From cd3c59e2d8e925d952f9704ca519fc9bdc62db73 Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Mon, 3 Jun 2019 20:24:21 +0300 Subject: [PATCH] Add X86-specific CLIP OS recommendations for kernel self-protection Refers to the issue #19 by @HacKurx --- kconfig-hardened-check.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py index bee2953..962e120 100755 --- a/kconfig-hardened-check.py +++ b/kconfig-hardened-check.py @@ -243,6 +243,18 @@ def construct_checklist(arch): checklist.append(OptCheck('DEBUG_VIRTUAL', 'y', 'clipos', 'self_protection')) checklist.append(AND(OptCheck('GCC_PLUGIN_RANDSTRUCT_PERFORMANCE', 'is not set', 'clipos', 'self_protection'), \ randstruct_is_set)) + if debug_mode or arch == 'X86_64' or arch == 'X86_32': + checklist.append(OptCheck('RANDOM_TRUST_CPU', 'is not set', 'clipos', 'self_protection')) + checklist.append(OptCheck('MICROCODE', 'y', 'clipos', 'self_protection')) # is needed for mitigating CPU bugs + checklist.append(OptCheck('X86_MSR', 'y', 'clipos', 'self_protection')) # is needed for mitigating CPU bugs + iommu_support_is_set = OptCheck('IOMMU_SUPPORT', 'y', 'clipos', 'self_protection') # is needed for mitigating DMA attacks + checklist.append(iommu_support_is_set) + checklist.append(AND(OptCheck('INTEL_IOMMU', 'y', 'clipos', 'self_protection'), \ + iommu_support_is_set)) + checklist.append(AND(OptCheck('INTEL_IOMMU_SVM', 'y', 'clipos', 'self_protection'), \ + iommu_support_is_set)) + checklist.append(AND(OptCheck('INTEL_IOMMU_DEFAULT_ON', 'y', 'clipos', 'self_protection'), \ + iommu_support_is_set)) if debug_mode or arch == 'X86_64' or arch == 'ARM64' or arch == 'X86_32': stackleak_is_set = OptCheck('GCC_PLUGIN_STACKLEAK', 'y', 'my', 'self_protection') -- 2.31.1