From: Alexander Popov Date: Sun, 9 Jun 2024 10:40:00 +0000 (+0300) Subject: Merge branch 'scs-pac' X-Git-Url: https://jxself.org/git/?a=commitdiff_plain;h=480c6df60ad7256eb28c49af06a1afeee4207d24;hp=f6075e933d9ec15d4b0bc216f764acbdfb51235d;p=kconfig-hardened-check.git Merge branch 'scs-pac' Refers to #131 Thanks @jvoisin --- diff --git a/.github/workflows/functional_test.sh b/.github/workflows/functional_test.sh index 106320c..ca50aaf 100644 --- a/.github/workflows/functional_test.sh +++ b/.github/workflows/functional_test.sh @@ -99,6 +99,19 @@ coverage run -a --branch bin/kernel-hardening-checker -g X86_64 -m show_ok && ex cp kernel_hardening_checker/config_files/distros/fedora_34.config ./test.config +echo ">>>>> no kconfig file <<<<<" +coverage run -a --branch bin/kernel-hardening-checker -c ./nosuchfile && exit 1 + +echo ">>>>> no cmdline file <<<<<" +coverage run -a --branch bin/kernel-hardening-checker -c ./test.config -l ./nosuchfile && exit 1 + +echo ">>>>> empty cmdline file <<<<<" +touch ./empty_file +coverage run -a --branch bin/kernel-hardening-checker -c ./test.config -l ./empty_file && exit 1 + +echo ">>>>> no sysctl file <<<<<" +coverage run -a --branch bin/kernel-hardening-checker -s ./nosuchfile && exit 1 + echo ">>>>> no kernel version <<<<<" sed '3d' test.config > error.config coverage run -a --branch bin/kernel-hardening-checker -c error.config && exit 1 @@ -147,7 +160,6 @@ echo 'some strange line' >> error_sysctls coverage run -a --branch bin/kernel-hardening-checker -c test.config -s error_sysctls && exit 1 echo ">>>>> invalid sysctl file <<<<<" -touch empty_file coverage run -a --branch bin/kernel-hardening-checker -c test.config -s empty_file && exit 1 echo "The end of the functional tests" diff --git a/kernel_hardening_checker/__init__.py b/kernel_hardening_checker/__init__.py index 91742c3..5893fab 100644 --- a/kernel_hardening_checker/__init__.py +++ b/kernel_hardening_checker/__init__.py @@ -10,6 +10,7 @@ This module performs input/output. # pylint: disable=missing-function-docstring,line-too-long,too-many-branches,too-many-statements +import os import gzip import sys from argparse import ArgumentParser @@ -26,9 +27,12 @@ __version__ = '0.6.6' def _open(file: str) -> TextIO: - if file.endswith('.gz'): - return gzip.open(file, 'rt', encoding='utf-8') - return open(file, 'rt', encoding='utf-8') + try: + if file.endswith('.gz'): + return gzip.open(file, 'rt', encoding='utf-8') + return open(file, 'rt', encoding='utf-8') + except FileNotFoundError: + sys.exit(f'[!] ERROR: unable to open {file}, are you sure it exists?') def detect_arch(fname: str, archs: List[str]) -> Tuple[StrOrNone, str]: @@ -165,8 +169,14 @@ def parse_kconfig_file(_mode: StrOrNone, parsed_options: Dict[str, str], fname: def parse_cmdline_file(mode: StrOrNone, parsed_options: Dict[str, str], fname: str) -> None: + if not os.path.isfile(fname): + sys.exit(f'[!] ERROR: unable to open {fname}, are you sure it exists?') + with open(fname, 'r', encoding='utf-8') as f: line = f.readline() + if not line: + sys.exit(f'[!] ERROR: empty "{fname}"') + opts = line.split() line = f.readline() @@ -187,6 +197,9 @@ def parse_cmdline_file(mode: StrOrNone, parsed_options: Dict[str, str], fname: s def parse_sysctl_file(mode: StrOrNone, parsed_options: Dict[str, str], fname: str) -> None: + if not os.path.isfile(fname): + sys.exit(f'[!] ERROR: unable to open {fname}, are you sure it exists?') + with open(fname, 'r', encoding='utf-8') as f: sysctl_pattern = re.compile(r"[a-zA-Z0-9/\._-]+ =.*$") for line in f.readlines(): diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py index 672ea7e..d3d5a83 100644 --- a/kernel_hardening_checker/checks.py +++ b/kernel_hardening_checker/checks.py @@ -65,11 +65,9 @@ def add_kconfig_checks(l: List[ChecklistObjType], arch: str) -> None: if arch in ('X86_64', 'ARM64', 'ARM'): l += [vmap_stack_is_set] if arch in ('X86_64', 'X86_32'): - l += [KconfigCheck('self_protection', 'defconfig', 'SPECULATION_MITIGATIONS', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'DEBUG_WX', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'WERROR', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'X86_MCE', 'y')] - l += [KconfigCheck('self_protection', 'defconfig', 'RETPOLINE', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'SYN_COOKIES', 'y')] # another reason? microcode_is_set = KconfigCheck('self_protection', 'defconfig', 'MICROCODE', 'y') l += [microcode_is_set] # is needed for mitigating CPU bugs @@ -89,16 +87,26 @@ def add_kconfig_checks(l: List[ChecklistObjType], arch: str) -> None: cpu_sup_intel_not_set)] l += [OR(KconfigCheck('self_protection', 'defconfig', 'X86_MCE_AMD', 'y'), cpu_sup_amd_not_set)] + l += [OR(KconfigCheck('self_protection', 'defconfig', 'CPU_MITIGATIONS', 'y'), + KconfigCheck('self_protection', 'defconfig', 'SPECULATION_MITIGATIONS', 'y'))] + l += [OR(KconfigCheck('self_protection', 'defconfig', 'MITIGATION_RETPOLINE', 'y'), + KconfigCheck('self_protection', 'defconfig', 'RETPOLINE', 'y'))] + l += [OR(KconfigCheck('self_protection', 'defconfig', 'MITIGATION_RFDS', 'y'), + cpu_sup_intel_not_set)] + l += [OR(KconfigCheck('self_protection', 'defconfig', 'MITIGATION_SPECTRE_BHI', 'y'), + cpu_sup_intel_not_set)] if arch in ('ARM64', 'ARM'): l += [KconfigCheck('self_protection', 'defconfig', 'HW_RANDOM_TPM', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'IOMMU_DEFAULT_DMA_STRICT', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'IOMMU_DEFAULT_PASSTHROUGH', 'is not set')] # true if IOMMU_DEFAULT_DMA_STRICT is set l += [KconfigCheck('self_protection', 'defconfig', 'STACKPROTECTOR_PER_TASK', 'y')] if arch == 'X86_64': - l += [KconfigCheck('self_protection', 'defconfig', 'PAGE_TABLE_ISOLATION', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'RANDOMIZE_MEMORY', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'X86_KERNEL_IBT', 'y')] - l += [OR(KconfigCheck('self_protection', 'defconfig', 'CPU_SRSO', 'y'), + l += [OR(KconfigCheck('self_protection', 'defconfig', 'MITIGATION_PAGE_TABLE_ISOLATION', 'y'), + KconfigCheck('self_protection', 'defconfig', 'PAGE_TABLE_ISOLATION', 'y'))] + l += [OR(KconfigCheck('self_protection', 'defconfig', 'MITIGATION_SRSO', 'y'), + KconfigCheck('self_protection', 'defconfig', 'CPU_SRSO', 'y'), cpu_sup_amd_not_set)] l += [AND(KconfigCheck('self_protection', 'defconfig', 'INTEL_IOMMU', 'y'), iommu_support_is_set)] @@ -127,6 +135,8 @@ def add_kconfig_checks(l: List[ChecklistObjType], arch: str) -> None: l += [KconfigCheck('self_protection', 'defconfig', 'DEBUG_ALIGN_RODATA', 'y')] # 'self_protection', 'kspp' + l += [KconfigCheck('self_protection', 'kspp', 'PAGE_TABLE_CHECK', 'y')] + l += [KconfigCheck('self_protection', 'kspp', 'PAGE_TABLE_CHECK_ENFORCED', 'y')] l += [KconfigCheck('self_protection', 'kspp', 'BUG_ON_DATA_CORRUPTION', 'y')] l += [KconfigCheck('self_protection', 'kspp', 'SLAB_FREELIST_HARDENED', 'y')] l += [KconfigCheck('self_protection', 'kspp', 'SLAB_FREELIST_RANDOM', 'y')] @@ -234,7 +244,8 @@ def add_kconfig_checks(l: List[ChecklistObjType], arch: str) -> None: l += [KconfigCheck('self_protection', 'kspp', 'DEFAULT_MMAP_MIN_ADDR', '32768')] l += [KconfigCheck('self_protection', 'kspp', 'SYN_COOKIES', 'y')] # another reason? if arch == 'X86_64': - l += [KconfigCheck('self_protection', 'kspp', 'SLS', 'y')] # vs CVE-2021-26341 in Straight-Line-Speculation + l += [OR(KconfigCheck('self_protection', 'kspp', 'MITIGATION_SLS', 'y'), + KconfigCheck('self_protection', 'kspp', 'SLS', 'y'))] # vs CVE-2021-26341 in Straight-Line-Speculation l += [AND(KconfigCheck('self_protection', 'kspp', 'INTEL_IOMMU_SVM', 'y'), iommu_support_is_set)] l += [AND(KconfigCheck('self_protection', 'kspp', 'AMD_IOMMU_V2', 'y'), @@ -245,9 +256,10 @@ def add_kconfig_checks(l: List[ChecklistObjType], arch: str) -> None: l += [KconfigCheck('self_protection', 'kspp', 'UNWIND_PATCH_PAC_INTO_SCS', 'y')] l += [KconfigCheck('self_protection', 'kspp', 'KASAN_HW_TAGS', 'y')] # see also: kasan=on, kasan.stacktrace=off, kasan.fault=panic if arch == 'X86_32': - l += [KconfigCheck('self_protection', 'kspp', 'PAGE_TABLE_ISOLATION', 'y')] l += [KconfigCheck('self_protection', 'kspp', 'HIGHMEM64G', 'y')] l += [KconfigCheck('self_protection', 'kspp', 'X86_PAE', 'y')] + l += [OR(KconfigCheck('self_protection', 'kspp', 'MITIGATION_PAGE_TABLE_ISOLATION', 'y'), + KconfigCheck('self_protection', 'kspp', 'PAGE_TABLE_ISOLATION', 'y'))] l += [AND(KconfigCheck('self_protection', 'kspp', 'INTEL_IOMMU', 'y'), iommu_support_is_set)] @@ -466,6 +478,10 @@ def add_cmdline_checks(l: List[ChecklistObjType], arch: str) -> None: l += [OR(CmdlineCheck('self_protection', 'defconfig', 'spectre_v2_user', 'is not off'), AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'), CmdlineCheck('self_protection', 'defconfig', 'spectre_v2_user', 'is not set')))] + l += [OR(CmdlineCheck('self_protection', 'defconfig', 'spectre_bhi', 'is not off'), + AND(KconfigCheck('self_protection', 'defconfig', 'MITIGATION_SPECTRE_BHI', 'y'), + CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'), + CmdlineCheck('self_protection', 'defconfig', 'spectre_bhi', 'is not set')))] l += [OR(CmdlineCheck('self_protection', 'defconfig', 'spec_store_bypass_disable', 'is not off'), AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'), CmdlineCheck('self_protection', 'defconfig', 'spec_store_bypass_disable', 'is not set')))] @@ -493,6 +509,10 @@ def add_cmdline_checks(l: List[ChecklistObjType], arch: str) -> None: l += [OR(CmdlineCheck('self_protection', 'defconfig', 'gather_data_sampling', 'is not off'), AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'), CmdlineCheck('self_protection', 'defconfig', 'gather_data_sampling', 'is not set')))] + l += [OR(CmdlineCheck('self_protection', 'defconfig', 'reg_file_data_sampling', 'is not off'), + AND(KconfigCheck('self_protection', 'defconfig', 'MITIGATION_RFDS', 'y'), + CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'), + CmdlineCheck('self_protection', 'defconfig', 'reg_file_data_sampling', 'is not set')))] if arch == 'ARM64': l += [OR(CmdlineCheck('self_protection', 'defconfig', 'kpti', 'is not off'), AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'), @@ -612,6 +632,7 @@ no_kstrtobool_options = [ 'pti', # See pti_check_boottime_disable() in arch/x86/mm/pti.c 'spectre_v2', # See spectre_v2_parse_cmdline() in arch/x86/kernel/cpu/bugs.c 'spectre_v2_user', # See spectre_v2_parse_user_cmdline() in arch/x86/kernel/cpu/bugs.c + 'spectre_bhi', # See spectre_bhi_parse_cmdline() in arch/x86/kernel/cpu/bugs.c 'spec_store_bypass_disable', # See ssb_parse_cmdline() in arch/x86/kernel/cpu/bugs.c 'l1tf', # See l1tf_cmdline() in arch/x86/kernel/cpu/bugs.c 'mds', # See mds_cmdline() in arch/x86/kernel/cpu/bugs.c @@ -623,6 +644,7 @@ no_kstrtobool_options = [ 'ssbd', # See parse_spectre_v4_param() in arch/arm64/kernel/proton-pack.c 'spec_rstack_overflow', # See srso_parse_cmdline() in arch/x86/kernel/cpu/bugs.c 'gather_data_sampling', # See gds_parse_cmdline() in arch/x86/kernel/cpu/bugs.c + 'reg_file_data_sampling', # See rfds_parse_cmdline() in arch/x86/kernel/cpu/bugs.c 'slub_debug', # See setup_slub_debug() in mm/slub.c 'iommu', # See iommu_setup() in arch/x86/kernel/pci-dma.c 'vsyscall', # See vsyscall_setup() in arch/x86/entry/vsyscall/vsyscall_64.c