From: Alexander Popov Date: Thu, 5 Jul 2018 10:54:40 +0000 (+0300) Subject: Add rules for options disabled by grsecurity X-Git-Tag: v0.5.2~93 X-Git-Url: https://jxself.org/git/?a=commitdiff_plain;h=995c93f8092cc1e28143742c87fc6600da1d96f5;p=kconfig-hardened-check.git Add rules for options disabled by grsecurity Carefully extracted from their last public patch --- diff --git a/README.md b/README.md index 1ad19fe..8d89888 100644 --- a/README.md +++ b/README.md @@ -10,7 +10,8 @@ But nobody likes checking configs manually. So let the computers do their job! __kconfig-hardened-check.py__ helps me to check the Linux kernel Kconfig option list against my hardening preferences for `x86_64`, which are based on the -[KSPP recommended settings][1] +[KSPP recommended settings][1] and last public [grsecurity][2] patch (options +which they disable). Please don't cry if my Python code looks like C. I'm just a kernel developer. @@ -86,6 +87,10 @@ Usage: ./kconfig-hardened-check.py [-p | -c ] CONFIG_COMPAT_BRK | is not set | ubuntu18 | cut_attack_surface || OK CONFIG_DEVKMEM | is not set | ubuntu18 | cut_attack_surface || OK CONFIG_COMPAT_VDSO | is not set | ubuntu18 | cut_attack_surface || OK + CONFIG_X86_PTDUMP | is not set | ubuntu18 | cut_attack_surface || OK + CONFIG_ZSMALLOC_STAT | is not set | ubuntu18 | cut_attack_surface || OK + CONFIG_PAGE_OWNER | is not set | ubuntu18 | cut_attack_surface || OK + CONFIG_DEBUG_KMEMLEAK | is not set | ubuntu18 | cut_attack_surface || OK CONFIG_IO_STRICT_DEVMEM | y | kspp | cut_attack_surface || FAIL: "is not set" CONFIG_LEGACY_VSYSCALL_NONE | y | kspp | cut_attack_surface || FAIL: "is not set" CONFIG_BINFMT_MISC | is not set | kspp | cut_attack_surface || FAIL: "m" @@ -97,24 +102,35 @@ Usage: ./kconfig-hardened-check.py [-p | -c ] CONFIG_X86_X32 | is not set | kspp | cut_attack_surface || FAIL: "y" CONFIG_MODIFY_LDT_SYSCALL | is not set | kspp | cut_attack_surface || FAIL: "y" CONFIG_HIBERNATION | is not set | kspp | cut_attack_surface || FAIL: "y" + CONFIG_KPROBES | is not set |grsecurity| cut_attack_surface || FAIL: "y" + CONFIG_UPROBES | is not set |grsecurity| cut_attack_surface || FAIL: "y" + CONFIG_GENERIC_TRACER | is not set |grsecurity| cut_attack_surface || FAIL: "y" + CONFIG_PROC_VMCORE | is not set |grsecurity| cut_attack_surface || FAIL: "y" + CONFIG_PROC_PAGE_MONITOR | is not set |grsecurity| cut_attack_surface || FAIL: "y" + CONFIG_USELIB | is not set |grsecurity| cut_attack_surface || FAIL: "y" + CONFIG_CHECKPOINT_RESTORE | is not set |grsecurity| cut_attack_surface || FAIL: "y" + CONFIG_USERFAULTFD | is not set |grsecurity| cut_attack_surface || FAIL: "y" + CONFIG_HWPOISON_INJECT | is not set |grsecurity| cut_attack_surface || FAIL: "m" + CONFIG_MEM_SOFT_DIRTY | is not set |grsecurity| cut_attack_surface || FAIL: "y" + CONFIG_DEVPORT | is not set |grsecurity| cut_attack_surface || FAIL: "y" + CONFIG_DEBUG_FS | is not set |grsecurity| cut_attack_surface || FAIL: "y" + CONFIG_NOTIFIER_ERROR_INJECTION | is not set |grsecurity| cut_attack_surface || FAIL: "m" CONFIG_KEXEC_FILE | is not set | my | cut_attack_surface || FAIL: "y" CONFIG_LIVEPATCH | is not set | my | cut_attack_surface || FAIL: "y" CONFIG_USER_NS | is not set | my | cut_attack_surface || FAIL: "y" CONFIG_IP_DCCP | is not set | my | cut_attack_surface || FAIL: "m" CONFIG_IP_SCTP | is not set | my | cut_attack_surface || FAIL: "m" CONFIG_FTRACE | is not set | my | cut_attack_surface || FAIL: "y" - CONFIG_KPROBES | is not set | my | cut_attack_surface || FAIL: "y" CONFIG_PROFILING | is not set | my | cut_attack_surface || FAIL: "y" - CONFIG_UPROBES | is not set | my | cut_attack_surface || FAIL: "y" CONFIG_BPF_JIT | is not set | my | cut_attack_surface || FAIL: "y" CONFIG_BPF_SYSCALL | is not set | my | cut_attack_surface || FAIL: "y" CONFIG_ARCH_MMAP_RND_BITS | 32 | my |userspace_protection|| FAIL: "28" CONFIG_LKDTM | m | my | feature_test || FAIL: "is not set" -[-] config check is NOT PASSED: 44 errors +[-] config check is NOT PASSED: 55 errors ``` __Go and fix them all!__ [1]: http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings - +[2]: https://grsecurity.net/ diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py index 183cbe3..4cd3527 100755 --- a/kconfig-hardened-check.py +++ b/kconfig-hardened-check.py @@ -85,6 +85,10 @@ def construct_opt_list(): opt_list.append([Opt('COMPAT_BRK', 'is not set', 'ubuntu18', 'cut_attack_surface'), '']) opt_list.append([Opt('DEVKMEM', 'is not set', 'ubuntu18', 'cut_attack_surface'), '']) opt_list.append([Opt('COMPAT_VDSO', 'is not set', 'ubuntu18', 'cut_attack_surface'), '']) + opt_list.append([Opt('X86_PTDUMP', 'is not set', 'ubuntu18', 'cut_attack_surface'), '']) + opt_list.append([Opt('ZSMALLOC_STAT', 'is not set', 'ubuntu18', 'cut_attack_surface'), '']) + opt_list.append([Opt('PAGE_OWNER', 'is not set', 'ubuntu18', 'cut_attack_surface'), '']) + opt_list.append([Opt('DEBUG_KMEMLEAK', 'is not set', 'ubuntu18', 'cut_attack_surface'), '']) opt_list.append([Opt('IO_STRICT_DEVMEM', 'y', 'kspp', 'cut_attack_surface'), '']) opt_list.append([Opt('LEGACY_VSYSCALL_NONE', 'y', 'kspp', 'cut_attack_surface'), '']) # 'vsyscall=none' @@ -98,15 +102,27 @@ def construct_opt_list(): opt_list.append([Opt('MODIFY_LDT_SYSCALL', 'is not set', 'kspp', 'cut_attack_surface'), '']) opt_list.append([Opt('HIBERNATION', 'is not set', 'kspp', 'cut_attack_surface'), '']) + opt_list.append([Opt('KPROBES', 'is not set', 'grsecurity', 'cut_attack_surface'), '']) + opt_list.append([Opt('UPROBES', 'is not set', 'grsecurity', 'cut_attack_surface'), '']) + opt_list.append([Opt('GENERIC_TRACER', 'is not set', 'grsecurity', 'cut_attack_surface'), '']) + opt_list.append([Opt('PROC_VMCORE', 'is not set', 'grsecurity', 'cut_attack_surface'), '']) + opt_list.append([Opt('PROC_PAGE_MONITOR', 'is not set', 'grsecurity', 'cut_attack_surface'), '']) + opt_list.append([Opt('USELIB', 'is not set', 'grsecurity', 'cut_attack_surface'), '']) + opt_list.append([Opt('CHECKPOINT_RESTORE', 'is not set', 'grsecurity', 'cut_attack_surface'), '']) + opt_list.append([Opt('USERFAULTFD', 'is not set', 'grsecurity', 'cut_attack_surface'), '']) + opt_list.append([Opt('HWPOISON_INJECT', 'is not set', 'grsecurity', 'cut_attack_surface'), '']) + opt_list.append([Opt('MEM_SOFT_DIRTY', 'is not set', 'grsecurity', 'cut_attack_surface'), '']) + opt_list.append([Opt('DEVPORT', 'is not set', 'grsecurity', 'cut_attack_surface'), '']) + opt_list.append([Opt('DEBUG_FS', 'is not set', 'grsecurity', 'cut_attack_surface'), '']) + opt_list.append([Opt('NOTIFIER_ERROR_INJECTION','is not set', 'grsecurity', 'cut_attack_surface'), '']) + opt_list.append([Opt('KEXEC_FILE', 'is not set', 'my', 'cut_attack_surface'), '']) opt_list.append([Opt('LIVEPATCH', 'is not set', 'my', 'cut_attack_surface'), '']) opt_list.append([Opt('USER_NS', 'is not set', 'my', 'cut_attack_surface'), '']) # user.max_user_namespaces=0 opt_list.append([Opt('IP_DCCP', 'is not set', 'my', 'cut_attack_surface'), '']) opt_list.append([Opt('IP_SCTP', 'is not set', 'my', 'cut_attack_surface'), '']) opt_list.append([Opt('FTRACE', 'is not set', 'my', 'cut_attack_surface'), '']) - opt_list.append([Opt('KPROBES', 'is not set', 'my', 'cut_attack_surface'), '']) opt_list.append([Opt('PROFILING', 'is not set', 'my', 'cut_attack_surface'), '']) - opt_list.append([Opt('UPROBES', 'is not set', 'my', 'cut_attack_surface'), '']) opt_list.append([Opt('BPF_JIT', 'is not set', 'my', 'cut_attack_surface'), '']) opt_list.append([Opt('BPF_SYSCALL', 'is not set', 'my', 'cut_attack_surface'), ''])