_stale_data', 'is not set')))]
     l += [OR(CmdlineCheck('self_protection', 'defconfig', 'retbleed', 'is not off'),
-             CmdlineCheck('self_protection', 'defconfig', 'retbleed', 'is not set'))]
+             AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+                 CmdlineCheck('self_protection', 'defconfig', 'retbleed', 'is not set')))]
     l += [OR(CmdlineCheck('self_protection', 'defconfig', 'kpti', 'is not off'),
-             CmdlineCheck('self_protection', 'defconfig', 'kpti', 'is not set'))]
-    l += [OR(CmdlineCheck('self_protection', 'defconfig', 'kvm.nx_huge_pages', 'is not off'),
-             CmdlineCheck('self_protection', 'defconfig', 'kvm.nx_huge_pages', 'is not set'))]
+             AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+                 CmdlineCheck('self_protection', 'defconfig', 'kpti', 'is not set')))]
     if arch == 'ARM64':
         l += [OR(CmdlineCheck('self_protection', 'defconfig', 'ssbd', 'kernel'),
                  CmdlineCheck('self_protection', 'my', 'ssbd', 'force-on'),
-                 CmdlineCheck('self_protection', 'defconfig', 'ssbd', 'is not set'))]
+                 AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'),
+                     CmdlineCheck('self_protection', 'defconfig', 'ssbd', 'is not set')))]
         l += [OR(CmdlineCheck('self_protection', 'defconfig', 'rodata', 'full'),
                  AND(KconfigCheck('self_protection', 'defconfig', 'RODATA_FULL_DEFAULT_ENABLED', 'y'),
                      CmdlineCheck('self_protection', 'defconfig', 'rodata', 'is not set')))]
@@ -464,6 +483,12 @@ def add_cmdline_checks(l, arch):
     # 'self_protection', 'kspp'
     l += [CmdlineCheck('self_protection', 'kspp', 'nosmt', 'is present')]
     l += [CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt')] # 'nosmt' by kspp + 'auto' by defconfig
+    l += [CmdlineCheck('self_protection', 'kspp', 'slab_merge', 'is not set')] # consequence of 'slab_nomerge' by kspp
+    l += [CmdlineCheck('self_protection', 'kspp', 'slub_merge', 'is not set')] # consequence of 'slab_nomerge' by kspp
+    l += [OR(CmdlineCheck('self_protection', 'kspp', 'slab_nomerge', 'is present'),
+             AND(KconfigCheck('self_protection', 'clipos', 'SLAB_MERGE_DEFAULT', 'is not set'),
+                 CmdlineCheck('self_protection', 'kspp', 'slab_merge', 'is not set'),
+                 CmdlineCheck('self_protection', 'kspp', 'slub_merge', 'is not set')))]
     l += [OR(CmdlineCheck('self_protection', 'kspp', 'init_on_alloc', '1'),
              AND(KconfigCheck('self_protection', 'kspp', 'INIT_ON_ALLOC_DEFAULT_ON', 'y'),
                  CmdlineCheck('self_protection', 'kspp', 'init_on_alloc', 'is not set')))]
@@ -473,10 +498,6 @@ def add_cmdline_checks(l, arch):
              AND(CmdlineCheck('self_protection', 'kspp', 'page_poison', '1'),
                  KconfigCheck('self_protection', 'kspp', 'PAGE_POISONING_ZERO', 'y'),
                  CmdlineCheck('self_protection', 'kspp', 'slub_debug', 'P')))]
-    l += [OR(CmdlineCheck('self_protection', 'kspp', 'slab_nomerge', 'is present'),
-             AND(KconfigCheck('self_protection', 'clipos', 'SLAB_MERGE_DEFAULT', 'is not set'),
-                 CmdlineCheck('self_protection', 'kspp', 'slab_merge', 'is not set'),
-                 CmdlineCheck('self_protection', 'clipos', 'slub_merge', 'is not set')))]
     l += [OR(CmdlineCheck('self_protection', 'kspp', 'iommu.strict', '1'),
              AND(KconfigCheck('self_protection', 'kspp', 'IOMMU_DEFAULT_DMA_STRICT', 'y'),
                  CmdlineCheck('self_protection', 'kspp', 'iommu.strict', 'is not set')))]
@@ -525,47 +546,27 @@ def add_cmdline_checks(l, arch):
     l += [CmdlineCheck('cut_attack_surface', 'my', 'sysrq_always_enabled', 'is not set')]
 
 
+no_kstrtobool_options = [
+    'debugfs', # See debugfs_kernel() in fs/debugfs/inode.c
+    'mitigations', # See mitigations_parse_cmdline() in kernel/cpu.c
+    'pti', # See pti_check_boottime_disable() in arch/x86/mm/pti.c
+    'spectre_v2', # See spectre_v2_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
+    'spectre_v2_user', # See spectre_v2_parse_user_cmdline() in arch/x86/kernel/cpu/bugs.c
+    'spec_store_bypass_disable', # See ssb_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
+    'l1tf', # See l1tf_cmdline() in arch/x86/kernel/cpu/bugs.c
+    'mds', # See mds_cmdline() in arch/x86/kernel/cpu/bugs.c
+    'tsx_async_abort', # See tsx_async_abort_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
+    'srbds', # See srbds_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
+    'mmio_stale_data', # See mmio_stale_data_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
+    'retbleed', # See retbleed_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
+    'tsx' # See tsx_init() in arch/x86/kernel/cpu/tsx.c
+]
+
+
 def normalize_cmdline_options(option, value):
     # Don't normalize the cmdline option values if
     # the Linux kernel doesn't use kstrtobool() for them
-    if option == 'debugfs':
-        # See debugfs_kernel() in fs/debugfs/inode.c
-        return value
-    if option == 'mitigations':
-        # See mitigations_parse_cmdline() in kernel/cpu.c
-        return value
-    if option == 'pti':
-        # See pti_check_boottime_disable() in arch/x86/mm/pti.c
-        return value
-    if option == 'spectre_v2':
-        # See spectre_v2_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
-        return value
-    if option == 'spectre_v2_user':
-        # See spectre_v2_parse_user_cmdline() in arch/x86/kernel/cpu/bugs.c
-        return value
-    if option == 'spec_store_bypass_disable':
-        # See ssb_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
-        return value
-    if option == 'l1tf':
-        # See l1tf_cmdline() in arch/x86/kernel/cpu/bugs.c
-        return value
-    if option == 'mds':
-        # See mds_cmdline() in arch/x86/kernel/cpu/bugs.c
-        return value
-    if option == 'tsx_async_abort':
-        # See tsx_async_abort_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
-        return value
-    if option == 'srbds':
-        # See srbds_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
-        return value
-    if option == 'mmio_stale_data':
-        # See mmio_stale_data_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
-        return value
-    if option == 'retbleed':
-        # See retbleed_parse_cmdline() in arch/x86/kernel/cpu/bugs.c
-        return value
-    if option == 'tsx':
-        # See tsx_init() in arch/x86/kernel/cpu/tsx.c
+    if option in no_kstrtobool_options:
         return value
 
     # Implement a limited part of the kstrtobool() logic