Add kconfig-hardened-check.py

This script helps me to check the Linux kernel Kconfig option list
against my hardening preferences for x86_64.

Nobody likes checking configs manually. Let the computers do their job!

Signed-off-by: Alexander Popov <alex.popov@linux.com>

README.md

+# Kconfig hardened check
+
+## Motivation
+
+There are plenty of Linux kernel hardening config options. A lot of them are
+not enabled by the major distros. We have to enable these options ourselves to
+make our systems more secure.
+
+But nobody likes checking configs manually. So let the computers do their job!
+
+__kconfig-hardened-check.py__ helps me to check the Linux kernel Kconfig option list
+against my hardening preferences for `x86_64`, which are based on the
+[KSPP recommended settings][1]
+
+Please don't cry if my Python code looks like C. I'm just a kernel developer.
+
+## Script output examples
+
+### Usage
+```
+#./kconfig-hardened-check.py
+Usage: ./kconfig-hardened-check.py [-p | -c <config_file>]
+ -p, --print
+	print hardening preferences
+ -c <config_file>, --config=<config_file>
+	check the config_file against these preferences
+```
+
+### Script output for `Ubuntu 18.04 (Bionic Beaver)` kernel config
+```
+./kconfig-hardened-check.py -c ubuntu-bionic-generic.config
+[+] Checking "ubuntu-bionic-generic.config" against hardening preferences...
+  option name                            | desired val | decision |       reason       ||    check result    
+  ===========================================================================================================
+  CONFIG_BUG                             |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_PAGE_TABLE_ISOLATION            |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_RETPOLINE                       |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_X86_64                          |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_STRICT_KERNEL_RWX               |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_STRICT_MODULE_RWX               |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_DEBUG_WX                        |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_RANDOMIZE_BASE                  |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_RANDOMIZE_MEMORY                |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_CC_STACKPROTECTOR_STRONG        |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_VMAP_STACK                      |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_THREAD_INFO_IN_TASK             |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_SCHED_STACK_END_CHECK           |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_SLUB_DEBUG                      |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_SLAB_FREELIST_HARDENED          |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_SLAB_FREELIST_RANDOM            |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_HARDENED_USERCOPY               |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_FORTIFY_SOURCE                  |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_STRICT_DEVMEM                   |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_SYN_COOKIES                     |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_SECCOMP                         |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_SECCOMP_FILTER                  |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_MODULE_SIG                      |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_MODULE_SIG_ALL                  |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_MODULE_SIG_SHA512               |      y      | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_DEFAULT_MMAP_MIN_ADDR           |    65536    | ubuntu18 |  self_protection   ||         OK         
+  CONFIG_BUG_ON_DATA_CORRUPTION          |      y      |   kspp   |  self_protection   || FAIL: "is not set" 
+  CONFIG_PAGE_POISONING                  |      y      |   kspp   |  self_protection   || FAIL: "is not set" 
+  CONFIG_GCC_PLUGINS                     |      y      |   kspp   |  self_protection   || FAIL: "is not set" 
+  CONFIG_GCC_PLUGIN_RANDSTRUCT           |      y      |   kspp   |  self_protection   ||  FAIL: not found   
+  CONFIG_GCC_PLUGIN_STRUCTLEAK           |      y      |   kspp   |  self_protection   ||  FAIL: not found   
+  CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL |      y      |   kspp   |  self_protection   ||  FAIL: not found   
+  CONFIG_GCC_PLUGIN_LATENT_ENTROPY       |      y      |   kspp   |  self_protection   ||  FAIL: not found   
+  CONFIG_IO_STRICT_DEVMEM                |      y      |   kspp   |  self_protection   || FAIL: "is not set" 
+  CONFIG_REFCOUNT_FULL                   |      y      |   kspp   |  self_protection   || FAIL: "is not set" 
+  CONFIG_DEBUG_LIST                      |      y      |   kspp   |  self_protection   || FAIL: "is not set" 
+  CONFIG_DEBUG_SG                        |      y      |   kspp   |  self_protection   || FAIL: "is not set" 
+  CONFIG_DEBUG_CREDENTIALS               |      y      |   kspp   |  self_protection   || FAIL: "is not set" 
+  CONFIG_DEBUG_NOTIFIERS                 |      y      |   kspp   |  self_protection   || FAIL: "is not set" 
+  CONFIG_MODULE_SIG_FORCE                |      y      |   kspp   |  self_protection   || FAIL: "is not set" 
+  CONFIG_HARDENED_USERCOPY_FALLBACK      | is not set  |   kspp   |  self_protection   ||  FAIL: not found   
+  CONFIG_GCC_PLUGIN_STACKLEAK            |      y      |    my    |  self_protection   ||  FAIL: not found   
+  CONFIG_SLUB_DEBUG_ON                   |      y      |    my    |  self_protection   || FAIL: "is not set" 
+  CONFIG_SECURITY_DMESG_RESTRICT         |      y      |    my    |  self_protection   || FAIL: "is not set" 
+  CONFIG_STATIC_USERMODEHELPER           |      y      |    my    |  self_protection   || FAIL: "is not set" 
+  CONFIG_SECURITY                        |      y      | ubuntu18 |  security_policy   ||         OK         
+  CONFIG_SECURITY_YAMA                   |      y      | ubuntu18 |  security_policy   ||         OK         
+  CONFIG_SECURITY_SELINUX_DISABLE        | is not set  | ubuntu18 |  security_policy   ||         OK         
+  CONFIG_ACPI_CUSTOM_METHOD              | is not set  | ubuntu18 | cut_attack_surface ||         OK         
+  CONFIG_COMPAT_BRK                      | is not set  | ubuntu18 | cut_attack_surface ||         OK         
+  CONFIG_DEVKMEM                         | is not set  | ubuntu18 | cut_attack_surface ||         OK         
+  CONFIG_COMPAT_VDSO                     | is not set  | ubuntu18 | cut_attack_surface ||         OK         
+  CONFIG_LEGACY_VSYSCALL_NONE            |      y      |   kspp   | cut_attack_surface || FAIL: "is not set" 
+  CONFIG_BINFMT_MISC                     | is not set  |   kspp   | cut_attack_surface ||     FAIL: "m"      
+  CONFIG_INET_DIAG                       | is not set  |   kspp   | cut_attack_surface ||     FAIL: "m"      
+  CONFIG_KEXEC                           | is not set  |   kspp   | cut_attack_surface ||     FAIL: "y"      
+  CONFIG_PROC_KCORE                      | is not set  |   kspp   | cut_attack_surface ||     FAIL: "y"      
+  CONFIG_LEGACY_PTYS                     | is not set  |   kspp   | cut_attack_surface ||     FAIL: "y"      
+  CONFIG_IA32_EMULATION                  | is not set  |   kspp   | cut_attack_surface ||     FAIL: "y"      
+  CONFIG_X86_X32                         | is not set  |   kspp   | cut_attack_surface ||     FAIL: "y"      
+  CONFIG_MODIFY_LDT_SYSCALL              | is not set  |   kspp   | cut_attack_surface ||     FAIL: "y"      
+  CONFIG_KEXEC_FILE                      | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      
+  CONFIG_LIVEPATCH                       | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      
+  CONFIG_NAMESPACES                      | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      
+  CONFIG_IP_DCCP                         | is not set  |    my    | cut_attack_surface ||     FAIL: "m"      
+  CONFIG_FTRACE                          | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      
+  CONFIG_KPROBES                         | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      
+  CONFIG_PROFILING                       | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      
+  CONFIG_UPROBES                         | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      
+  CONFIG_BPF_JIT                         | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      
+  CONFIG_BPF_SYSCALL                     | is not set  |    my    | cut_attack_surface ||     FAIL: "y"      
+  CONFIG_LKDTM                           |      m      |    my    |    feature_test    || FAIL: "is not set" 
+
+[-] config check is NOT PASSED: 39 errors
+```
+
+__Go and fix them all!__
+
+[1]: http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings
+

kspp-recommendations.config

+# CONFIGs
+
+# Report BUG() conditions and kill the offending process.
+CONFIG_BUG=y
+
+# Make sure kernel page tables have safe permissions.
+CONFIG_DEBUG_KERNEL=y
+CONFIG_STRICT_KERNEL_RWX=y
+
+# Report any dangerous memory permissions (not available on all archs).
+CONFIG_DEBUG_WX=y
+
+# Use -fstack-protector-strong (gcc 4.9+) for best stack canary coverage.
+CONFIG_CC_STACKPROTECTOR=y
+CONFIG_CC_STACKPROTECTOR_STRONG=y
+
+# Do not allow direct physical memory access (but if you must have it, at least enable STRICT mode...)
+# CONFIG_DEVMEM is not set
+CONFIG_STRICT_DEVMEM=y
+CONFIG_IO_STRICT_DEVMEM=y
+
+# Provides some protections against SYN flooding.
+CONFIG_SYN_COOKIES=y
+
+# Perform additional validation of various commonly targeted structures.
+CONFIG_DEBUG_CREDENTIALS=y
+CONFIG_DEBUG_NOTIFIERS=y
+CONFIG_DEBUG_LIST=y
+CONFIG_DEBUG_SG=y
+CONFIG_BUG_ON_DATA_CORRUPTION=y
+CONFIG_SCHED_STACK_END_CHECK=y
+
+# Provide userspace with seccomp BPF API for syscall attack surface reduction.
+CONFIG_SECCOMP=y
+CONFIG_SECCOMP_FILTER=y
+
+# Provide userspace with ptrace ancestry protections.
+CONFIG_SECURITY=y
+CONFIG_SECURITY_YAMA=y
+
+# Perform usercopy bounds checking. (And disable fallback to gain full whitelist enforcement.)
+CONFIG_HARDENED_USERCOPY=y
+# CONFIG_HARDENED_USERCOPY_FALLBACK is not set
+
+# Randomize allocator freelists, harden metadata.
+CONFIG_SLAB_FREELIST_RANDOM=y
+CONFIG_SLAB_FREELIST_HARDENED=y
+
+# Allow allocator validation checking to be enabled (see "slub_debug=P" below).
+CONFIG_SLUB_DEBUG=y
+
+# Wipe higher-level memory allocations when they are freed (needs "page_poison=1" command line below).
+# (If you can afford even more performance penalty, leave CONFIG_PAGE_POISONING_NO_SANITY=n)
+CONFIG_PAGE_POISONING=y
+CONFIG_PAGE_POISONING_NO_SANITY=y
+CONFIG_PAGE_POISONING_ZERO=y
+
+# Adds guard pages to kernel stacks (not all architectures support this yet).
+CONFIG_VMAP_STACK=y
+
+# Perform extensive checks on reference counting.
+CONFIG_REFCOUNT_FULL=y
+
+# Check for memory copies that might overflow a structure in str*() and mem*() functions both at build-time and run-time.
+CONFIG_FORTIFY_SOURCE=y
+
+# Dangerous; enabling this allows direct physical memory writing.
+# CONFIG_ACPI_CUSTOM_METHOD is not set
+
+# Dangerous; enabling this disables brk ASLR.
+# CONFIG_COMPAT_BRK is not set
+
+# Dangerous; enabling this allows direct kernel memory writing.
+# CONFIG_DEVKMEM is not set
+
+# Dangerous; exposes kernel text image layout.
+# CONFIG_PROC_KCORE is not set
+
+# Dangerous; enabling this disables VDSO ASLR.
+# CONFIG_COMPAT_VDSO is not set
+
+# Dangerous; enabling this allows replacement of running kernel.
+# CONFIG_KEXEC is not set
+
+# Dangerous; enabling this allows replacement of running kernel.
+# CONFIG_HIBERNATION is not set
+
+# Prior to v4.1, assists heap memory attacks; best to keep interface disabled.
+# CONFIG_INET_DIAG is not set
+
+# Easily confused by misconfigured userspace, keep off.
+# CONFIG_BINFMT_MISC is not set
+
+# Use the modern PTY interface (devpts) only.
+# CONFIG_LEGACY_PTYS is not set
+
+# If SELinux can be disabled at runtime, the LSM structures cannot be read-only; keep off.
+# CONFIG_SECURITY_SELINUX_DISABLE is not set
+
+# Reboot devices immediately if kernel experiences an Oops.
+CONFIG_PANIC_ON_OOPS=y
+CONFIG_PANIC_TIMEOUT=-1
+
+# Keep root from altering kernel memory via loadable modules.
+# CONFIG_MODULES is not set
+
+# But if CONFIG_MODULE=y is needed, at least they must be signed with a per-build key.
+CONFIG_STRICT_MODULE_RWX=y
+CONFIG_MODULE_SIG=y
+CONFIG_MODULE_SIG_FORCE=y
+CONFIG_MODULE_SIG_ALL=y
+CONFIG_MODULE_SIG_SHA512=y
+CONFIG_MODULE_SIG_HASH="sha512"
+CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
+
+
+# GCC plugins
+
+# Enable GCC Plugins
+CONFIG_GCC_PLUGINS=y
+
+# Gather additional entropy at boot time for systems that may not have appropriate entropy sources.
+CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y
+
+# Force all structures to be initialized before they are passed to other functions.
+CONFIG_GCC_PLUGIN_STRUCTLEAK=y
+CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y
+
+# Randomize the layout of system structures. This may have dramatic performance impact, so
+# use with caution or also use CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE=y
+CONFIG_GCC_PLUGIN_RANDSTRUCT=y
+
+
+#x86_64
+
+# Full 64-bit means PAE and NX bit.
+CONFIG_X86_64=y
+
+# Disallow allocating the first 64k of memory.
+CONFIG_DEFAULT_MMAP_MIN_ADDR=65536
+
+# Randomize position of kernel and memory.
+CONFIG_RANDOMIZE_BASE=y
+CONFIG_RANDOMIZE_MEMORY=y
+
+# Modern libc no longer needs a fixed-position mapping in userspace, remove it as a possible target.
+CONFIG_LEGACY_VSYSCALL_NONE=y
+
+# Enable Kernel Page Table Isolation to remove an entire class of cache timing side-channels.
+CONFIG_PAGE_TABLE_ISOLATION=y
+
+# Remove additional attack surface, unless you really need them.
+# CONFIG_IA32_EMULATION is not set
+# CONFIG_X86_X32 is not set
+# CONFIG_MODIFY_LDT_SYSCALL is not set
+
+