From 39c7c2864c8f84218ca6faf8ba086b8fa7b2c3f6 Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Tue, 9 Nov 2021 21:02:57 +0300 Subject: [PATCH] Add more checks from grsecurity for cutting attack surface (part II) This includes: - KCMP - RSEQ - LATENCYTOP - KCOV - PROVIDE_OHCI1394_DMA_INIT - SUNRPC_DEBUG - FAIL_FUTEX - KPROBE_EVENTS - UPROBE_EVENTS - FUNCTION_TRACER - STACK_TRACER - HIST_TRIGGERS - BLK_DEV_IO_TRACE --- kconfig_hardened_check/__init__.py | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py index eec0aa4..b8b8e69 100644 --- a/kconfig_hardened_check/__init__.py +++ b/kconfig_hardened_check/__init__.py @@ -499,8 +499,13 @@ def construct_checklist(l, arch): l += [OptCheck('cut_attack_surface', 'grsecurity', 'PAGE_OWNER', 'is not set')] l += [OptCheck('cut_attack_surface', 'grsecurity', 'DEBUG_KMEMLEAK', 'is not set')] l += [OptCheck('cut_attack_surface', 'grsecurity', 'BINFMT_AOUT', 'is not set')] - l += [OptCheck('cut_attack_surface', 'grsecurity', 'UPROBES', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'KPROBE_EVENTS', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'UPROBE_EVENTS', 'is not set')] l += [OptCheck('cut_attack_surface', 'grsecurity', 'GENERIC_TRACER', 'is not set')] # refers to LOCKDOWN + l += [OptCheck('cut_attack_surface', 'grsecurity', 'FUNCTION_TRACER', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'STACK_TRACER', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'HIST_TRIGGERS', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'BLK_DEV_IO_TRACE', 'is not set')] l += [OptCheck('cut_attack_surface', 'grsecurity', 'PROC_VMCORE', 'is not set')] l += [OptCheck('cut_attack_surface', 'grsecurity', 'PROC_PAGE_MONITOR', 'is not set')] l += [OptCheck('cut_attack_surface', 'grsecurity', 'USELIB', 'is not set')] @@ -511,6 +516,7 @@ def construct_checklist(l, arch): l += [OptCheck('cut_attack_surface', 'grsecurity', 'DEVPORT', 'is not set')] # refers to LOCKDOWN l += [OptCheck('cut_attack_surface', 'grsecurity', 'DEBUG_FS', 'is not set')] # refers to LOCKDOWN l += [OptCheck('cut_attack_surface', 'grsecurity', 'NOTIFIER_ERROR_INJECTION', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'FAIL_FUTEX', 'is not set')] l += [OptCheck('cut_attack_surface', 'grsecurity', 'PUNIT_ATOM_DEBUG', 'is not set')] l += [OptCheck('cut_attack_surface', 'grsecurity', 'ACPI_CONFIGFS', 'is not set')] l += [OptCheck('cut_attack_surface', 'grsecurity', 'EDAC_DEBUG', 'is not set')] @@ -520,6 +526,12 @@ def construct_checklist(l, arch): l += [OptCheck('cut_attack_surface', 'grsecurity', 'MTD_SLRAM', 'is not set')] l += [OptCheck('cut_attack_surface', 'grsecurity', 'MTD_PHRAM', 'is not set')] l += [OptCheck('cut_attack_surface', 'grsecurity', 'IO_URING', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'KCMP', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'RSEQ', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'LATENCYTOP', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'KCOV', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'PROVIDE_OHCI1394_DMA_INIT', 'is not set')] + l += [OptCheck('cut_attack_surface', 'grsecurity', 'SUNRPC_DEBUG', 'is not set')] l += [AND(OptCheck('cut_attack_surface', 'grsecurity', 'X86_PTDUMP', 'is not set'), OptCheck('cut_attack_surface', 'my', 'PTDUMP_DEBUGFS', 'is not set'))] -- 2.31.1