Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
K
kernel-hardening-checker
Overview
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
fact-depend
kernel-hardening-checker
Commits
66dcf26d
Commit
66dcf26d
authored
Feb 12, 2022
by
Alexander Popov
Browse files
Options
Browse Files
Download
Plain Diff
Merge branch 'refactoring'
It has preparations for solving #46.
parents
7ed482ba
3d9f2f8b
Hide whitespace changes
Inline
Side-by-side
Showing
2 changed files
with
432 additions
and
414 deletions
+432
-414
README.md
README.md
+166
-166
__init__.py
kconfig_hardened_check/__init__.py
+266
-248
No files found.
README.md
View file @
66dcf26d
...
...
@@ -83,177 +83,177 @@ CONFIG_DEVMEM | is not set | kspp | cut_atta
## Example output for `Ubuntu 20.04 LTS (Focal Fossa)` kernel config
```
$ ./bin/kconfig-hardened-check -c kconfig_hardened_check/config_files/distros/ubuntu-focal.config
$ ./bin/kconfig-hardened-check -c kconfig_hardened_check/config_files/distros/ubuntu-focal.config
[+] Config file to check: kconfig_hardened_check/config_files/distros/ubuntu-focal.config
[+] Detected architecture: X86_64
[+] Detected kernel version: 5.4
=========================================================================================================================
option name | desired val | decision | reason |
check result
option name | type |desired val | decision | reason |
check result
=========================================================================================================================
CONFIG_BUG
| y |defconfig | self_protection |
OK
CONFIG_SLUB_DEBUG
| y |defconfig | self_protection |
OK
CONFIG_GCC_PLUGINS
| y |defconfig | self_protection |
FAIL: not found
CONFIG_STACKPROTECTOR_STRONG
| y |defconfig | self_protection |
OK
CONFIG_STRICT_KERNEL_RWX
| y |defconfig | self_protection |
OK
CONFIG_STRICT_MODULE_RWX
| y |defconfig | self_protection |
OK
CONFIG_REFCOUNT_FULL
| y |defconfig | self_protection |
FAIL: "is not set"
CONFIG_IOMMU_SUPPORT
| y |defconfig | self_protection |
OK
CONFIG_RANDOMIZE_BASE
| y |defconfig | self_protection |
OK
CONFIG_THREAD_INFO_IN_TASK
| y |defconfig | self_protection |
OK
CONFIG_VMAP_STACK
| y |defconfig | self_protection |
OK
CONFIG_MICROCODE
| y |defconfig | self_protection |
OK
CONFIG_RETPOLINE
| y |defconfig | self_protection |
OK
CONFIG_X86_SMAP
| y |defconfig | self_protection |
OK
CONFIG_SYN_COOKIES
| y |defconfig | self_protection |
OK
CONFIG_X86_UMIP
| y |defconfig | self_protection |
OK: CONFIG_X86_INTEL_UMIP "y"
CONFIG_PAGE_TABLE_ISOLATION
| y |defconfig | self_protection |
OK
CONFIG_RANDOMIZE_MEMORY
| y |defconfig | self_protection |
OK
CONFIG_INTEL_IOMMU
| y |defconfig | self_protection |
OK
CONFIG_AMD_IOMMU
| y |defconfig | self_protection |
OK
CONFIG_SECURITY_DMESG_RESTRICT
| y | kspp | self_protection |
FAIL: "is not set"
CONFIG_BUG_ON_DATA_CORRUPTION
| y | kspp | self_protection |
FAIL: "is not set"
CONFIG_DEBUG_WX
| y | kspp | self_protection |
OK
CONFIG_SCHED_STACK_END_CHECK
| y | kspp | self_protection |
OK
CONFIG_SLAB_FREELIST_HARDENED
| y | kspp | self_protection |
OK
CONFIG_SLAB_FREELIST_RANDOM
| y | kspp | self_protection |
OK
CONFIG_SHUFFLE_PAGE_ALLOCATOR
| y | kspp | self_protection |
OK
CONFIG_FORTIFY_SOURCE
| y | kspp | self_protection |
OK
CONFIG_DEBUG_LIST
| y | kspp | self_protection |
FAIL: "is not set"
CONFIG_DEBUG_SG
| y | kspp | self_protection |
FAIL: "is not set"
CONFIG_DEBUG_CREDENTIALS
| y | kspp | self_protection |
FAIL: "is not set"
CONFIG_DEBUG_NOTIFIERS
| y | kspp | self_protection |
FAIL: "is not set"
CONFIG_INIT_ON_ALLOC_DEFAULT_ON
| y | kspp | self_protection |
OK
CONFIG_GCC_PLUGIN_LATENT_ENTROPY
| y | kspp | self_protection |
FAIL: not found
CONFIG_GCC_PLUGIN_RANDSTRUCT
| y | kspp | self_protection |
FAIL: not found
CONFIG_HARDENED_USERCOPY
| y | kspp | self_protection |
OK
CONFIG_HARDENED_USERCOPY_FALLBACK
| is not set | kspp | self_protection |
FAIL: "y"
CONFIG_HARDENED_USERCOPY_PAGESPAN
| is not set | kspp | self_protection |
OK
CONFIG_MODULE_SIG
| y | kspp | self_protection |
OK
CONFIG_MODULE_SIG_ALL
| y | kspp | self_protection |
OK
CONFIG_MODULE_SIG_SHA512
| y | kspp | self_protection |
OK
CONFIG_MODULE_SIG_FORCE
| y | kspp | self_protection |
FAIL: "is not set"
CONFIG_INIT_STACK_ALL_ZERO
| y | kspp | self_protection |
FAIL: not found
CONFIG_INIT_ON_FREE_DEFAULT_ON
| y | kspp | self_protection |
OK: CONFIG_PAGE_POISONING_ZERO "y"
CONFIG_GCC_PLUGIN_STACKLEAK
| y | kspp | self_protection |
FAIL: not found
CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT
| y | kspp | self_protection |
FAIL: not found
CONFIG_DEFAULT_MMAP_MIN_ADDR
| 65536 | kspp | self_protection |
OK
CONFIG_UBSAN_BOUNDS
| y |maintainer| self_protection |
FAIL: not found
CONFIG_UBSAN_SANITIZE_ALL
| y |maintainer| self_protection |
FAIL: CONFIG_UBSAN_BOUNDS not "y"
CONFIG_UBSAN_TRAP
| y |maintainer| self_protection |
FAIL: CONFIG_UBSAN_BOUNDS not "y"
CONFIG_DEBUG_VIRTUAL
| y | clipos | self_protection |
FAIL: "is not set"
CONFIG_STATIC_USERMODEHELPER
| y | clipos | self_protection |
FAIL: "is not set"
CONFIG_EFI_DISABLE_PCI_DMA
| y | clipos | self_protection |
FAIL: not found
CONFIG_SLAB_MERGE_DEFAULT
| is not set | clipos | self_protection |
FAIL: "y"
CONFIG_RANDOM_TRUST_BOOTLOADER
| is not set | clipos | self_protection |
FAIL: "y"
CONFIG_RANDOM_TRUST_CPU
| is not set | clipos | self_protection |
FAIL: "y"
CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE
| is not set | clipos | self_protection |
FAIL: CONFIG_GCC_PLUGIN_RANDSTRUCT not "y"
CONFIG_STACKLEAK_METRICS
| is not set | clipos | self_protection |
FAIL: CONFIG_GCC_PLUGIN_STACKLEAK not "y"
CONFIG_STACKLEAK_RUNTIME_DISABLE
| is not set | clipos | self_protection |
FAIL: CONFIG_GCC_PLUGIN_STACKLEAK not "y"
CONFIG_INTEL_IOMMU_DEFAULT_ON
| y | clipos | self_protection |
FAIL: "is not set"
CONFIG_INTEL_IOMMU_SVM
| y | clipos | self_protection |
OK
CONFIG_RESET_ATTACK_MITIGATION
| y | my | self_protection |
OK
CONFIG_AMD_IOMMU_V2
| y | my | self_protection |
FAIL: "m"
CONFIG_SECURITY
| y |defconfig | security_policy |
OK
CONFIG_SECURITY_YAMA
| y | kspp | security_policy |
OK
CONFIG_SECURITY_WRITABLE_HOOKS
| is not set | my | security_policy |
OK: not found
CONFIG_SECURITY_LOCKDOWN_LSM
| y | clipos | security_policy |
OK
CONFIG_SECURITY_LOCKDOWN_LSM_EARLY
| y | clipos | security_policy |
OK
CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY|
y | clipos | security_policy |
FAIL: "is not set"
CONFIG_SECURITY_SAFESETID
| y | my | security_policy |
OK
CONFIG_SECURITY_LOADPIN
| y | my | security_policy |
FAIL: "is not set"
CONFIG_SECURITY_LOADPIN_ENFORCE
| y | my | security_policy |
FAIL: CONFIG_SECURITY_LOADPIN not "y"
CONFIG_SECCOMP
| y |defconfig | cut_attack_surface |
OK
CONFIG_SECCOMP_FILTER
| y |defconfig | cut_attack_surface |
OK
CONFIG_STRICT_DEVMEM
| y |defconfig | cut_attack_surface |
OK
CONFIG_ACPI_CUSTOM_METHOD
| is not set | kspp | cut_attack_surface |
OK
CONFIG_COMPAT_BRK
| is not set | kspp | cut_attack_surface |
OK
CONFIG_DEVKMEM
| is not set | kspp | cut_attack_surface |
OK
CONFIG_COMPAT_VDSO
| is not set | kspp | cut_attack_surface |
OK
CONFIG_BINFMT_MISC
| is not set | kspp | cut_attack_surface |
FAIL: "m"
CONFIG_INET_DIAG
| is not set | kspp | cut_attack_surface |
FAIL: "m"
CONFIG_KEXEC
| is not set | kspp | cut_attack_surface |
FAIL: "y"
CONFIG_PROC_KCORE
| is not set | kspp | cut_attack_surface |
FAIL: "y"
CONFIG_LEGACY_PTYS
| is not set | kspp | cut_attack_surface |
FAIL: "y"
CONFIG_HIBERNATION
| is not set | kspp | cut_attack_surface |
FAIL: "y"
CONFIG_IA32_EMULATION
| is not set | kspp | cut_attack_surface |
FAIL: "y"
CONFIG_X86_X32
| is not set | kspp | cut_attack_surface |
FAIL: "y"
CONFIG_MODIFY_LDT_SYSCALL
| is not set | kspp | cut_attack_surface |
FAIL: "y"
CONFIG_OABI_COMPAT
| is not set | kspp | cut_attack_surface |
OK: not found
CONFIG_MODULES
| is not set | kspp | cut_attack_surface |
FAIL: "y"
CONFIG_DEVMEM
| is not set | kspp | cut_attack_surface |
FAIL: "y"
CONFIG_IO_STRICT_DEVMEM
| y | kspp | cut_attack_surface |
FAIL: "is not set"
CONFIG_LEGACY_VSYSCALL_NONE
| y | kspp | cut_attack_surface |
FAIL: "is not set"
CONFIG_ZSMALLOC_STAT
| is not set |grsecurity| cut_attack_surface |
OK
CONFIG_PAGE_OWNER
| is not set |grsecurity| cut_attack_surface |
OK
CONFIG_DEBUG_KMEMLEAK
| is not set |grsecurity| cut_attack_surface |
OK
CONFIG_BINFMT_AOUT
| is not set |grsecurity| cut_attack_surface |
OK: not found
CONFIG_KPROBE_EVENTS
| is not set |grsecurity| cut_attack_surface |
FAIL: "y"
CONFIG_UPROBE_EVENTS
| is not set |grsecurity| cut_attack_surface |
FAIL: "y"
CONFIG_GENERIC_TRACER
| is not set |grsecurity| cut_attack_surface |
FAIL: "y"
CONFIG_FUNCTION_TRACER
| is not set |grsecurity| cut_attack_surface |
FAIL: "y"
CONFIG_STACK_TRACER
| is not set |grsecurity| cut_attack_surface |
FAIL: "y"
CONFIG_HIST_TRIGGERS
| is not set |grsecurity| cut_attack_surface |
FAIL: "y"
CONFIG_BLK_DEV_IO_TRACE
| is not set |grsecurity| cut_attack_surface |
FAIL: "y"
CONFIG_PROC_VMCORE
| is not set |grsecurity| cut_attack_surface |
FAIL: "y"
CONFIG_PROC_PAGE_MONITOR
| is not set |grsecurity| cut_attack_surface |
FAIL: "y"
CONFIG_USELIB
| is not set |grsecurity| cut_attack_surface |
FAIL: "y"
CONFIG_CHECKPOINT_RESTORE
| is not set |grsecurity| cut_attack_surface |
FAIL: "y"
CONFIG_USERFAULTFD
| is not set |grsecurity| cut_attack_surface |
FAIL: "y"
CONFIG_HWPOISON_INJECT
| is not set |grsecurity| cut_attack_surface |
FAIL: "m"
CONFIG_MEM_SOFT_DIRTY
| is not set |grsecurity| cut_attack_surface |
FAIL: "y"
CONFIG_DEVPORT
| is not set |grsecurity| cut_attack_surface |
FAIL: "y"
CONFIG_DEBUG_FS
| is not set |grsecurity| cut_attack_surface |
FAIL: "y"
CONFIG_NOTIFIER_ERROR_INJECTION
| is not set |grsecurity| cut_attack_surface |
FAIL: "m"
CONFIG_FAIL_FUTEX
| is not set |grsecurity| cut_attack_surface |
OK: not found
CONFIG_PUNIT_ATOM_DEBUG
| is not set |grsecurity| cut_attack_surface |
FAIL: "m"
CONFIG_ACPI_CONFIGFS
| is not set |grsecurity| cut_attack_surface |
FAIL: "m"
CONFIG_EDAC_DEBUG
| is not set |grsecurity| cut_attack_surface |
OK
CONFIG_DRM_I915_DEBUG
| is not set |grsecurity| cut_attack_surface |
OK
CONFIG_BCACHE_CLOSURES_DEBUG
| is not set |grsecurity| cut_attack_surface |
OK
CONFIG_DVB_C8SECTPFE
| is not set |grsecurity| cut_attack_surface |
OK: not found
CONFIG_MTD_SLRAM
| is not set |grsecurity| cut_attack_surface |
FAIL: "m"
CONFIG_MTD_PHRAM
| is not set |grsecurity| cut_attack_surface |
FAIL: "m"
CONFIG_IO_URING
| is not set |grsecurity| cut_attack_surface |
FAIL: "y"
CONFIG_KCMP
| is not set |grsecurity| cut_attack_surface |
OK: not found
CONFIG_RSEQ
| is not set |grsecurity| cut_attack_surface |
FAIL: "y"
CONFIG_LATENCYTOP
| is not set |grsecurity| cut_attack_surface |
OK
CONFIG_KCOV
| is not set |grsecurity| cut_attack_surface |
OK
CONFIG_PROVIDE_OHCI1394_DMA_INIT
| is not set |grsecurity| cut_attack_surface |
OK
CONFIG_SUNRPC_DEBUG
| is not set |grsecurity| cut_attack_surface |
FAIL: "y"
CONFIG_PTDUMP_DEBUGFS
| is not set |grsecurity| cut_attack_surface |
OK: not found
CONFIG_DRM_LEGACY
| is not set |maintainer| cut_attack_surface |
OK
CONFIG_FB
| is not set |maintainer| cut_attack_surface |
FAIL: "y"
CONFIG_VT
| is not set |maintainer| cut_attack_surface |
FAIL: "y"
CONFIG_BLK_DEV_FD
| is not set |maintainer| cut_attack_surface |
FAIL: "m"
CONFIG_AIO
| is not set |grapheneos| cut_attack_surface |
FAIL: "y"
CONFIG_STAGING
| is not set | clipos | cut_attack_surface |
FAIL: "y"
CONFIG_KSM
| is not set | clipos | cut_attack_surface |
FAIL: "y"
CONFIG_KALLSYMS
| is not set | clipos | cut_attack_surface |
FAIL: "y"
CONFIG_X86_VSYSCALL_EMULATION
| is not set | clipos | cut_attack_surface |
FAIL: "y"
CONFIG_MAGIC_SYSRQ
| is not set | clipos | cut_attack_surface |
FAIL: "y"
CONFIG_KEXEC_FILE
| is not set | clipos | cut_attack_surface |
FAIL: "y"
CONFIG_USER_NS
| is not set | clipos | cut_attack_surface |
FAIL: "y"
CONFIG_X86_MSR
| is not set | clipos | cut_attack_surface |
FAIL: "m"
CONFIG_X86_CPUID
| is not set | clipos | cut_attack_surface |
FAIL: "m"
CONFIG_X86_IOPL_IOPERM
| is not set | clipos | cut_attack_surface |
OK: not found
CONFIG_ACPI_TABLE_UPGRADE
| is not set | clipos | cut_attack_surface |
FAIL: "y"
CONFIG_EFI_CUSTOM_SSDT_OVERLAYS
| is not set | clipos | cut_attack_surface |
OK: not found
CONFIG_LDISC_AUTOLOAD
| is not set | clipos | cut_attack_surface |
FAIL: "y"
CONFIG_X86_INTEL_TSX_MODE_OFF
| y | clipos | cut_attack_surface |
OK
CONFIG_EFI_TEST
| is not set | lockdown | cut_attack_surface |
FAIL: "m"
CONFIG_BPF_SYSCALL
| is not set | lockdown | cut_attack_surface |
FAIL: "y"
CONFIG_MMIOTRACE_TEST
| is not set | lockdown | cut_attack_surface |
OK
CONFIG_KPROBES
| is not set | lockdown | cut_attack_surface |
FAIL: "y"
CONFIG_TRIM_UNUSED_KSYMS
| y | my | cut_attack_surface |
FAIL: not found
CONFIG_MMIOTRACE
| is not set | my | cut_attack_surface |
FAIL: "y"
CONFIG_LIVEPATCH
| is not set | my | cut_attack_surface |
FAIL: "y"
CONFIG_IP_DCCP
| is not set | my | cut_attack_surface |
FAIL: "m"
CONFIG_IP_SCTP
| is not set | my | cut_attack_surface |
FAIL: "m"
CONFIG_FTRACE
| is not set | my | cut_attack_surface |
FAIL: "y"
CONFIG_VIDEO_VIVID
| is not set | my | cut_attack_surface |
FAIL: "m"
CONFIG_INPUT_EVBUG
| is not set | my | cut_attack_surface |
FAIL: "m"
CONFIG_INTEGRITY
| y |defconfig |userspace_hardening |
OK
CONFIG_ARCH_MMAP_RND_BITS
| 32 | clipos |userspace_hardening |
FAIL: "28"
CONFIG_BUG
|kconfig| y |defconfig | self_protection |
OK
CONFIG_SLUB_DEBUG
|kconfig| y |defconfig | self_protection |
OK
CONFIG_GCC_PLUGINS
|kconfig| y |defconfig | self_protection |
FAIL: not found
CONFIG_STACKPROTECTOR_STRONG
|kconfig| y |defconfig | self_protection |
OK
CONFIG_STRICT_KERNEL_RWX
|kconfig| y |defconfig | self_protection |
OK
CONFIG_STRICT_MODULE_RWX
|kconfig| y |defconfig | self_protection |
OK
CONFIG_REFCOUNT_FULL
|kconfig| y |defconfig | self_protection |
FAIL: "is not set"
CONFIG_IOMMU_SUPPORT
|kconfig| y |defconfig | self_protection |
OK
CONFIG_RANDOMIZE_BASE
|kconfig| y |defconfig | self_protection |
OK
CONFIG_THREAD_INFO_IN_TASK
|kconfig| y |defconfig | self_protection |
OK
CONFIG_VMAP_STACK
|kconfig| y |defconfig | self_protection |
OK
CONFIG_MICROCODE
|kconfig| y |defconfig | self_protection |
OK
CONFIG_RETPOLINE
|kconfig| y |defconfig | self_protection |
OK
CONFIG_X86_SMAP
|kconfig| y |defconfig | self_protection |
OK
CONFIG_SYN_COOKIES
|kconfig| y |defconfig | self_protection |
OK
CONFIG_X86_UMIP
|kconfig| y |defconfig | self_protection |
OK: CONFIG_X86_INTEL_UMIP "y"
CONFIG_PAGE_TABLE_ISOLATION
|kconfig| y |defconfig | self_protection |
OK
CONFIG_RANDOMIZE_MEMORY
|kconfig| y |defconfig | self_protection |
OK
CONFIG_INTEL_IOMMU
|kconfig| y |defconfig | self_protection |
OK
CONFIG_AMD_IOMMU
|kconfig| y |defconfig | self_protection |
OK
CONFIG_SECURITY_DMESG_RESTRICT
|kconfig| y | kspp | self_protection |
FAIL: "is not set"
CONFIG_BUG_ON_DATA_CORRUPTION
|kconfig| y | kspp | self_protection |
FAIL: "is not set"
CONFIG_DEBUG_WX
|kconfig| y | kspp | self_protection |
OK
CONFIG_SCHED_STACK_END_CHECK
|kconfig| y | kspp | self_protection |
OK
CONFIG_SLAB_FREELIST_HARDENED
|kconfig| y | kspp | self_protection |
OK
CONFIG_SLAB_FREELIST_RANDOM
|kconfig| y | kspp | self_protection |
OK
CONFIG_SHUFFLE_PAGE_ALLOCATOR
|kconfig| y | kspp | self_protection |
OK
CONFIG_FORTIFY_SOURCE
|kconfig| y | kspp | self_protection |
OK
CONFIG_DEBUG_LIST
|kconfig| y | kspp | self_protection |
FAIL: "is not set"
CONFIG_DEBUG_SG
|kconfig| y | kspp | self_protection |
FAIL: "is not set"
CONFIG_DEBUG_CREDENTIALS
|kconfig| y | kspp | self_protection |
FAIL: "is not set"
CONFIG_DEBUG_NOTIFIERS
|kconfig| y | kspp | self_protection |
FAIL: "is not set"
CONFIG_INIT_ON_ALLOC_DEFAULT_ON
|kconfig| y | kspp | self_protection |
OK
CONFIG_GCC_PLUGIN_LATENT_ENTROPY
|kconfig| y | kspp | self_protection |
FAIL: not found
CONFIG_GCC_PLUGIN_RANDSTRUCT
|kconfig| y | kspp | self_protection |
FAIL: not found
CONFIG_HARDENED_USERCOPY
|kconfig| y | kspp | self_protection |
OK
CONFIG_HARDENED_USERCOPY_FALLBACK
|kconfig| is not set | kspp | self_protection |
FAIL: "y"
CONFIG_HARDENED_USERCOPY_PAGESPAN
|kconfig| is not set | kspp | self_protection |
OK
CONFIG_MODULE_SIG
|kconfig| y | kspp | self_protection |
OK
CONFIG_MODULE_SIG_ALL
|kconfig| y | kspp | self_protection |
OK
CONFIG_MODULE_SIG_SHA512
|kconfig| y | kspp | self_protection |
OK
CONFIG_MODULE_SIG_FORCE
|kconfig| y | kspp | self_protection |
FAIL: "is not set"
CONFIG_INIT_STACK_ALL_ZERO
|kconfig| y | kspp | self_protection |
FAIL: not found
CONFIG_INIT_ON_FREE_DEFAULT_ON
|kconfig| y | kspp | self_protection |
OK: CONFIG_PAGE_POISONING_ZERO "y"
CONFIG_GCC_PLUGIN_STACKLEAK
|kconfig| y | kspp | self_protection |
FAIL: not found
CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT
|kconfig| y | kspp | self_protection |
FAIL: not found
CONFIG_DEFAULT_MMAP_MIN_ADDR
|kconfig| 65536 | kspp | self_protection |
OK
CONFIG_UBSAN_BOUNDS
|kconfig| y |maintainer| self_protection |
FAIL: not found
CONFIG_UBSAN_SANITIZE_ALL
|kconfig| y |maintainer| self_protection |
FAIL: CONFIG_UBSAN_BOUNDS not "y"
CONFIG_UBSAN_TRAP
|kconfig| y |maintainer| self_protection |
FAIL: CONFIG_UBSAN_BOUNDS not "y"
CONFIG_DEBUG_VIRTUAL
|kconfig| y | clipos | self_protection |
FAIL: "is not set"
CONFIG_STATIC_USERMODEHELPER
|kconfig| y | clipos | self_protection |
FAIL: "is not set"
CONFIG_EFI_DISABLE_PCI_DMA
|kconfig| y | clipos | self_protection |
FAIL: not found
CONFIG_SLAB_MERGE_DEFAULT
|kconfig| is not set | clipos | self_protection |
FAIL: "y"
CONFIG_RANDOM_TRUST_BOOTLOADER
|kconfig| is not set | clipos | self_protection |
FAIL: "y"
CONFIG_RANDOM_TRUST_CPU
|kconfig| is not set | clipos | self_protection |
FAIL: "y"
CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE
|kconfig| is not set | clipos | self_protection |
FAIL: CONFIG_GCC_PLUGIN_RANDSTRUCT not "y"
CONFIG_STACKLEAK_METRICS
|kconfig| is not set | clipos | self_protection |
FAIL: CONFIG_GCC_PLUGIN_STACKLEAK not "y"
CONFIG_STACKLEAK_RUNTIME_DISABLE
|kconfig| is not set | clipos | self_protection |
FAIL: CONFIG_GCC_PLUGIN_STACKLEAK not "y"
CONFIG_INTEL_IOMMU_DEFAULT_ON
|kconfig| y | clipos | self_protection |
FAIL: "is not set"
CONFIG_INTEL_IOMMU_SVM
|kconfig| y | clipos | self_protection |
OK
CONFIG_RESET_ATTACK_MITIGATION
|kconfig| y | my | self_protection |
OK
CONFIG_AMD_IOMMU_V2
|kconfig| y | my | self_protection |
FAIL: "m"
CONFIG_SECURITY
|kconfig| y |defconfig | security_policy |
OK
CONFIG_SECURITY_YAMA
|kconfig| y | kspp | security_policy |
OK
CONFIG_SECURITY_WRITABLE_HOOKS
|kconfig| is not set | my | security_policy |
OK: not found
CONFIG_SECURITY_LOCKDOWN_LSM
|kconfig| y | clipos | security_policy |
OK
CONFIG_SECURITY_LOCKDOWN_LSM_EARLY
|kconfig| y | clipos | security_policy |
OK
CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY|
kconfig| y | clipos | security_policy |
FAIL: "is not set"
CONFIG_SECURITY_SAFESETID
|kconfig| y | my | security_policy |
OK
CONFIG_SECURITY_LOADPIN
|kconfig| y | my | security_policy |
FAIL: "is not set"
CONFIG_SECURITY_LOADPIN_ENFORCE
|kconfig| y | my | security_policy |
FAIL: CONFIG_SECURITY_LOADPIN not "y"
CONFIG_SECCOMP
|kconfig| y |defconfig |cut_attack_surface|
OK
CONFIG_SECCOMP_FILTER
|kconfig| y |defconfig |cut_attack_surface|
OK
CONFIG_STRICT_DEVMEM
|kconfig| y |defconfig |cut_attack_surface|
OK
CONFIG_ACPI_CUSTOM_METHOD
|kconfig| is not set | kspp |cut_attack_surface|
OK
CONFIG_COMPAT_BRK
|kconfig| is not set | kspp |cut_attack_surface|
OK
CONFIG_DEVKMEM
|kconfig| is not set | kspp |cut_attack_surface|
OK
CONFIG_COMPAT_VDSO
|kconfig| is not set | kspp |cut_attack_surface|
OK
CONFIG_BINFMT_MISC
|kconfig| is not set | kspp |cut_attack_surface|
FAIL: "m"
CONFIG_INET_DIAG
|kconfig| is not set | kspp |cut_attack_surface|
FAIL: "m"
CONFIG_KEXEC
|kconfig| is not set | kspp |cut_attack_surface|
FAIL: "y"
CONFIG_PROC_KCORE
|kconfig| is not set | kspp |cut_attack_surface|
FAIL: "y"
CONFIG_LEGACY_PTYS
|kconfig| is not set | kspp |cut_attack_surface|
FAIL: "y"
CONFIG_HIBERNATION
|kconfig| is not set | kspp |cut_attack_surface|
FAIL: "y"
CONFIG_IA32_EMULATION
|kconfig| is not set | kspp |cut_attack_surface|
FAIL: "y"
CONFIG_X86_X32
|kconfig| is not set | kspp |cut_attack_surface|
FAIL: "y"
CONFIG_MODIFY_LDT_SYSCALL
|kconfig| is not set | kspp |cut_attack_surface|
FAIL: "y"
CONFIG_OABI_COMPAT
|kconfig| is not set | kspp |cut_attack_surface|
OK: not found
CONFIG_MODULES
|kconfig| is not set | kspp |cut_attack_surface|
FAIL: "y"
CONFIG_DEVMEM
|kconfig| is not set | kspp |cut_attack_surface|
FAIL: "y"
CONFIG_IO_STRICT_DEVMEM
|kconfig| y | kspp |cut_attack_surface|
FAIL: "is not set"
CONFIG_LEGACY_VSYSCALL_NONE
|kconfig| y | kspp |cut_attack_surface|
FAIL: "is not set"
CONFIG_ZSMALLOC_STAT
|kconfig| is not set | grsec |cut_attack_surface|
OK
CONFIG_PAGE_OWNER
|kconfig| is not set | grsec |cut_attack_surface|
OK
CONFIG_DEBUG_KMEMLEAK
|kconfig| is not set | grsec |cut_attack_surface|
OK
CONFIG_BINFMT_AOUT
|kconfig| is not set | grsec |cut_attack_surface|
OK: not found
CONFIG_KPROBE_EVENTS
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "y"
CONFIG_UPROBE_EVENTS
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "y"
CONFIG_GENERIC_TRACER
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "y"
CONFIG_FUNCTION_TRACER
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "y"
CONFIG_STACK_TRACER
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "y"
CONFIG_HIST_TRIGGERS
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "y"
CONFIG_BLK_DEV_IO_TRACE
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "y"
CONFIG_PROC_VMCORE
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "y"
CONFIG_PROC_PAGE_MONITOR
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "y"
CONFIG_USELIB
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "y"
CONFIG_CHECKPOINT_RESTORE
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "y"
CONFIG_USERFAULTFD
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "y"
CONFIG_HWPOISON_INJECT
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "m"
CONFIG_MEM_SOFT_DIRTY
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "y"
CONFIG_DEVPORT
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "y"
CONFIG_DEBUG_FS
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "y"
CONFIG_NOTIFIER_ERROR_INJECTION
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "m"
CONFIG_FAIL_FUTEX
|kconfig| is not set | grsec |cut_attack_surface|
OK: not found
CONFIG_PUNIT_ATOM_DEBUG
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "m"
CONFIG_ACPI_CONFIGFS
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "m"
CONFIG_EDAC_DEBUG
|kconfig| is not set | grsec |cut_attack_surface|
OK
CONFIG_DRM_I915_DEBUG
|kconfig| is not set | grsec |cut_attack_surface|
OK
CONFIG_BCACHE_CLOSURES_DEBUG
|kconfig| is not set | grsec |cut_attack_surface|
OK
CONFIG_DVB_C8SECTPFE
|kconfig| is not set | grsec |cut_attack_surface|
OK: not found
CONFIG_MTD_SLRAM
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "m"
CONFIG_MTD_PHRAM
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "m"
CONFIG_IO_URING
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "y"
CONFIG_KCMP
|kconfig| is not set | grsec |cut_attack_surface|
OK: not found
CONFIG_RSEQ
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "y"
CONFIG_LATENCYTOP
|kconfig| is not set | grsec |cut_attack_surface|
OK
CONFIG_KCOV
|kconfig| is not set | grsec |cut_attack_surface|
OK
CONFIG_PROVIDE_OHCI1394_DMA_INIT
|kconfig| is not set | grsec |cut_attack_surface|
OK
CONFIG_SUNRPC_DEBUG
|kconfig| is not set | grsec |cut_attack_surface|
FAIL: "y"
CONFIG_PTDUMP_DEBUGFS
|kconfig| is not set | grsec |cut_attack_surface|
OK: not found
CONFIG_DRM_LEGACY
|kconfig| is not set |maintainer|cut_attack_surface|
OK
CONFIG_FB
|kconfig| is not set |maintainer|cut_attack_surface|
FAIL: "y"
CONFIG_VT
|kconfig| is not set |maintainer|cut_attack_surface|
FAIL: "y"
CONFIG_BLK_DEV_FD
|kconfig| is not set |maintainer|cut_attack_surface|
FAIL: "m"
CONFIG_AIO
|kconfig| is not set |grapheneos|cut_attack_surface|
FAIL: "y"
CONFIG_STAGING
|kconfig| is not set | clipos |cut_attack_surface|
FAIL: "y"
CONFIG_KSM
|kconfig| is not set | clipos |cut_attack_surface|
FAIL: "y"
CONFIG_KALLSYMS
|kconfig| is not set | clipos |cut_attack_surface|
FAIL: "y"
CONFIG_X86_VSYSCALL_EMULATION
|kconfig| is not set | clipos |cut_attack_surface|
FAIL: "y"
CONFIG_MAGIC_SYSRQ
|kconfig| is not set | clipos |cut_attack_surface|
FAIL: "y"
CONFIG_KEXEC_FILE
|kconfig| is not set | clipos |cut_attack_surface|
FAIL: "y"
CONFIG_USER_NS
|kconfig| is not set | clipos |cut_attack_surface|
FAIL: "y"
CONFIG_X86_MSR
|kconfig| is not set | clipos |cut_attack_surface|
FAIL: "m"
CONFIG_X86_CPUID
|kconfig| is not set | clipos |cut_attack_surface|
FAIL: "m"
CONFIG_X86_IOPL_IOPERM
|kconfig| is not set | clipos |cut_attack_surface|
OK: not found
CONFIG_ACPI_TABLE_UPGRADE
|kconfig| is not set | clipos |cut_attack_surface|
FAIL: "y"
CONFIG_EFI_CUSTOM_SSDT_OVERLAYS
|kconfig| is not set | clipos |cut_attack_surface|
OK: not found
CONFIG_LDISC_AUTOLOAD
|kconfig| is not set | clipos |cut_attack_surface|
FAIL: "y"
CONFIG_X86_INTEL_TSX_MODE_OFF
|kconfig| y | clipos |cut_attack_surface|
OK
CONFIG_EFI_TEST
|kconfig| is not set | lockdown |cut_attack_surface|
FAIL: "m"
CONFIG_BPF_SYSCALL
|kconfig| is not set | lockdown |cut_attack_surface|
FAIL: "y"
CONFIG_MMIOTRACE_TEST
|kconfig| is not set | lockdown |cut_attack_surface|
OK
CONFIG_KPROBES
|kconfig| is not set | lockdown |cut_attack_surface|
FAIL: "y"
CONFIG_TRIM_UNUSED_KSYMS
|kconfig| y | my |cut_attack_surface|
FAIL: not found
CONFIG_MMIOTRACE
|kconfig| is not set | my |cut_attack_surface|
FAIL: "y"
CONFIG_LIVEPATCH
|kconfig| is not set | my |cut_attack_surface|
FAIL: "y"
CONFIG_IP_DCCP
|kconfig| is not set | my |cut_attack_surface|
FAIL: "m"
CONFIG_IP_SCTP
|kconfig| is not set | my |cut_attack_surface|
FAIL: "m"
CONFIG_FTRACE
|kconfig| is not set | my |cut_attack_surface|
FAIL: "y"
CONFIG_VIDEO_VIVID
|kconfig| is not set | my |cut_attack_surface|
FAIL: "m"
CONFIG_INPUT_EVBUG
|kconfig| is not set | my |cut_attack_surface|
FAIL: "m"
CONFIG_INTEGRITY
|kconfig| y |defconfig | harden_userspace |
OK
CONFIG_ARCH_MMAP_RND_BITS
|kconfig| 32 | clipos | harden_userspace |
FAIL: "28"
[+] Config check is finished: 'OK' - 68 / 'FAIL' - 96
```
...
...
kconfig_hardened_check/__init__.py
View file @
66dcf26d
#!/usr/bin/python3
#
# This tool helps me to check
the Linux kernel Kconfig option li
st
#
against
my security hardening preferences for X86_64, ARM64, X86_32, and ARM.
# This tool helps me to check
Linux kernel options again
st
# my security hardening preferences for X86_64, ARM64, X86_32, and ARM.
# Let the computers do their job!
#
# Author: Alexander Popov <alex.popov@linux.com>
...
...
@@ -106,10 +106,16 @@ class OptCheck:
return
True
return
False
class
KconfigCheck
(
OptCheck
):
@property
def
type
(
self
):
return
"kconfig"
def
table_print
(
self
,
_mode
,
with_results
):
print
(
'CONFIG_{:<3
8}|{:^13}|{:^10}|{:^20}'
.
format
(
self
.
nam
e
,
self
.
expected
,
self
.
decision
,
self
.
reason
),
end
=
''
)
print
(
'CONFIG_{:<3
3}|{:^7}|{:^12}|{:^10}|{:^18}'
.
format
(
self
.
name
,
self
.
typ
e
,
self
.
expected
,
self
.
decision
,
self
.
reason
),
end
=
''
)
if
with_results
:
print
(
'|
{}'
.
format
(
self
.
result
),
end
=
''
)
print
(
'| {}'
.
format
(
self
.
result
),
end
=
''
)
class
VerCheck
:
...
...
@@ -135,7 +141,7 @@ class VerCheck:
ver_req
=
'kernel version >= '
+
str
(
self
.
ver_expected
[
0
])
+
'.'
+
str
(
self
.
ver_expected
[
1
])
print
(
'{:<91}'
.
format
(
ver_req
),
end
=
''
)
if
with_results
:
print
(
'|
{}'
.
format
(
self
.
result
),
end
=
''
)
print
(
'| {}'
.
format
(
self
.
result
),
end
=
''
)
class
PresenceCheck
:
...
...
@@ -154,7 +160,7 @@ class PresenceCheck:
def
table_print
(
self
,
_mode
,
with_results
):
print
(
'CONFIG_{:<84}'
.
format
(
self
.
name
+
' is present'
),
end
=
''
)
if
with_results
:
print
(
'|
{}'
.
format
(
self
.
result
),
end
=
''
)
print
(
'| {}'
.
format
(
self
.
result
),
end
=
''
)
class
ComplexOptCheck
:
...
...
@@ -162,7 +168,7 @@ class ComplexOptCheck:
self
.
opts
=
opts
if
not
self
.
opts
:
sys
.
exit
(
'[!] ERROR: empty {} check'
.
format
(
self
.
__class__
.
__name__
))
if
not
isinstance
(
opts
[
0
],
Opt
Check
):
if
not
isinstance
(
opts
[
0
],
Kconfig
Check
):
sys
.
exit
(
'[!] ERROR: invalid {} check: {}'
.
format
(
self
.
__class__
.
__name__
,
opts
))
self
.
result
=
None
...
...
@@ -171,6 +177,10 @@ class ComplexOptCheck:
return
self
.
opts
[
0
]
.
name
@property
def
type
(
self
):
return
self
.
opts
[
0
]
.
type
@property
def
expected
(
self
):
return
self
.
opts
[
0
]
.
expected
...
...
@@ -186,7 +196,7 @@ class ComplexOptCheck:
if
mode
==
'verbose'
:
print
(
' {:87}'
.
format
(
'<<< '
+
self
.
__class__
.
__name__
+
' >>>'
),
end
=
''
)
if
with_results
:
print
(
'|
{}'
.
format
(
self
.
result
),
end
=
''
)
print
(
'| {}'
.
format
(
self
.
result
),
end
=
''
)
for
o
in
self
.
opts
:
print
()
o
.
table_print
(
mode
,
with_results
)
...
...
@@ -194,7 +204,7 @@ class ComplexOptCheck:
o
=
self
.
opts
[
0
]
o
.
table_print
(
mode
,
False
)
if
with_results
:
print
(
'|
{}'
.
format
(
self
.
result
),
end
=
''
)
print
(
'| {}'
.
format
(
self
.
result
),
end
=
''
)
class
OR
(
ComplexOptCheck
):
...
...
@@ -210,14 +220,11 @@ class OR(ComplexOptCheck):
for
i
,
opt
in
enumerate
(
self
.
opts
):
ret
=
opt
.
check
()
if
ret
:
if
opt
.
result
!=
'OK'
or
i
==
0
:
# Preserve additional explanation of this OK result.
# Simple OK is enough only for the main option that
# this OR-check is about.
self
.
result
=
opt
.
result
else
:
# Simple OK is not enough for additional checks.
if
opt
.
result
==
'OK'
and
i
!=
0
:
# Simple OK is not enough for additional checks, add more info:
self
.
result
=
'OK: CONFIG_{} "{}"'
.
format
(
opt
.
name
,
opt
.
expected
)
else
:
self
.
result
=
opt
.
result
return
True
self
.
result
=
self
.
opts
[
0
]
.
result
return
False
...
...
@@ -285,317 +292,317 @@ def detect_version(fname):
return
None
,
'no kernel version detected'
def
construct_checklist
(
l
,
arch
):
# Calling the
Opt
Check class constructor:
#
Opt
Check(reason, decision, name, expected)
def
add_kconfig_checks
(
l
,
arch
):
# Calling the
Kconfig
Check class constructor:
#
Kconfig
Check(reason, decision, name, expected)
modules_not_set
=
Opt
Check
(
'cut_attack_surface'
,
'kspp'
,
'MODULES'
,
'is not set'
)
devmem_not_set
=
Opt
Check
(
'cut_attack_surface'
,
'kspp'
,
'DEVMEM'
,
'is not set'
)
# refers to LOCKDOWN
modules_not_set
=
Kconfig
Check
(
'cut_attack_surface'
,
'kspp'
,
'MODULES'
,
'is not set'
)
devmem_not_set
=
Kconfig
Check
(
'cut_attack_surface'
,
'kspp'
,
'DEVMEM'
,
'is not set'
)
# refers to LOCKDOWN
# 'self_protection', 'defconfig'
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'BUG'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'SLUB_DEBUG'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'GCC_PLUGINS'
,
'y'
)]
l
+=
[
OR
(
Opt
Check
(
'self_protection'
,
'defconfig'
,
'STACKPROTECTOR_STRONG'
,
'y'
),
Opt
Check
(
'self_protection'
,
'defconfig'
,
'CC_STACKPROTECTOR_STRONG'
,
'y'
))]
l
+=
[
OR
(
Opt
Check
(
'self_protection'
,
'defconfig'
,
'STRICT_KERNEL_RWX'
,
'y'
),
Opt
Check
(
'self_protection'
,
'defconfig'
,
'DEBUG_RODATA'
,
'y'
))]
# before v4.11
l
+=
[
OR
(
Opt
Check
(
'self_protection'
,
'defconfig'
,
'STRICT_MODULE_RWX'
,
'y'
),
Opt
Check
(
'self_protection'
,
'defconfig'
,
'DEBUG_SET_MODULE_RONX'
,
'y'
),
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'BUG'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'SLUB_DEBUG'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'GCC_PLUGINS'
,
'y'
)]
l
+=
[
OR
(
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'STACKPROTECTOR_STRONG'
,
'y'
),
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'CC_STACKPROTECTOR_STRONG'
,
'y'
))]
l
+=
[
OR
(
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'STRICT_KERNEL_RWX'
,
'y'
),
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'DEBUG_RODATA'
,
'y'
))]
# before v4.11
l
+=
[
OR
(
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'STRICT_MODULE_RWX'
,
'y'
),
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'DEBUG_SET_MODULE_RONX'
,
'y'
),
modules_not_set
)]
# DEBUG_SET_MODULE_RONX was before v4.11
l
+=
[
OR
(
Opt
Check
(
'self_protection'
,
'defconfig'
,
'REFCOUNT_FULL'
,
'y'
),
l
+=
[
OR
(
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'REFCOUNT_FULL'
,
'y'
),
VerCheck
((
5
,
5
)))]
# REFCOUNT_FULL is enabled by default since v5.5
iommu_support_is_set
=
Opt
Check
(
'self_protection'
,
'defconfig'
,
'IOMMU_SUPPORT'
,
'y'
)
iommu_support_is_set
=
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'IOMMU_SUPPORT'
,
'y'
)
l
+=
[
iommu_support_is_set
]
# is needed for mitigating DMA attacks
if
arch
in
(
'X86_64'
,
'ARM64'
,
'X86_32'
):
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'RANDOMIZE_BASE'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'THREAD_INFO_IN_TASK'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'RANDOMIZE_BASE'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'THREAD_INFO_IN_TASK'
,
'y'
)]
if
arch
in
(
'X86_64'
,
'ARM64'
):
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'VMAP_STACK'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'VMAP_STACK'
,
'y'
)]
if
arch
in
(
'X86_64'
,
'X86_32'
):
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'MICROCODE'
,
'y'
)]
# is needed for mitigating CPU bugs
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'RETPOLINE'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'X86_SMAP'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'SYN_COOKIES'
,
'y'
)]
# another reason?
l
+=
[
OR
(
Opt
Check
(
'self_protection'
,
'defconfig'
,
'X86_UMIP'
,
'y'
),
Opt
Check
(
'self_protection'
,
'defconfig'
,
'X86_INTEL_UMIP'
,
'y'
))]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'MICROCODE'
,
'y'
)]
# is needed for mitigating CPU bugs
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'RETPOLINE'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'X86_SMAP'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'SYN_COOKIES'
,
'y'
)]
# another reason?
l
+=
[
OR
(
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'X86_UMIP'
,
'y'
),
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'X86_INTEL_UMIP'
,
'y'
))]
if
arch
in
(
'ARM64'
,
'ARM'
):
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'STACKPROTECTOR_PER_TASK'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'STACKPROTECTOR_PER_TASK'
,
'y'
)]
if
arch
==
'X86_64'
:
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'PAGE_TABLE_ISOLATION'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'RANDOMIZE_MEMORY'
,
'y'
)]
l
+=
[
AND
(
Opt
Check
(
'self_protection'
,
'defconfig'
,
'INTEL_IOMMU'
,
'y'
),
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'PAGE_TABLE_ISOLATION'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'RANDOMIZE_MEMORY'
,
'y'
)]
l
+=
[
AND
(
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'INTEL_IOMMU'
,
'y'
),
iommu_support_is_set
)]
l
+=
[
AND
(
Opt
Check
(
'self_protection'
,
'defconfig'
,
'AMD_IOMMU'
,
'y'
),
l
+=
[
AND
(
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'AMD_IOMMU'
,
'y'
),
iommu_support_is_set
)]
if
arch
==
'ARM64'
:
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'ARM64_PAN'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'ARM64_EPAN'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'UNMAP_KERNEL_AT_EL0'
,
'y'
)]
l
+=
[
OR
(
Opt
Check
(
'self_protection'
,
'defconfig'
,
'HARDEN_EL2_VECTORS'
,
'y'
),
AND
(
Opt
Check
(
'self_protection'
,
'defconfig'
,
'RANDOMIZE_BASE'
,
'y'
),
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'ARM64_PAN'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'ARM64_EPAN'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'UNMAP_KERNEL_AT_EL0'
,
'y'
)]
l
+=
[
OR
(
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'HARDEN_EL2_VECTORS'
,
'y'
),
AND
(
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'RANDOMIZE_BASE'
,
'y'
),
VerCheck
((
5
,
9
))))]
# HARDEN_EL2_VECTORS was included in RANDOMIZE_BASE in v5.9
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'RODATA_FULL_DEFAULT_ENABLED'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'ARM64_PTR_AUTH_KERNEL'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'ARM64_BTI_KERNEL'
,
'y'
)]
l
+=
[
OR
(
Opt
Check
(
'self_protection'
,
'defconfig'
,
'HARDEN_BRANCH_PREDICTOR'
,
'y'
),
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'RODATA_FULL_DEFAULT_ENABLED'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'ARM64_PTR_AUTH_KERNEL'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'ARM64_BTI_KERNEL'
,
'y'
)]
l
+=
[
OR
(
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'HARDEN_BRANCH_PREDICTOR'
,
'y'
),
VerCheck
((
5
,
10
)))]
# HARDEN_BRANCH_PREDICTOR is enabled by default since v5.10
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'ARM64_MTE'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'ARM64_MTE'
,
'y'
)]
if
arch
==
'ARM'
:
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'CPU_SW_DOMAIN_PAN'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'defconfig'
,
'HARDEN_BRANCH_PREDICTOR'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'CPU_SW_DOMAIN_PAN'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'defconfig'
,
'HARDEN_BRANCH_PREDICTOR'
,
'y'
)]
# 'self_protection', 'kspp'
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'SECURITY_DMESG_RESTRICT'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'BUG_ON_DATA_CORRUPTION'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'DEBUG_WX'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'SCHED_STACK_END_CHECK'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'SLAB_FREELIST_HARDENED'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'SLAB_FREELIST_RANDOM'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'SHUFFLE_PAGE_ALLOCATOR'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'FORTIFY_SOURCE'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'DEBUG_LIST'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'DEBUG_SG'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'DEBUG_CREDENTIALS'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'DEBUG_NOTIFIERS'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'INIT_ON_ALLOC_DEFAULT_ON'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'GCC_PLUGIN_LATENT_ENTROPY'
,
'y'
)]
randstruct_is_set
=
Opt
Check
(
'self_protection'
,
'kspp'
,
'GCC_PLUGIN_RANDSTRUCT'
,
'y'
)
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'SECURITY_DMESG_RESTRICT'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'BUG_ON_DATA_CORRUPTION'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'DEBUG_WX'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'SCHED_STACK_END_CHECK'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'SLAB_FREELIST_HARDENED'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'SLAB_FREELIST_RANDOM'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'SHUFFLE_PAGE_ALLOCATOR'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'FORTIFY_SOURCE'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'DEBUG_LIST'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'DEBUG_SG'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'DEBUG_CREDENTIALS'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'DEBUG_NOTIFIERS'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'INIT_ON_ALLOC_DEFAULT_ON'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'GCC_PLUGIN_LATENT_ENTROPY'
,
'y'
)]
randstruct_is_set
=
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'GCC_PLUGIN_RANDSTRUCT'
,
'y'
)
l
+=
[
randstruct_is_set
]
hardened_usercopy_is_set
=
Opt
Check
(
'self_protection'
,
'kspp'
,
'HARDENED_USERCOPY'
,
'y'
)
hardened_usercopy_is_set
=
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'HARDENED_USERCOPY'
,
'y'
)
l
+=
[
hardened_usercopy_is_set
]
l
+=
[
AND
(
Opt
Check
(
'self_protection'
,
'kspp'
,
'HARDENED_USERCOPY_FALLBACK'
,
'is not set'
),
l
+=
[
AND
(
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'HARDENED_USERCOPY_FALLBACK'
,
'is not set'
),
hardened_usercopy_is_set
)]
l
+=
[
AND
(
Opt
Check
(
'self_protection'
,
'kspp'
,
'HARDENED_USERCOPY_PAGESPAN'
,
'is not set'
),
l
+=
[
AND
(
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'HARDENED_USERCOPY_PAGESPAN'
,
'is not set'
),
hardened_usercopy_is_set
)]
l
+=
[
OR
(
Opt
Check
(
'self_protection'
,
'kspp'
,
'MODULE_SIG'
,
'y'
),
l
+=
[
OR
(
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'MODULE_SIG'
,
'y'
),
modules_not_set
)]
l
+=
[
OR
(
Opt
Check
(
'self_protection'
,
'kspp'
,
'MODULE_SIG_ALL'
,
'y'
),
l
+=
[
OR
(
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'MODULE_SIG_ALL'
,
'y'
),
modules_not_set
)]
l
+=
[
OR
(
Opt
Check
(
'self_protection'
,
'kspp'
,
'MODULE_SIG_SHA512'
,
'y'
),
l
+=
[
OR
(
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'MODULE_SIG_SHA512'
,
'y'
),
modules_not_set
)]
l
+=
[
OR
(
Opt
Check
(
'self_protection'
,
'kspp'
,
'MODULE_SIG_FORCE'
,
'y'
),
l
+=
[
OR
(
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'MODULE_SIG_FORCE'
,
'y'
),
modules_not_set
)]
# refers to LOCKDOWN
l
+=
[
OR
(
Opt
Check
(
'self_protection'
,
'kspp'
,
'INIT_STACK_ALL_ZERO'
,
'y'
),
Opt
Check
(
'self_protection'
,
'kspp'
,
'GCC_PLUGIN_STRUCTLEAK_BYREF_ALL'
,
'y'
))]
l
+=
[
OR
(
Opt
Check
(
'self_protection'
,
'kspp'
,
'INIT_ON_FREE_DEFAULT_ON'
,
'y'
),
Opt
Check
(
'self_protection'
,
'kspp'
,
'PAGE_POISONING_ZERO'
,
'y'
))]
l
+=
[
OR
(
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'INIT_STACK_ALL_ZERO'
,
'y'
),
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'GCC_PLUGIN_STRUCTLEAK_BYREF_ALL'
,
'y'
))]
l
+=
[
OR
(
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'INIT_ON_FREE_DEFAULT_ON'
,
'y'
),
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'PAGE_POISONING_ZERO'
,
'y'
))]
# CONFIG_INIT_ON_FREE_DEFAULT_ON was added in v5.3.
# CONFIG_PAGE_POISONING_ZERO was removed in v5.11.
# Starting from v5.11 CONFIG_PAGE_POISONING unconditionally checks
# the 0xAA poison pattern on allocation.
# That brings higher performance penalty.
if
arch
in
(
'X86_64'
,
'ARM64'
,
'X86_32'
):
stackleak_is_set
=
Opt
Check
(
'self_protection'
,
'kspp'
,
'GCC_PLUGIN_STACKLEAK'
,
'y'
)
stackleak_is_set
=
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'GCC_PLUGIN_STACKLEAK'
,
'y'
)
l
+=
[
stackleak_is_set
]
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'RANDOMIZE_KSTACK_OFFSET_DEFAULT'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'RANDOMIZE_KSTACK_OFFSET_DEFAULT'
,
'y'
)]
if
arch
in
(
'X86_64'
,
'X86_32'
):
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'DEFAULT_MMAP_MIN_ADDR'
,
'65536'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'DEFAULT_MMAP_MIN_ADDR'
,
'65536'
)]
if
arch
in
(
'ARM64'
,
'ARM'
):
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'DEFAULT_MMAP_MIN_ADDR'
,
'32768'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'SYN_COOKIES'
,
'y'
)]
# another reason?
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'DEFAULT_MMAP_MIN_ADDR'
,
'32768'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'SYN_COOKIES'
,
'y'
)]
# another reason?
if
arch
==
'ARM64'
:
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'ARM64_SW_TTBR0_PAN'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'ARM64_SW_TTBR0_PAN'
,
'y'
)]
if
arch
==
'X86_32'
:
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'PAGE_TABLE_ISOLATION'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'HIGHMEM64G'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'kspp'
,
'X86_PAE'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'PAGE_TABLE_ISOLATION'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'HIGHMEM64G'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'kspp'
,
'X86_PAE'
,
'y'
)]
# 'self_protection', 'maintainer'
ubsan_bounds_is_set
=
Opt
Check
(
'self_protection'
,
'maintainer'
,
'UBSAN_BOUNDS'
,
'y'
)
# only array index bounds checking
ubsan_bounds_is_set
=
Kconfig
Check
(
'self_protection'
,
'maintainer'
,
'UBSAN_BOUNDS'
,
'y'
)
# only array index bounds checking
l
+=
[
ubsan_bounds_is_set
]
# recommended by Kees Cook in /issues/53
l
+=
[
AND
(
Opt
Check
(
'self_protection'
,
'maintainer'
,
'UBSAN_SANITIZE_ALL'
,
'y'
),
l
+=
[
AND
(
Kconfig
Check
(
'self_protection'
,
'maintainer'
,
'UBSAN_SANITIZE_ALL'
,
'y'
),
ubsan_bounds_is_set
)]
# recommended by Kees Cook in /issues/53
l
+=
[
AND
(
Opt
Check
(
'self_protection'
,
'maintainer'
,
'UBSAN_TRAP'
,
'y'
),
l
+=
[
AND
(
Kconfig
Check
(
'self_protection'
,
'maintainer'
,
'UBSAN_TRAP'
,
'y'
),
ubsan_bounds_is_set
)]
# recommended by Kees Cook in /issues/53
# 'self_protection', 'clipos'
l
+=
[
Opt
Check
(
'self_protection'
,
'clipos'
,
'DEBUG_VIRTUAL'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'clipos'
,
'STATIC_USERMODEHELPER'
,
'y'
)]
# needs userspace support
l
+=
[
Opt
Check
(
'self_protection'
,
'clipos'
,
'EFI_DISABLE_PCI_DMA'
,
'y'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'clipos'
,
'SLAB_MERGE_DEFAULT'
,
'is not set'
)]
# slab_nomerge
l
+=
[
Opt
Check
(
'self_protection'
,
'clipos'
,
'RANDOM_TRUST_BOOTLOADER'
,
'is not set'
)]
l
+=
[
Opt
Check
(
'self_protection'
,
'clipos'
,
'RANDOM_TRUST_CPU'
,
'is not set'
)]
l
+=
[
AND
(
Opt
Check
(
'self_protection'
,
'clipos'
,
'GCC_PLUGIN_RANDSTRUCT_PERFORMANCE'
,
'is not set'
),
l
+=
[
Kconfig
Check
(
'self_protection'
,
'clipos'
,
'DEBUG_VIRTUAL'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'clipos'
,
'STATIC_USERMODEHELPER'
,
'y'
)]
# needs userspace support
l
+=
[
Kconfig
Check
(
'self_protection'
,
'clipos'
,
'EFI_DISABLE_PCI_DMA'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'clipos'
,
'SLAB_MERGE_DEFAULT'
,
'is not set'
)]
# slab_nomerge
l
+=
[
Kconfig
Check
(
'self_protection'
,
'clipos'
,
'RANDOM_TRUST_BOOTLOADER'
,
'is not set'
)]
l
+=
[
Kconfig
Check
(
'self_protection'
,
'clipos'
,
'RANDOM_TRUST_CPU'
,
'is not set'
)]
l
+=
[
AND
(
Kconfig
Check
(
'self_protection'
,
'clipos'
,
'GCC_PLUGIN_RANDSTRUCT_PERFORMANCE'
,
'is not set'
),
randstruct_is_set
)]
if
arch
in
(
'X86_64'
,
'ARM64'
,
'X86_32'
):
l
+=
[
AND
(
Opt
Check
(
'self_protection'
,
'clipos'
,
'STACKLEAK_METRICS'
,
'is not set'
),
l
+=
[
AND
(
Kconfig
Check
(
'self_protection'
,
'clipos'
,
'STACKLEAK_METRICS'
,
'is not set'
),
stackleak_is_set
)]
l
+=
[
AND
(
Opt
Check
(
'self_protection'
,
'clipos'
,
'STACKLEAK_RUNTIME_DISABLE'
,
'is not set'
),
l
+=
[
AND
(
Kconfig
Check
(
'self_protection'
,
'clipos'
,
'STACKLEAK_RUNTIME_DISABLE'
,
'is not set'
),
stackleak_is_set
)]
if
arch
in
(
'X86_64'
,
'X86_32'
):
l
+=
[
AND
(
Opt
Check
(
'self_protection'
,
'clipos'
,
'INTEL_IOMMU_DEFAULT_ON'
,
'y'
),
l
+=
[
AND
(
Kconfig
Check
(
'self_protection'
,
'clipos'
,
'INTEL_IOMMU_DEFAULT_ON'
,
'y'
),
iommu_support_is_set
)]
if
arch
==
'X86_64'
:
l
+=
[
AND
(
Opt
Check
(
'self_protection'
,
'clipos'
,
'INTEL_IOMMU_SVM'
,
'y'
),
l
+=
[
AND
(
Kconfig
Check
(
'self_protection'
,
'clipos'
,
'INTEL_IOMMU_SVM'
,
'y'
),
iommu_support_is_set
)]
if
arch
==
'X86_32'
:
l
+=
[
AND
(
Opt
Check
(
'self_protection'
,
'clipos'
,
'INTEL_IOMMU'
,
'y'
),
l
+=
[
AND
(
Kconfig
Check
(
'self_protection'
,
'clipos'
,
'INTEL_IOMMU'
,
'y'
),
iommu_support_is_set
)]
# 'self_protection', 'my'
l
+=
[
Opt
Check
(
'self_protection'
,
'my'
,
'RESET_ATTACK_MITIGATION'
,
'y'
)]
# needs userspace support (systemd)
l
+=
[
Kconfig
Check
(
'self_protection'
,
'my'
,
'RESET_ATTACK_MITIGATION'
,
'y'
)]
# needs userspace support (systemd)
if
arch
==
'X86_64'
:
l
+=
[
AND
(
Opt
Check
(
'self_protection'
,
'my'
,
'AMD_IOMMU_V2'
,
'y'
),
l
+=
[
AND
(
Kconfig
Check
(
'self_protection'
,
'my'
,
'AMD_IOMMU_V2'
,
'y'
),
iommu_support_is_set
)]
if
arch
==
'ARM64'
:
l
+=
[
Opt
Check
(
'self_protection'
,
'my'
,
'SHADOW_CALL_STACK'
,
'y'
)]
# depends on clang, maybe it's alternative to STACKPROTECTOR_STRONG
l
+=
[
Opt
Check
(
'self_protection'
,
'my'
,
'KASAN_HW_TAGS'
,
'y'
)]
cfi_clang_is_set
=
Opt
Check
(
'self_protection'
,
'my'
,
'CFI_CLANG'
,
'y'
)
l
+=
[
Kconfig
Check
(
'self_protection'
,
'my'
,
'SHADOW_CALL_STACK'
,
'y'
)]
# depends on clang, maybe it's alternative to STACKPROTECTOR_STRONG
l
+=
[
Kconfig
Check
(
'self_protection'
,
'my'
,
'KASAN_HW_TAGS'
,
'y'
)]
cfi_clang_is_set
=
Kconfig
Check
(
'self_protection'
,
'my'
,
'CFI_CLANG'
,
'y'
)
l
+=
[
cfi_clang_is_set
]
l
+=
[
AND
(
Opt
Check
(
'self_protection'
,
'my'
,
'CFI_PERMISSIVE'
,
'is not set'
),
l
+=
[
AND
(
Kconfig
Check
(
'self_protection'
,
'my'
,
'CFI_PERMISSIVE'
,
'is not set'
),
cfi_clang_is_set
)]
# 'security_policy'
if
arch
in
(
'X86_64'
,
'ARM64'
,
'X86_32'
):
l
+=
[
Opt
Check
(
'security_policy'
,
'defconfig'
,
'SECURITY'
,
'y'
)]
# and choose your favourite LSM
l
+=
[
Kconfig
Check
(
'security_policy'
,
'defconfig'
,
'SECURITY'
,
'y'
)]
# and choose your favourite LSM
if
arch
==
'ARM'
:
l
+=
[
Opt
Check
(
'security_policy'
,
'kspp'
,
'SECURITY'
,
'y'
)]
# and choose your favourite LSM
l
+=
[
Opt
Check
(
'security_policy'
,
'kspp'
,
'SECURITY_YAMA'
,
'y'
)]
l
+=
[
OR
(
Opt
Check
(
'security_policy'
,
'my'
,
'SECURITY_WRITABLE_HOOKS'
,
'is not set'
),
Opt
Check
(
'security_policy'
,
'kspp'
,
'SECURITY_SELINUX_DISABLE'
,
'is not set'
))]
l
+=
[
Opt
Check
(
'security_policy'
,
'clipos'
,
'SECURITY_LOCKDOWN_LSM'
,
'y'
)]
l
+=
[
Opt
Check
(
'security_policy'
,
'clipos'
,
'SECURITY_LOCKDOWN_LSM_EARLY'
,
'y'
)]
l
+=
[
Opt
Check
(
'security_policy'
,
'clipos'
,
'LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY'
,
'y'
)]
l
+=
[
Opt
Check
(
'security_policy'
,
'my'
,
'SECURITY_SAFESETID'
,
'y'
)]
loadpin_is_set
=
Opt
Check
(
'security_policy'
,
'my'
,
'SECURITY_LOADPIN'
,
'y'
)
l
+=
[
Kconfig
Check
(
'security_policy'
,
'kspp'
,
'SECURITY'
,
'y'
)]
# and choose your favourite LSM
l
+=
[
Kconfig
Check
(
'security_policy'
,
'kspp'
,
'SECURITY_YAMA'
,
'y'
)]
l
+=
[
OR
(
Kconfig
Check
(
'security_policy'
,
'my'
,
'SECURITY_WRITABLE_HOOKS'
,
'is not set'
),
Kconfig
Check
(
'security_policy'
,
'kspp'
,
'SECURITY_SELINUX_DISABLE'
,
'is not set'
))]
l
+=
[
Kconfig
Check
(
'security_policy'
,
'clipos'
,
'SECURITY_LOCKDOWN_LSM'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'security_policy'
,
'clipos'
,
'SECURITY_LOCKDOWN_LSM_EARLY'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'security_policy'
,
'clipos'
,
'LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'security_policy'
,
'my'
,
'SECURITY_SAFESETID'
,
'y'
)]
loadpin_is_set
=
Kconfig
Check
(
'security_policy'
,
'my'
,
'SECURITY_LOADPIN'
,
'y'
)
l
+=
[
loadpin_is_set
]
# needs userspace support
l
+=
[
AND
(
Opt
Check
(
'security_policy'
,
'my'
,
'SECURITY_LOADPIN_ENFORCE'
,
'y'
),
l
+=
[
AND
(
Kconfig
Check
(
'security_policy'
,
'my'
,
'SECURITY_LOADPIN_ENFORCE'
,
'y'
),
loadpin_is_set
)]
# 'cut_attack_surface', 'defconfig'
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'defconfig'
,
'SECCOMP'
,
'y'
)]
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'defconfig'
,
'SECCOMP_FILTER'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'defconfig'
,
'SECCOMP'
,
'y'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'defconfig'
,
'SECCOMP_FILTER'
,
'y'
)]
if
arch
in
(
'X86_64'
,
'ARM64'
,
'X86_32'
):
l
+=
[
OR
(
Opt
Check
(
'cut_attack_surface'
,
'defconfig'
,
'STRICT_DEVMEM'
,
'y'
),
l
+=
[
OR
(
Kconfig
Check
(
'cut_attack_surface'
,
'defconfig'
,
'STRICT_DEVMEM'
,
'y'
),
devmem_not_set
)]
# refers to LOCKDOWN
# 'cut_attack_surface', 'kspp'
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'kspp'
,
'ACPI_CUSTOM_METHOD'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'kspp'
,
'COMPAT_BRK'
,
'is not set'
)]
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'kspp'
,
'DEVKMEM'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'kspp'
,
'COMPAT_VDSO'
,
'is not set'
)]
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'kspp'
,
'BINFMT_MISC'
,
'is not set'
)]
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'kspp'
,
'INET_DIAG'
,
'is not set'
)]
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'kspp'
,
'KEXEC'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'kspp'
,
'PROC_KCORE'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'kspp'
,
'LEGACY_PTYS'
,
'is not set'
)]
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'kspp'
,
'HIBERNATION'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'kspp'
,
'IA32_EMULATION'
,
'is not set'
)]
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'kspp'
,
'X86_X32'
,
'is not set'
)]
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'kspp'
,
'MODIFY_LDT_SYSCALL'
,
'is not set'
)]
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'kspp'
,
'OABI_COMPAT'
,
'is not set'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'kspp'
,
'ACPI_CUSTOM_METHOD'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'kspp'
,
'COMPAT_BRK'
,
'is not set'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'kspp'
,
'DEVKMEM'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'kspp'
,
'COMPAT_VDSO'
,
'is not set'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'kspp'
,
'BINFMT_MISC'
,
'is not set'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'kspp'
,
'INET_DIAG'
,
'is not set'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'kspp'
,
'KEXEC'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'kspp'
,
'PROC_KCORE'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'kspp'
,
'LEGACY_PTYS'
,
'is not set'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'kspp'
,
'HIBERNATION'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'kspp'
,
'IA32_EMULATION'
,
'is not set'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'kspp'
,
'X86_X32'
,
'is not set'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'kspp'
,
'MODIFY_LDT_SYSCALL'
,
'is not set'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'kspp'
,
'OABI_COMPAT'
,
'is not set'
)]
l
+=
[
modules_not_set
]
l
+=
[
devmem_not_set
]
l
+=
[
OR
(
Opt
Check
(
'cut_attack_surface'
,
'kspp'
,
'IO_STRICT_DEVMEM'
,
'y'
),
l
+=
[
OR
(
Kconfig
Check
(
'cut_attack_surface'
,
'kspp'
,
'IO_STRICT_DEVMEM'
,
'y'
),
devmem_not_set
)]
# refers to LOCKDOWN
if
arch
==
'ARM'
:
l
+=
[
OR
(
Opt
Check
(
'cut_attack_surface'
,
'kspp'
,
'STRICT_DEVMEM'
,
'y'
),
l
+=
[
OR
(
Kconfig
Check
(
'cut_attack_surface'
,
'kspp'
,
'STRICT_DEVMEM'
,
'y'
),
devmem_not_set
)]
# refers to LOCKDOWN
if
arch
==
'X86_64'
:
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'kspp'
,
'LEGACY_VSYSCALL_NONE'
,
'y'
)]
# 'vsyscall=none'
# 'cut_attack_surface', 'grsec
urity
'
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'ZSMALLOC_STAT'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'PAGE_OWNER'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'DEBUG_KMEMLEAK'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'BINFMT_AOUT'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'KPROBE_EVENTS'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'UPROBE_EVENTS'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'GENERIC_TRACER'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'FUNCTION_TRACER'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'STACK_TRACER'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'HIST_TRIGGERS'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'BLK_DEV_IO_TRACE'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'PROC_VMCORE'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'PROC_PAGE_MONITOR'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'USELIB'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'CHECKPOINT_RESTORE'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'USERFAULTFD'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'HWPOISON_INJECT'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'MEM_SOFT_DIRTY'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'DEVPORT'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'DEBUG_FS'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'NOTIFIER_ERROR_INJECTION'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'FAIL_FUTEX'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'PUNIT_ATOM_DEBUG'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'ACPI_CONFIGFS'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'EDAC_DEBUG'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'DRM_I915_DEBUG'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'BCACHE_CLOSURES_DEBUG'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'DVB_C8SECTPFE'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'MTD_SLRAM'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'MTD_PHRAM'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'IO_URING'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'KCMP'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'RSEQ'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'LATENCYTOP'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'KCOV'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'PROVIDE_OHCI1394_DMA_INIT'
,
'is not set'
)]
l
+=
[
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'SUNRPC_DEBUG'
,
'is not set'
)]
l
+=
[
AND
(
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'PTDUMP_DEBUGFS'
,
'is not set'
),
OptCheck
(
'cut_attack_surface'
,
'grsecurity
'
,
'X86_PTDUMP'
,
'is not set'
))]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'kspp'
,
'LEGACY_VSYSCALL_NONE'
,
'y'
)]
# 'vsyscall=none'
# 'cut_attack_surface', 'grsec'
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'ZSMALLOC_STAT'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'PAGE_OWNER'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'DEBUG_KMEMLEAK'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'BINFMT_AOUT'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'KPROBE_EVENTS'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'UPROBE_EVENTS'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'GENERIC_TRACER'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'FUNCTION_TRACER'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'STACK_TRACER'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'HIST_TRIGGERS'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'BLK_DEV_IO_TRACE'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'PROC_VMCORE'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'PROC_PAGE_MONITOR'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'USELIB'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'CHECKPOINT_RESTORE'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'USERFAULTFD'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'HWPOISON_INJECT'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'MEM_SOFT_DIRTY'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'DEVPORT'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'DEBUG_FS'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'NOTIFIER_ERROR_INJECTION'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'FAIL_FUTEX'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'PUNIT_ATOM_DEBUG'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'ACPI_CONFIGFS'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'EDAC_DEBUG'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'DRM_I915_DEBUG'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'BCACHE_CLOSURES_DEBUG'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'DVB_C8SECTPFE'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'MTD_SLRAM'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'MTD_PHRAM'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'IO_URING'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'KCMP'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'RSEQ'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'LATENCYTOP'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'KCOV'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'PROVIDE_OHCI1394_DMA_INIT'
,
'is not set'
)]
l
+=
[
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'SUNRPC_DEBUG'
,
'is not set'
)]
l
+=
[
AND
(
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'PTDUMP_DEBUGFS'
,
'is not set'
),
KconfigCheck
(
'cut_attack_surface'
,
'grsec
'
,
'X86_PTDUMP'
,
'is not set'
))]
# 'cut_attack_surface', 'maintainer'
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'maintainer'
,
'DRM_LEGACY'
,
'is not set'
)]
# recommended by Daniel Vetter in /issues/38
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'maintainer'
,
'FB'
,
'is not set'
)]
# recommended by Daniel Vetter in /issues/38
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'maintainer'
,
'VT'
,
'is not set'
)]
# recommended by Daniel Vetter in /issues/38
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'maintainer'
,
'BLK_DEV_FD'
,
'is not set'
)]
# recommended by Denis Efremov in /pull/54
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'maintainer'
,
'DRM_LEGACY'
,
'is not set'
)]
# recommended by Daniel Vetter in /issues/38
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'maintainer'
,
'FB'
,
'is not set'
)]
# recommended by Daniel Vetter in /issues/38
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'maintainer'
,
'VT'
,
'is not set'
)]
# recommended by Daniel Vetter in /issues/38
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'maintainer'
,
'BLK_DEV_FD'
,
'is not set'
)]
# recommended by Denis Efremov in /pull/54
# 'cut_attack_surface', 'grapheneos'
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'grapheneos'
,
'AIO'
,
'is not set'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'grapheneos'
,
'AIO'
,
'is not set'
)]
# 'cut_attack_surface', 'clipos'
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'clipos'
,
'STAGING'
,
'is not set'
)]
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'clipos'
,
'KSM'
,
'is not set'
)]
# to prevent FLUSH+RELOAD attack
# l += [
Opt
Check('cut_attack_surface', 'clipos', 'IKCONFIG', 'is not set')] # no, IKCONFIG is needed for this check :)
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'clipos'
,
'KALLSYMS'
,
'is not set'
)]
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'clipos'
,
'X86_VSYSCALL_EMULATION'
,
'is not set'
)]
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'clipos'
,
'MAGIC_SYSRQ'
,
'is not set'
)]
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'clipos'
,
'KEXEC_FILE'
,
'is not set'
)]
# refers to LOCKDOWN (permissive)
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'clipos'
,
'USER_NS'
,
'is not set'
)]
# user.max_user_namespaces=0
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'clipos'
,
'X86_MSR'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'clipos'
,
'X86_CPUID'
,
'is not set'
)]
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'clipos'
,
'X86_IOPL_IOPERM'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'clipos'
,
'ACPI_TABLE_UPGRADE'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'clipos'
,
'EFI_CUSTOM_SSDT_OVERLAYS'
,
'is not set'
)]
l
+=
[
AND
(
Opt
Check
(
'cut_attack_surface'
,
'clipos'
,
'LDISC_AUTOLOAD'
,
'is not set'
),
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'clipos'
,
'STAGING'
,
'is not set'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'clipos'
,
'KSM'
,
'is not set'
)]
# to prevent FLUSH+RELOAD attack
# l += [
Kconfig
Check('cut_attack_surface', 'clipos', 'IKCONFIG', 'is not set')] # no, IKCONFIG is needed for this check :)
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'clipos'
,
'KALLSYMS'
,
'is not set'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'clipos'
,
'X86_VSYSCALL_EMULATION'
,
'is not set'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'clipos'
,
'MAGIC_SYSRQ'
,
'is not set'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'clipos'
,
'KEXEC_FILE'
,
'is not set'
)]
# refers to LOCKDOWN (permissive)
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'clipos'
,
'USER_NS'
,
'is not set'
)]
# user.max_user_namespaces=0
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'clipos'
,
'X86_MSR'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'clipos'
,
'X86_CPUID'
,
'is not set'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'clipos'
,
'X86_IOPL_IOPERM'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'clipos'
,
'ACPI_TABLE_UPGRADE'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'clipos'
,
'EFI_CUSTOM_SSDT_OVERLAYS'
,
'is not set'
)]
l
+=
[
AND
(
Kconfig
Check
(
'cut_attack_surface'
,
'clipos'
,
'LDISC_AUTOLOAD'
,
'is not set'
),
PresenceCheck
(
'LDISC_AUTOLOAD'
))]
if
arch
in
(
'X86_64'
,
'X86_32'
):
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'clipos'
,
'X86_INTEL_TSX_MODE_OFF'
,
'y'
)]
# tsx=off
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'clipos'
,
'X86_INTEL_TSX_MODE_OFF'
,
'y'
)]
# tsx=off
# 'cut_attack_surface', 'lockdown'
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'lockdown'
,
'EFI_TEST'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'lockdown'
,
'BPF_SYSCALL'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'lockdown'
,
'MMIOTRACE_TEST'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'lockdown'
,
'KPROBES'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'lockdown'
,
'EFI_TEST'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'lockdown'
,
'BPF_SYSCALL'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'lockdown'
,
'MMIOTRACE_TEST'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'lockdown'
,
'KPROBES'
,
'is not set'
)]
# refers to LOCKDOWN
# 'cut_attack_surface', 'my'
l
+=
[
OR
(
Opt
Check
(
'cut_attack_surface'
,
'my'
,
'TRIM_UNUSED_KSYMS'
,
'y'
),
l
+=
[
OR
(
Kconfig
Check
(
'cut_attack_surface'
,
'my'
,
'TRIM_UNUSED_KSYMS'
,
'y'
),
modules_not_set
)]
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'my'
,
'MMIOTRACE'
,
'is not set'
)]
# refers to LOCKDOWN (permissive)
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'my'
,
'LIVEPATCH'
,
'is not set'
)]
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'my'
,
'IP_DCCP'
,
'is not set'
)]
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'my'
,
'IP_SCTP'
,
'is not set'
)]
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'my'
,
'FTRACE'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'my'
,
'VIDEO_VIVID'
,
'is not set'
)]
l
+=
[
Opt
Check
(
'cut_attack_surface'
,
'my'
,
'INPUT_EVBUG'
,
'is not set'
)]
# Can be used as a keylogger
# '
userspace_hardening
'
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'my'
,
'MMIOTRACE'
,
'is not set'
)]
# refers to LOCKDOWN (permissive)
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'my'
,
'LIVEPATCH'
,
'is not set'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'my'
,
'IP_DCCP'
,
'is not set'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'my'
,
'IP_SCTP'
,
'is not set'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'my'
,
'FTRACE'
,
'is not set'
)]
# refers to LOCKDOWN
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'my'
,
'VIDEO_VIVID'
,
'is not set'
)]
l
+=
[
Kconfig
Check
(
'cut_attack_surface'
,
'my'
,
'INPUT_EVBUG'
,
'is not set'
)]
# Can be used as a keylogger
# '
harden_userspace
'
if
arch
in
(
'X86_64'
,
'ARM64'
,
'X86_32'
):
l
+=
[
OptCheck
(
'userspace_hardening
'
,
'defconfig'
,
'INTEGRITY'
,
'y'
)]
l
+=
[
KconfigCheck
(
'harden_userspace
'
,
'defconfig'
,
'INTEGRITY'
,
'y'
)]
if
arch
==
'ARM'
:
l
+=
[
OptCheck
(
'userspace_hardening
'
,
'my'
,
'INTEGRITY'
,
'y'
)]
l
+=
[
KconfigCheck
(
'harden_userspace
'
,
'my'
,
'INTEGRITY'
,
'y'
)]
if
arch
==
'ARM64'
:
l
+=
[
OptCheck
(
'userspace_hardening
'
,
'defconfig'
,
'ARM64_MTE'
,
'y'
)]
l
+=
[
KconfigCheck
(
'harden_userspace
'
,
'defconfig'
,
'ARM64_MTE'
,
'y'
)]
if
arch
in
(
'ARM'
,
'X86_32'
):
l
+=
[
OptCheck
(
'userspace_hardening
'
,
'defconfig'
,
'VMSPLIT_3G'
,
'y'
)]
l
+=
[
KconfigCheck
(
'harden_userspace
'
,
'defconfig'
,
'VMSPLIT_3G'
,
'y'
)]
if
arch
in
(
'X86_64'
,
'ARM64'
):
l
+=
[
OptCheck
(
'userspace_hardening
'
,
'clipos'
,
'ARCH_MMAP_RND_BITS'
,
'32'
)]
l
+=
[
KconfigCheck
(
'harden_userspace
'
,
'clipos'
,
'ARCH_MMAP_RND_BITS'
,
'32'
)]
if
arch
in
(
'X86_32'
,
'ARM'
):
l
+=
[
OptCheck
(
'userspace_hardening
'
,
'my'
,
'ARCH_MMAP_RND_BITS'
,
'16'
)]
l
+=
[
KconfigCheck
(
'harden_userspace
'
,
'my'
,
'ARCH_MMAP_RND_BITS'
,
'16'
)]
# l += [
Opt
Check('feature_test', 'my', 'LKDTM', 'm')] # only for debugging!
# l += [
Kconfig
Check('feature_test', 'my', 'LKDTM', 'm')] # only for debugging!
def
print_unknown_options
(
checklist
,
parsed_options
):
...
...
@@ -616,7 +623,7 @@ def print_checklist(mode, checklist, with_results):
if
mode
==
'json'
:
opts
=
[]
for
o
in
checklist
:
opt
=
[
'CONFIG_'
+
o
.
name
,
o
.
expected
,
o
.
decision
,
o
.
reason
]
opt
=
[
'CONFIG_'
+
o
.
name
,
o
.
type
,
o
.
expected
,
o
.
decision
,
o
.
reason
]
if
with_results
:
opt
.
append
(
o
.
result
)
opts
.
append
(
opt
)
...
...
@@ -628,9 +635,9 @@ def print_checklist(mode, checklist, with_results):
if
with_results
:
sep_line_len
+=
30
print
(
'='
*
sep_line_len
)
print
(
'{:^4
5}|{:^13}|{:^10}|{:^20}'
.
format
(
'option nam
e'
,
'desired val'
,
'decision'
,
'reason'
),
end
=
''
)
print
(
'{:^4
0}|{:^7}|{:^12}|{:^10}|{:^18}'
.
format
(
'option name'
,
'typ
e'
,
'desired val'
,
'decision'
,
'reason'
),
end
=
''
)
if
with_results
:
print
(
'|
{}'
.
format
(
'check result'
),
end
=
''
)
print
(
'| {}'
.
format
(
'check result'
),
end
=
''
)
print
()
print
(
'='
*
sep_line_len
)
...
...
@@ -663,13 +670,13 @@ def print_checklist(mode, checklist, with_results):
print
(
'[+] Config check is finished:
\'
OK
\'
- {}{} /
\'
FAIL
\'
- {}{}'
.
format
(
ok_count
,
ok_suppressed
,
fail_count
,
fail_suppressed
))
def
p
erform_check
(
opt
,
parsed_options
,
kernel_version
):
def
p
opulate_opt_with_data
(
opt
,
parsed_options
,
kernel_version
):
if
hasattr
(
opt
,
'opts'
):
# prepare ComplexOptCheck
for
o
in
opt
.
opts
:
if
hasattr
(
o
,
'opts'
):
# Recursion for nested ComplexOptChecks
p
erform_check
(
o
,
parsed_options
,
kernel_version
)
p
opulate_opt_with_data
(
o
,
parsed_options
,
kernel_version
)
if
hasattr
(
o
,
'state'
):
o
.
state
=
parsed_options
.
get
(
o
.
name
,
None
)
if
hasattr
(
o
,
'ver'
):
...
...
@@ -679,15 +686,19 @@ def perform_check(opt, parsed_options, kernel_version):
if
not
hasattr
(
opt
,
'state'
):
sys
.
exit
(
'[!] ERROR: bad simple check {}'
.
format
(
vars
(
opt
)))
opt
.
state
=
parsed_options
.
get
(
opt
.
name
,
None
)
opt
.
check
()
def
p
erform_checks
(
checklist
,
parsed_options
,
kernel_version
):
def
p
opulate_with_data
(
checklist
,
parsed_options
,
kernel_version
):
for
opt
in
checklist
:
p
erform_check
(
opt
,
parsed_options
,
kernel_version
)
p
opulate_opt_with_data
(
opt
,
parsed_options
,
kernel_version
)
def
parse_config_file
(
parsed_options
,
fname
):
def
perform_checks
(
checklist
):
for
opt
in
checklist
:
opt
.
check
()
def
parse_kconfig_file
(
parsed_options
,
fname
):
with
open
(
fname
,
'r'
)
as
f
:
opt_is_on
=
re
.
compile
(
"CONFIG_[a-zA-Z0-9_]*=[a-zA-Z0-9_
\"
]*"
)
opt_is_off
=
re
.
compile
(
"# CONFIG_[a-zA-Z0-9_]* is not set"
)
...
...
@@ -702,10 +713,10 @@ def parse_config_file(parsed_options, fname):
elif
opt_is_off
.
match
(
line
):
option
,
value
=
line
[
9
:]
.
split
(
' '
,
1
)
if
value
!=
'is not set'
:
sys
.
exit
(
'[!] ERROR: bad disabled config option "{}"'
.
format
(
line
))
sys
.
exit
(
'[!] ERROR: bad disabled
k
config option "{}"'
.
format
(
line
))
if
option
in
parsed_options
:
sys
.
exit
(
'[!] ERROR: config option "{}" exists multiple times'
.
format
(
line
))
sys
.
exit
(
'[!] ERROR:
k
config option "{}" exists multiple times'
.
format
(
line
))
if
option
:
parsed_options
[
option
]
=
value
...
...
@@ -716,7 +727,7 @@ def parse_config_file(parsed_options, fname):
def
main
():
# Report modes:
# * verbose mode for
# - reporting about unknown kernel options in the config
# - reporting about unknown kernel options in the
k
config
# - verbose printing of ComplexOptCheck items
# * json mode for printing the results in JSON format
report_modes
=
[
'verbose'
,
'json'
,
'show_ok'
,
'show_fail'
]
...
...
@@ -727,7 +738,7 @@ def main():
parser
.
add_argument
(
'-p'
,
'--print'
,
choices
=
supported_archs
,
help
=
'print security hardening preferences for the selected architecture'
)
parser
.
add_argument
(
'-c'
,
'--config'
,
help
=
'check the kernel config file against these preferences'
)
help
=
'check the kernel
k
config file against these preferences'
)
parser
.
add_argument
(
'-m'
,
'--mode'
,
choices
=
report_modes
,
help
=
'choose the report mode'
)
args
=
parser
.
parse_args
()
...
...
@@ -742,7 +753,7 @@ def main():
if
args
.
config
:
if
mode
!=
'json'
:
print
(
'[+]
C
onfig file to check: {}'
.
format
(
args
.
config
))
print
(
'[+]
Kc
onfig file to check: {}'
.
format
(
args
.
config
))
arch
,
msg
=
detect_arch
(
args
.
config
,
supported_archs
)
if
not
arch
:
...
...
@@ -756,22 +767,29 @@ def main():
if
mode
!=
'json'
:
print
(
'[+] Detected kernel version: {}.{}'
.
format
(
kernel_version
[
0
],
kernel_version
[
1
]))
construct_checklist
(
config_checklist
,
arch
)
parsed_options
=
OrderedDict
()
parse_config_file
(
parsed_options
,
args
.
config
)
perform_checks
(
config_checklist
,
parsed_options
,
kernel_version
)
# add relevant kconfig checks to the checklist
add_kconfig_checks
(
config_checklist
,
arch
)
# populate the checklist with the parsed kconfig data
parsed_kconfig_options
=
OrderedDict
()
parse_kconfig_file
(
parsed_kconfig_options
,
args
.
config
)
populate_with_data
(
config_checklist
,
parsed_kconfig_options
,
kernel_version
)
# now everything is ready for performing the checks
perform_checks
(
config_checklist
)
# finally print the results
if
mode
==
'verbose'
:
print_unknown_options
(
config_checklist
,
parsed_options
)
print_unknown_options
(
config_checklist
,
parsed_
kconfig_
options
)
print_checklist
(
mode
,
config_checklist
,
True
)
sys
.
exit
(
0
)
if
args
.
print
:
if
mode
in
(
'show_ok'
,
'show_fail'
):
sys
.
exit
(
'[!] ERROR:
please use "{}" mode for checking the kernel config
'
.
format
(
mode
))
sys
.
exit
(
'[!] ERROR:
wrong mode "{}" for --print
'
.
format
(
mode
))
arch
=
args
.
print
construct_checklist
(
config_checklist
,
arch
)
add_kconfig_checks
(
config_checklist
,
arch
)
if
mode
!=
'json'
:
print
(
'[+] Printing kernel security hardening preferences for {}...'
.
format
(
arch
))
print_checklist
(
mode
,
config_checklist
,
False
)
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment
