From cf8d3739c10cd9e6e1b768b0fadd2518f97b9f99 Mon Sep 17 00:00:00 2001 From: jvoisin Date: Mon, 15 Apr 2024 14:05:42 +0200 Subject: [PATCH 1/2] Add a check for X86_USER_SHADOW_STACK This should close #114 --- kernel_hardening_checker/checks.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py index 5aff75e2..21f4d2f5 100644 --- a/kernel_hardening_checker/checks.py +++ b/kernel_hardening_checker/checks.py @@ -400,6 +400,8 @@ def add_kconfig_checks(l, arch): l += [KconfigCheck('cut_attack_surface', 'a13xp0p0v', 'MODULE_FORCE_LOAD', 'is not set')] # 'harden_userspace' + if arch == 'X86_64': + l += [KconfigCheck('harden_userspace', 'defconfig', 'X86_USER_SHADOW_STACK', 'y')] if arch == 'ARM64': l += [KconfigCheck('harden_userspace', 'defconfig', 'ARM64_PTR_AUTH', 'y')] l += [KconfigCheck('harden_userspace', 'defconfig', 'ARM64_BTI', 'y')] From cf20e03180e4c9841e7d0cb2f97418996ebd3148 Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Wed, 17 Apr 2024 19:12:12 +0300 Subject: [PATCH 2/2] Fix 'decision' for the X86_USER_SHADOW_STACK check Refers to #114, #120 --- kernel_hardening_checker/checks.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py index 21f4d2f5..5ec19cc5 100644 --- a/kernel_hardening_checker/checks.py +++ b/kernel_hardening_checker/checks.py @@ -400,8 +400,6 @@ def add_kconfig_checks(l, arch): l += [KconfigCheck('cut_attack_surface', 'a13xp0p0v', 'MODULE_FORCE_LOAD', 'is not set')] # 'harden_userspace' - if arch == 'X86_64': - l += [KconfigCheck('harden_userspace', 'defconfig', 'X86_USER_SHADOW_STACK', 'y')] if arch == 'ARM64': l += [KconfigCheck('harden_userspace', 'defconfig', 'ARM64_PTR_AUTH', 'y')] l += [KconfigCheck('harden_userspace', 'defconfig', 'ARM64_BTI', 'y')] @@ -409,6 +407,8 @@ def add_kconfig_checks(l, arch): l += [KconfigCheck('harden_userspace', 'defconfig', 'VMSPLIT_3G', 'y')] l += [KconfigCheck('harden_userspace', 'clipos', 'COREDUMP', 'is not set')] l += [KconfigCheck('harden_userspace', 'a13xp0p0v', 'ARCH_MMAP_RND_BITS', 'MAX')] # 'MAX' value is refined using ARCH_MMAP_RND_BITS_MAX + if arch == 'X86_64': + l += [KconfigCheck('harden_userspace', 'a13xp0p0v', 'X86_USER_SHADOW_STACK', 'y')] def add_cmdline_checks(l, arch):