From 34469ca1cd291fc75577eab81f1099f2abfc91b9 Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Wed, 17 Aug 2022 09:33:00 +0300 Subject: [PATCH] Add the debugfs check Don't normalize this option value since the Linux kernel doesn't use kstrtobool() for it. --- kconfig_hardened_check/__init__.py | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py index d8df56f..27362cc 100644 --- a/kconfig_hardened_check/__init__.py +++ b/kconfig_hardened_check/__init__.py @@ -14,7 +14,6 @@ # iommu=force (does it help against DMA attacks?) # slub_debug=FZ (slow) # loadpin.enforce=1 -# debugfs=no-mount (or off if possible) # # Mitigations of CPU vulnerabilities: # Аrch-independent: @@ -717,6 +716,10 @@ def add_cmdline_checks(l, arch): AND(KconfigCheck('cut_attack_surface', 'kspp', 'LEGACY_VSYSCALL_NONE', 'y'), CmdlineCheck('cut_attack_surface', 'kspp', 'vsyscall', 'is not set')))] + # 'cut_attack_surface', 'grsec' + # The cmdline checks compatible with the kconfig options disabled by grsecurity... + l += [OR(CmdlineCheck('cut_attack_surface', 'grsec', 'debugfs', 'off'), + KconfigCheck('cut_attack_surface', 'grsec', 'DEBUG_FS', 'is not set'))] # ... the end def print_unknown_options(checklist, parsed_options): @@ -860,12 +863,14 @@ def parse_kconfig_file(parsed_options, fname): def normalize_cmdline_options(option, value): - # Handle special cases + # Don't normalize the cmdline option values if + # the Linux kernel doesn't use kstrtobool() for them if option == 'pti': - # Don't normalize the pti value since - # the Linux kernel doesn't use kstrtobool() for pti. # See pti_check_boottime_disable() in linux/arch/x86/mm/pti.c return value + if option == 'debugfs': + # See debugfs_kernel() in fs/debugfs/inode.c + return value # Implement a limited part of the kstrtobool() logic if value in ('1', 'on', 'On', 'ON', 'y', 'Y', 'yes', 'Yes', 'YES'): -- 2.31.1