Skip to content

K
kernel-hardening-checker
Commit 37429744 by Alexander Popov
Options

Add the 'page_alloc.shuffle' check

parent e9fa4333
Showing with 5 additions and 1 deletions
kconfig_hardened_check/__init__.py
...@@ -11,7 +11,6 @@ ...@@ -11,7 +11,6 @@
# #
# #
# N.B Hardening command line parameters: # N.B Hardening command line parameters:
# page_alloc.shuffle=1
# iommu=force (does it help against DMA attacks?) # iommu=force (does it help against DMA attacks?)
# slub_debug=FZ (slow) # slub_debug=FZ (slow)
# loadpin.enforce=1 # loadpin.enforce=1
...@@ -693,12 +692,17 @@ def add_cmdline_checks(l, arch): ...@@ -693,12 +692,17 @@ def add_cmdline_checks(l, arch):
l += [OR(CmdlineCheck('self_protection', 'kspp', 'iommu.passthrough', '0'), l += [OR(CmdlineCheck('self_protection', 'kspp', 'iommu.passthrough', '0'),
AND(KconfigCheck('self_protection', 'kspp', 'IOMMU_DEFAULT_PASSTHROUGH', 'is not set'), AND(KconfigCheck('self_protection', 'kspp', 'IOMMU_DEFAULT_PASSTHROUGH', 'is not set'),
CmdlineCheck('self_protection', 'kspp', 'iommu.passthrough', 'is not set')))] CmdlineCheck('self_protection', 'kspp', 'iommu.passthrough', 'is not set')))]
# The cmdline checks based on the kconfig recommendations of the KSPP project:
l += [OR(CmdlineCheck('self_protection', 'kspp', 'hardened_usercopy', '1'), l += [OR(CmdlineCheck('self_protection', 'kspp', 'hardened_usercopy', '1'),
AND(KconfigCheck('self_protection', 'kspp', 'HARDENED_USERCOPY', 'y'), AND(KconfigCheck('self_protection', 'kspp', 'HARDENED_USERCOPY', 'y'),
CmdlineCheck('self_protection', 'kspp', 'hardened_usercopy', 'is not set')))] CmdlineCheck('self_protection', 'kspp', 'hardened_usercopy', 'is not set')))]
l += [OR(CmdlineCheck('self_protection', 'kspp', 'slab_common.usercopy_fallback', '0'), l += [OR(CmdlineCheck('self_protection', 'kspp', 'slab_common.usercopy_fallback', '0'),
AND(KconfigCheck('self_protection', 'kspp', 'HARDENED_USERCOPY_FALLBACK', 'is not set'), AND(KconfigCheck('self_protection', 'kspp', 'HARDENED_USERCOPY_FALLBACK', 'is not set'),
CmdlineCheck('self_protection', 'kspp', 'slab_common.usercopy_fallback', 'is not set')))] CmdlineCheck('self_protection', 'kspp', 'slab_common.usercopy_fallback', 'is not set')))]
l += [OR(CmdlineCheck('self_protection', 'kspp', 'page_alloc.shuffle', '1'),
AND(KconfigCheck('self_protection', 'kspp', 'SHUFFLE_PAGE_ALLOCATOR', 'y'),
CmdlineCheck('self_protection', 'kspp', 'page_alloc.shuffle', 'is not set')))]
# The end
if arch in ('X86_64', 'ARM64', 'X86_32'): if arch in ('X86_64', 'ARM64', 'X86_32'):
l += [OR(CmdlineCheck('self_protection', 'kspp', 'randomize_kstack_offset', '1'), l += [OR(CmdlineCheck('self_protection', 'kspp', 'randomize_kstack_offset', '1'),
AND(KconfigCheck('self_protection', 'kspp', 'RANDOMIZE_KSTACK_OFFSET_DEFAULT', 'y'), AND(KconfigCheck('self_protection', 'kspp', 'RANDOMIZE_KSTACK_OFFSET_DEFAULT', 'y'),
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment