kconfig-hardened-check.git
2 years agoDon't mention LKDTM
Alexander Popov [Thu, 21 Jul 2022 06:27:47 +0000 (09:27 +0300)]
Don't mention LKDTM

I can't recommend disabling it, because LKDTM is used to test the kernel
hardening features.

But I cant recommend enabling it, because LKDTM contains intentional
memory corruption errors. It's not for production systems.

So let's simply drop the comment about LKDTM.

2 years agoAdd info about the LKDDb project by @cateee
Alexander Popov [Sun, 17 Jul 2022 15:20:52 +0000 (18:20 +0300)]
Add info about the LKDDb project by @cateee

#68

2 years agoCheck ARM64_BTI for userspace hardening
Alexander Popov [Sun, 17 Jul 2022 14:57:19 +0000 (17:57 +0300)]
Check ARM64_BTI for userspace hardening

2 years agoCheck ARM64_PTR_AUTH for userspace hardening
Alexander Popov [Sun, 17 Jul 2022 14:52:56 +0000 (17:52 +0300)]
Check ARM64_PTR_AUTH for userspace hardening

2 years agoAdd rodata check for ARM64
Alexander Popov [Sun, 17 Jul 2022 11:03:33 +0000 (14:03 +0300)]
Add rodata check for ARM64

2 years agoAdd iommu.passthrough check
Alexander Popov [Mon, 11 Jul 2022 06:59:26 +0000 (09:59 +0300)]
Add iommu.passthrough check

2 years agoAdd IOMMU_DEFAULT_PASSTHROUGH check
Alexander Popov [Mon, 11 Jul 2022 06:49:44 +0000 (09:49 +0300)]
Add IOMMU_DEFAULT_PASSTHROUGH check

2 years agoAdd iommu.strict check
Alexander Popov [Mon, 11 Jul 2022 06:25:07 +0000 (09:25 +0300)]
Add iommu.strict check

2 years agoAdd vsyscall check
Alexander Popov [Mon, 11 Jul 2022 05:59:37 +0000 (08:59 +0300)]
Add vsyscall check

2 years agoDon't add CmdlineChecks in add_kconfig_checks() to avoid wrong results
Alexander Popov [Sat, 9 Jul 2022 22:16:03 +0000 (01:16 +0300)]
Don't add CmdlineChecks in add_kconfig_checks() to avoid wrong results

2 years agoAdd slub_debug check
Alexander Popov [Sat, 9 Jul 2022 22:15:21 +0000 (01:15 +0300)]
Add slub_debug check

2 years agoAdd the release badge
Alexander Popov [Fri, 8 Jul 2022 23:48:40 +0000 (02:48 +0300)]
Add the release badge

2 years agoAdd the init_on_free check
Alexander Popov [Mon, 20 Jun 2022 18:08:25 +0000 (21:08 +0300)]
Add the init_on_free check

2 years agoAdd the page_poison check required for PAGE_POISONING_ZERO
Alexander Popov [Mon, 20 Jun 2022 18:01:15 +0000 (21:01 +0300)]
Add the page_poison check required for PAGE_POISONING_ZERO

2 years agoRewrite the slab_nomerge check
Alexander Popov [Mon, 20 Jun 2022 17:33:18 +0000 (20:33 +0300)]
Rewrite the slab_nomerge check

Use the presence check for slab_nomerge.
Also check that slab_merge is not set.

2 years agoRewrite the randomize_kstack_offset check
Alexander Popov [Mon, 20 Jun 2022 17:13:50 +0000 (20:13 +0300)]
Rewrite the randomize_kstack_offset check

Reusing "is not set" for CmdlineCheck is a nice hack.

2 years agoCheck that a kconfig option value is sane
Alexander Popov [Sun, 19 Jun 2022 20:45:41 +0000 (23:45 +0300)]
Check that a kconfig option value is sane

2 years agoAdd a tricky check for init_on_alloc and INIT_ON_ALLOC_DEFAULT_ON
Alexander Popov [Sun, 19 Jun 2022 19:49:03 +0000 (22:49 +0300)]
Add a tricky check for init_on_alloc and INIT_ON_ALLOC_DEFAULT_ON

Nice!

2 years agoMove the add_cmdline_checks() call earlier
Alexander Popov [Sun, 19 Jun 2022 19:38:23 +0000 (22:38 +0300)]
Move the add_cmdline_checks() call earlier

populate_with_data() must be called after all checks have been added.

2 years agoDon't check __name__ in __init__.py (it can't run separately anyway)
Alexander Popov [Wed, 8 Jun 2022 22:54:42 +0000 (01:54 +0300)]
Don't check __name__ in __init__.py (it can't run separately anyway)

2 years agoFix the pylint warning about isinstance
Alexander Popov [Wed, 8 Jun 2022 22:47:07 +0000 (01:47 +0300)]
Fix the pylint warning about isinstance

2 years agoDrop unneeded properties of ComplexOptCheck
Alexander Popov [Wed, 8 Jun 2022 22:32:59 +0000 (01:32 +0300)]
Drop unneeded properties of ComplexOptCheck

Thanks to the coverage info

2 years agoTurn some error conditions into assertions (part 4)
Alexander Popov [Wed, 8 Jun 2022 22:03:19 +0000 (01:03 +0300)]
Turn some error conditions into assertions (part 4)

2 years agoTurn some error conditions into assertions (part 3)
Alexander Popov [Wed, 8 Jun 2022 21:54:00 +0000 (00:54 +0300)]
Turn some error conditions into assertions (part 3)

2 years agoTurn some error conditions into assertions (part 2)
Alexander Popov [Wed, 8 Jun 2022 21:24:36 +0000 (00:24 +0300)]
Turn some error conditions into assertions (part 2)

2 years agoTurn some error conditions into assertions (part 1)
Alexander Popov [Wed, 8 Jun 2022 21:04:15 +0000 (00:04 +0300)]
Turn some error conditions into assertions (part 1)

2 years agoDrop useless checks, the ComplexOptCheck constructor has already checked this
Alexander Popov [Wed, 8 Jun 2022 17:13:42 +0000 (20:13 +0300)]
Drop useless checks, the ComplexOptCheck constructor has already checked this

2 years agogithub actions: Test error handling (part 2)
Alexander Popov [Wed, 8 Jun 2022 16:37:15 +0000 (19:37 +0300)]
github actions: Test error handling (part 2)

And also test the tool without "-l".

2 years agogithub actions: Test error handling (part 1)
Alexander Popov [Wed, 8 Jun 2022 15:17:39 +0000 (18:17 +0300)]
github actions: Test error handling (part 1)

2 years agogithub actions: Collect coverage for error handling (part 1)
Alexander Popov [Mon, 30 May 2022 22:30:42 +0000 (01:30 +0300)]
github actions: Collect coverage for error handling (part 1)

2 years agogithub actions: upgrade to codecov-action@v2
Alexander Popov [Mon, 30 May 2022 22:43:25 +0000 (01:43 +0300)]
github actions: upgrade to codecov-action@v2

2 years agoCheck that --config and --print are not used together
Alexander Popov [Mon, 30 May 2022 21:41:09 +0000 (00:41 +0300)]
Check that --config and --print are not used together

2 years agogithub actions: Collect coverage for cmdline checking
Alexander Popov [Mon, 30 May 2022 21:07:18 +0000 (00:07 +0300)]
github actions: Collect coverage for cmdline checking

2 years agogithub actions: Improve the descriptions
Alexander Popov [Mon, 30 May 2022 16:28:30 +0000 (19:28 +0300)]
github actions: Improve the descriptions

2 years agogithub actions: Improve the test output
Alexander Popov [Mon, 30 May 2022 22:54:11 +0000 (01:54 +0300)]
github actions: Improve the test output

2 years agoDrop dash-separated values from setup.cfg
Alexander Popov [Mon, 30 May 2022 16:07:09 +0000 (19:07 +0300)]
Drop dash-separated values from setup.cfg

2 years agogithub actions: Add testing with python 3.9
Alexander Popov [Mon, 30 May 2022 16:04:33 +0000 (19:04 +0300)]
github actions: Add testing with python 3.9

2 years agoMerge branch 'cmdline'
Alexander Popov [Sat, 28 May 2022 19:03:53 +0000 (22:03 +0300)]
Merge branch 'cmdline'

This is the feature for #46.

2 years agoChange the example output in README cmdline
Alexander Popov [Sat, 28 May 2022 18:06:10 +0000 (21:06 +0300)]
Change the example output in README

2 years agoDescribe the cmdline checking support in README
Alexander Popov [Sat, 28 May 2022 17:58:57 +0000 (20:58 +0300)]
Describe the cmdline checking support in README

2 years agoAdd the example config of Fedora 34
Alexander Popov [Sat, 28 May 2022 17:48:28 +0000 (20:48 +0300)]
Add the example config of Fedora 34

2 years agoCheck the pti cmdline parameter
Alexander Popov [Sat, 28 May 2022 17:42:35 +0000 (20:42 +0300)]
Check the pti cmdline parameter

2 years agoCheck the slab_nomerge cmdline parameter
Alexander Popov [Sat, 28 May 2022 17:35:12 +0000 (20:35 +0300)]
Check the slab_nomerge cmdline parameter

2 years agoCheck the randomize_kstack_offset cmdline parameter
Alexander Popov [Thu, 31 Mar 2022 17:26:45 +0000 (20:26 +0300)]
Check the randomize_kstack_offset cmdline parameter

2 years agoAdd cmdline file parsing
Alexander Popov [Mon, 28 Mar 2022 09:17:31 +0000 (12:17 +0300)]
Add cmdline file parsing

2 years agoAdd the infrastructure for cmdline checks
Alexander Popov [Sun, 27 Mar 2022 20:46:11 +0000 (23:46 +0300)]
Add the infrastructure for cmdline checks

2 years agoAdd '--cmdline' argument for the tool
Alexander Popov [Sun, 27 Mar 2022 20:30:33 +0000 (23:30 +0300)]
Add '--cmdline' argument for the tool

2 years agoAdd cmdline checks to '--print'
Alexander Popov [Sun, 27 Mar 2022 20:03:02 +0000 (23:03 +0300)]
Add cmdline checks to '--print'

2 years agoAdd the CmdlineCheck class
Alexander Popov [Sun, 27 Mar 2022 18:25:04 +0000 (21:25 +0300)]
Add the CmdlineCheck class

2 years agoAdd the comment about sysrq_always_enabled
Alexander Popov [Sun, 15 May 2022 20:21:25 +0000 (23:21 +0300)]
Add the comment about sysrq_always_enabled

Thanks to @izh1979 for the idea (and for the rodata idea too).

2 years agoAdd the comment about rodata
Alexander Popov [Sun, 15 May 2022 18:45:09 +0000 (21:45 +0300)]
Add the comment about rodata

2 years agoUpdate direct feedback from Linux kernel maintainers (#62)
Alexander Popov [Sun, 8 May 2022 13:21:31 +0000 (16:21 +0300)]
Update direct feedback from Linux kernel maintainers (#62)

2 years agoAdd the comment about arm64.nomte
Alexander Popov [Fri, 6 May 2022 22:21:21 +0000 (01:21 +0300)]
Add the comment about arm64.nomte

Thanks to @izh1979 for the idea.

2 years agoAdd the comment about kernel.randomize_va_space
Alexander Popov [Fri, 6 May 2022 22:21:00 +0000 (01:21 +0300)]
Add the comment about kernel.randomize_va_space

Thanks to @izh1979 for the idea.

2 years agoAdd the KGDB check
Alexander Popov [Fri, 6 May 2022 15:28:44 +0000 (18:28 +0300)]
Add the KGDB check

Thanks to @izh1979 for the idea.

2 years agoAdd RANDOMIZE_MODULE_REGION_FULL for arm64
Alexander Popov [Fri, 6 May 2022 15:20:56 +0000 (18:20 +0300)]
Add RANDOMIZE_MODULE_REGION_FULL for arm64

Thanks to @izh1979 for the idea.

2 years agoUpdate the README v0.5.17
Alexander Popov [Thu, 28 Apr 2022 11:49:52 +0000 (14:49 +0300)]
Update the README

Ready for the release 0.5.17.

2 years agoMerge pull request #62 from evdenis/master
Alexander Popov [Thu, 28 Apr 2022 11:38:31 +0000 (14:38 +0300)]
Merge pull request #62 from evdenis/master

Add BLK_DEV_FD_RAWCMD

Thanks @evdenis!

2 years agoAdd the type property for OptCheck to fix a pylint error
Alexander Popov [Thu, 28 Apr 2022 11:31:00 +0000 (14:31 +0300)]
Add the type property for OptCheck to fix a pylint error

Fix for kconfig_hardened_check/__init__.py:125:68: E1101:
  Instance of 'OptCheck' has no 'type' member (no-member)

2 years agoAdd BLK_DEV_FD_RAWCMD 62/head
Denis Efremov [Wed, 27 Apr 2022 18:09:41 +0000 (21:09 +0300)]
Add BLK_DEV_FD_RAWCMD

See commit torvalds/linux@233087ca0636 ("floppy: disable FDRAWCMD by default")

Signed-off-by: Denis Efremov <efremov@linux.com>
2 years agoAdd the STACKPROTECTOR check from KSPP
Alexander Popov [Fri, 22 Apr 2022 10:13:05 +0000 (13:13 +0300)]
Add the STACKPROTECTOR check from KSPP

Thanks to @izh1979 for the idea.

2 years agoDrop the ARM64_MTE check for userspace hardening
Alexander Popov [Fri, 22 Apr 2022 09:50:34 +0000 (12:50 +0300)]
Drop the ARM64_MTE check for userspace hardening

It is moved to kernel self protection.

Thanks to @izh1979 for the idea.

2 years agoSeparate out checking SECURITY_WRITABLE_HOOKS and SECURITY_SELINUX_DISABLE
Alexander Popov [Fri, 22 Apr 2022 09:34:49 +0000 (12:34 +0300)]
Separate out checking SECURITY_WRITABLE_HOOKS and SECURITY_SELINUX_DISABLE

Thanks to @izh1979 for the idea.
Combining these checks with OR is not correct.

2 years agoFix the arch condition for the SCHED_CORE check
Alexander Popov [Fri, 22 Apr 2022 07:35:10 +0000 (10:35 +0300)]
Fix the arch condition for the SCHED_CORE check

2 years agoAdd the KSPP recommendation of ZERO_CALL_USED_REGS
Alexander Popov [Fri, 22 Apr 2022 07:23:23 +0000 (10:23 +0300)]
Add the KSPP recommendation of ZERO_CALL_USED_REGS

2 years agoDisabling X86_MSR is recommended by KSPP
Alexander Popov [Fri, 22 Apr 2022 07:23:04 +0000 (10:23 +0300)]
Disabling X86_MSR is recommended by KSPP

2 years agoFix the bug in the verdict description for ComplexOptCheck
Alexander Popov [Wed, 20 Apr 2022 16:25:16 +0000 (19:25 +0300)]
Fix the bug in the verdict description for ComplexOptCheck

Before the fix:
CONFIG_EFI_DISABLE_PCI_DMA | kconfig | y | clipos | self_protection | OK: not found

After the fix:
CONFIG_EFI_DISABLE_PCI_DMA | kconfig | y | clipos | self_protection | OK: CONFIG_EFI not found

Also added the assertions preventing similar bugs in future.

2 years agoAdditional check for TYPES_OF_CHECKS
Alexander Popov [Thu, 31 Mar 2022 16:38:25 +0000 (19:38 +0300)]
Additional check for TYPES_OF_CHECKS

2 years agoDrop PresenceCheck; OptCheck without 'expected' parameter can do the job
Alexander Popov [Mon, 28 Mar 2022 12:12:36 +0000 (15:12 +0300)]
Drop PresenceCheck; OptCheck without 'expected' parameter can do the job

2 years agoUpdate the KSPP recommendations in the config_files
Alexander Popov [Wed, 20 Apr 2022 14:59:38 +0000 (17:59 +0300)]
Update the KSPP recommendations in the config_files

2 years agoAdd the KSPP recommendation of SCHED_CORE
Alexander Popov [Wed, 20 Apr 2022 14:42:49 +0000 (17:42 +0300)]
Add the KSPP recommendation of SCHED_CORE

2 years agoAdd the KSPP recommendation of IOMMU_DEFAULT_DMA_STRICT
Alexander Popov [Wed, 20 Apr 2022 14:24:32 +0000 (17:24 +0300)]
Add the KSPP recommendation of IOMMU_DEFAULT_DMA_STRICT

2 years agoAdd the KSPP recommendation of WERROR
Alexander Popov [Wed, 20 Apr 2022 14:16:58 +0000 (17:16 +0300)]
Add the KSPP recommendation of WERROR

2 years agoAdd the KSPP recommendation of KFENCE
Alexander Popov [Wed, 20 Apr 2022 14:13:50 +0000 (17:13 +0300)]
Add the KSPP recommendation of KFENCE

2 years agoNo need in BPF_UNPRIV_DEFAULT_OFF if BPF_SYSCALL is disabled
Alexander Popov [Fri, 8 Apr 2022 21:05:38 +0000 (00:05 +0300)]
No need in BPF_UNPRIV_DEFAULT_OFF if BPF_SYSCALL is disabled

2 years agoMerge branch 'from-martin-rowe'
Alexander Popov [Fri, 8 Apr 2022 16:45:37 +0000 (19:45 +0300)]
Merge branch 'from-martin-rowe'

2 years agoAdd defconfigs for Linux v5.17
Alexander Popov [Thu, 7 Apr 2022 17:20:16 +0000 (20:20 +0300)]
Add defconfigs for Linux v5.17

2 years agoDrop unneeded return values (refactoring)
Alexander Popov [Mon, 28 Mar 2022 09:54:47 +0000 (12:54 +0300)]
Drop unneeded return values (refactoring)

2 years agoUBSAN_SANITIZE_ALL not available on ARM 60/head
Martin Rowe [Sat, 26 Mar 2022 14:20:16 +0000 (00:20 +1000)]
UBSAN_SANITIZE_ALL not available on ARM

ARCH_HAS_UBSAN_SANITIZE_ALL is not selected for arm arch, which
prevents selectiong of CONFIG_UBSAN_SANITIZE_ALL

https://github.com/torvalds/linux/blob/master/arch/arm/Kconfig
https://github.com/torvalds/linux/blob/master/lib/Kconfig.ubsan

2 years agoAdd HARDEN_BRANCH_HISTORY for arm
Alexander Popov [Sun, 20 Mar 2022 21:53:37 +0000 (00:53 +0300)]
Add HARDEN_BRANCH_HISTORY for arm

2 years agoAdd MITIGATE_SPECTRE_BRANCH_HISTORY for arm64
Alexander Popov [Sun, 20 Mar 2022 21:51:30 +0000 (00:51 +0300)]
Add MITIGATE_SPECTRE_BRANCH_HISTORY for arm64

2 years agoTHREAD_INFO_IN_TASK is available for ARM since v5.16
Alexander Popov [Fri, 18 Mar 2022 22:11:27 +0000 (01:11 +0300)]
THREAD_INFO_IN_TASK is available for ARM since v5.16

2 years agoMerge branch 'from-martin-rowe'
Alexander Popov [Fri, 18 Mar 2022 21:36:19 +0000 (00:36 +0300)]
Merge branch 'from-martin-rowe'

Refers to #59.

Thanks @cyanidium

2 years agoEFI mitigations can't be enabled if EFI is not set 59/head
Martin Rowe [Tue, 15 Mar 2022 12:38:05 +0000 (12:38 +0000)]
EFI mitigations can't be enabled if EFI is not set

Both EFI_DISABLE_PCI_DMA and RESET_ATTACK_MITIGATION depend on EFI, but if EFI is not set, neither config is required.

Useful on embedded devices that use u-boot or similar instead of EFI.

2 years agoFix the BPF_UNPRIV_DEFAULT_OFF check (it is enabled by default)
Alexander Popov [Sun, 13 Mar 2022 22:28:18 +0000 (01:28 +0300)]
Fix the BPF_UNPRIV_DEFAULT_OFF check (it is enabled by default)

2 years agoAdd CONFIG_SLS vs CVE-2021-26341 in Straight-Line-Speculation
Alexander Popov [Sun, 13 Mar 2022 18:12:23 +0000 (21:12 +0300)]
Add CONFIG_SLS vs CVE-2021-26341 in Straight-Line-Speculation

2 years agoAdd the comment that l1d_flush is a part of the l1tf option
Alexander Popov [Sun, 13 Mar 2022 17:39:06 +0000 (20:39 +0300)]
Add the comment that l1d_flush is a part of the l1tf option

2 years agoAdd BPF_UNPRIV_DEFAULT_OFF to cut_attack_surface
Alexander Popov [Sun, 13 Mar 2022 17:18:48 +0000 (20:18 +0300)]
Add BPF_UNPRIV_DEFAULT_OFF to cut_attack_surface

2 years agoUse the option type instead of calling hasattr()
Alexander Popov [Sat, 5 Mar 2022 15:44:16 +0000 (18:44 +0300)]
Use the option type instead of calling hasattr()

2 years agoMerge branch 'refactoring'
Alexander Popov [Sat, 5 Mar 2022 14:42:24 +0000 (17:42 +0300)]
Merge branch 'refactoring'

It has more preparations for solving #46.

2 years agoIntroduce the json_dump() class method refactoring
Alexander Popov [Mon, 14 Feb 2022 21:57:42 +0000 (00:57 +0300)]
Introduce the json_dump() class method

2 years agoImprove 'type' for ComplexOptCheck and PresenceCheck classes
Alexander Popov [Mon, 14 Feb 2022 21:19:42 +0000 (00:19 +0300)]
Improve 'type' for ComplexOptCheck and PresenceCheck classes

2 years agoMake populate_with_data() aware of data type
Alexander Popov [Mon, 14 Feb 2022 21:18:50 +0000 (00:18 +0300)]
Make populate_with_data() aware of data type

2 years agoAdd 'type' for PresenceCheck and VersionCheck
Alexander Popov [Mon, 14 Feb 2022 18:23:58 +0000 (21:23 +0300)]
Add 'type' for PresenceCheck and VersionCheck

2 years agoRename VerCheck to VersionCheck
Alexander Popov [Mon, 14 Feb 2022 18:22:17 +0000 (21:22 +0300)]
Rename VerCheck to VersionCheck

2 years agoAdd more ComplexOptCheck validation
Alexander Popov [Mon, 14 Feb 2022 16:50:21 +0000 (19:50 +0300)]
Add more ComplexOptCheck validation

2 years agoImprove print_unknown_options()
Alexander Popov [Mon, 14 Feb 2022 14:47:21 +0000 (17:47 +0300)]
Improve print_unknown_options()

Don't miss options behind the second level of ComplexOptCheck

2 years agoRemove 'CONFIG_' hardcoding
Alexander Popov [Mon, 14 Feb 2022 07:59:36 +0000 (10:59 +0300)]
Remove 'CONFIG_' hardcoding

2 years agoMerge branch 'refactoring'
Alexander Popov [Fri, 11 Feb 2022 22:16:44 +0000 (01:16 +0300)]
Merge branch 'refactoring'

It has preparations for solving #46.

2 years agoRefactor the OR logic code
Alexander Popov [Fri, 11 Feb 2022 22:03:06 +0000 (01:03 +0300)]
Refactor the OR logic code