forked from siderolabs/pkgs
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: add KSPP compliance check script
We tailor results for our needs. I picked Python for the script as we don't have jq in the tools ;) Also fixed the kernel config to be compliant according to the script and subset of the enforcements. I had to add a patch to kernel's Kconfig files to switch off some default options which otherwise get enabled via `olddefconfig` and violate KSPP. Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
- Loading branch information
Showing
7 changed files
with
147 additions
and
14 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig | ||
| index 7101ac64bb20..e2c8cff3f791 100644 | ||
| --- a/arch/x86/Kconfig | ||
| +++ b/arch/x86/Kconfig | ||
| @@ -41,7 +41,7 @@ config FORCE_DYNAMIC_FTRACE | ||
| in order to test the non static function tracing in the | ||
| generic code, as other architectures still use it. But we | ||
| only need to keep it around for x86_64. No need to keep it | ||
| - for x86_32. For x86_32, force DYNAMIC_FTRACE. | ||
| + for x86_32. For x86_32, force DYNAMIC_FTRACE. | ||
| # | ||
| # Arch settings | ||
| # | ||
| @@ -1191,7 +1191,6 @@ config VM86 | ||
|
|
||
| config X86_16BIT | ||
| bool "Enable support for 16-bit segments" if EXPERT | ||
| - default y | ||
| depends on MODIFY_LDT_SYSCALL | ||
| help | ||
| This option is required by programs like Wine to run 16-bit | ||
| @@ -1204,7 +1203,7 @@ config X86_ESPFIX32 | ||
| depends on X86_16BIT && X86_32 | ||
|
|
||
| config X86_ESPFIX64 | ||
| - def_bool y | ||
| + bool "Foo" | ||
| depends on X86_16BIT && X86_64 | ||
|
|
||
| config X86_VSYSCALL_EMULATION | ||
| @@ -2405,7 +2404,6 @@ config CMDLINE_OVERRIDE | ||
|
|
||
| config MODIFY_LDT_SYSCALL | ||
| bool "Enable the LDT (local descriptor table)" if EXPERT | ||
| - default y | ||
| help | ||
| Linux can allow user programs to install a per-process x86 | ||
| Local Descriptor Table (LDT) using the modify_ldt(2) system | ||
| diff --git a/security/Kconfig b/security/Kconfig | ||
| index 7561f6f99f1d..7bf554bc0906 100644 | ||
| --- a/security/Kconfig | ||
| +++ b/security/Kconfig | ||
| @@ -166,7 +166,6 @@ config HARDENED_USERCOPY | ||
| config HARDENED_USERCOPY_FALLBACK | ||
| bool "Allow usercopy whitelist violations to fallback to object size" | ||
| depends on HARDENED_USERCOPY | ||
| - default y | ||
| help | ||
| This is a temporary option that allows missing usercopy whitelists | ||
| to be discovered via a WARN() to the kernel log, instead of | ||
| @@ -292,4 +291,3 @@ config LSM | ||
| source "security/Kconfig.hardening" | ||
|
|
||
| endmenu | ||
| - |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| """ | ||
| Script to filter JSON output of kconfig hardened check script. | ||
| """ | ||
|
|
||
| import json | ||
| import sys | ||
|
|
||
| """ | ||
| Names of check groups we analyze. | ||
| """ | ||
| GROUPS = {'defconfig', 'kspp'} | ||
|
|
||
| """ | ||
| Names of violations we ignore for a good reason. | ||
| """ | ||
| IGNORE_VIOLATIONS = { | ||
| 'CONFIG_MODULES', # enabled for backwards compat, modules require signing key which is thrown away | ||
| 'CONFIG_IA32_EMULATION', # see https://github.com/talos-systems/pkgs/pull/125 | ||
| } | ||
|
|
||
| def main(): | ||
| violations = json.load(sys.stdin) | ||
|
|
||
| # filter out non-failures | ||
| violations = [item for item in violations if item[4].startswith("FAIL")] | ||
|
|
||
| # filter only failures in the groups we're interested in | ||
| violations = [item for item in violations if item[2] in GROUPS] | ||
|
|
||
| # filter out violations we ignore | ||
| violations = [item for item in violations if item[0] not in IGNORE_VIOLATIONS] | ||
|
|
||
| if not violations: | ||
| sys.exit(0) | ||
|
|
||
| print('{:^45}|{:^13}|{:^10}|{:^20}'.format('option name', 'desired val', 'decision', 'reason')) | ||
| print('=' * 91) | ||
|
|
||
| for violation in violations: | ||
| print('{:<45}|{:^13}|{:^10}|{:^20}'.format(*violation)) | ||
|
|
||
| sys.exit(1) | ||
|
|
||
|
|
||
| if __name__ == "__main__": | ||
| main() |