From: Alexander Popov Date: Sun, 9 Oct 2022 18:04:19 +0000 (+0300) Subject: Improve the HW_RANDOM_TPM check X-Git-Tag: v0.6.1~76 X-Git-Url: https://jxself.org/git/?a=commitdiff_plain;h=5d58ae21516ac9f7b92e6ba98927ec5f2bb7e073;p=kconfig-hardened-check.git Improve the HW_RANDOM_TPM check RANDOM_TRUST_BOOTLOADER and RANDOM_TRUST_CPU should be disabled if HW_RANDOM_TPM is enabled. The Clip OS description: Do not credit entropy included in Linux’s entropy pool when generated by the CPU manufacturer’s HWRNG, the bootloader or the UEFI firmware. Fast and robust initialization of Linux’s CSPRNG is instead achieved thanks to the TPM’s HWRNG. --- diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py index 3412a1a..7cc81d6 100644 --- a/kconfig_hardened_check/__init__.py +++ b/kconfig_hardened_check/__init__.py @@ -482,9 +482,12 @@ def add_kconfig_checks(l, arch): l += [OR(KconfigCheck('self_protection', 'clipos', 'EFI_DISABLE_PCI_DMA', 'y'), efi_not_set)] l += [KconfigCheck('self_protection', 'clipos', 'SLAB_MERGE_DEFAULT', 'is not set')] - l += [KconfigCheck('self_protection', 'clipos', 'RANDOM_TRUST_BOOTLOADER', 'is not set')] - l += [KconfigCheck('self_protection', 'clipos', 'RANDOM_TRUST_CPU', 'is not set')] - l += [KconfigCheck('self_protection', 'clipos', 'CONFIG_HW_RANDOM_TPM', 'y')] + hw_random_tpm_is_set = KconfigCheck('self_protection', 'clipos', 'HW_RANDOM_TPM', 'y') + l += [hw_random_tpm_is_set] + l += [AND(KconfigCheck('self_protection', 'clipos', 'RANDOM_TRUST_BOOTLOADER', 'is not set'), + hw_random_tpm_is_set)] + l += [AND(KconfigCheck('self_protection', 'clipos', 'RANDOM_TRUST_CPU', 'is not set'), + hw_random_tpm_is_set)] l += [AND(KconfigCheck('self_protection', 'clipos', 'RANDSTRUCT_PERFORMANCE', 'is not set'), KconfigCheck('self_protection', 'clipos', 'GCC_PLUGIN_RANDSTRUCT_PERFORMANCE', 'is not set'), randstruct_is_set)]