The expected value on arm64 for a 48-bit address space (4 level page tables with 4k pa

Hi <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

CONFIG_ARCH_MMAP_RND_BITS check is wrong for arm64 about kconfig-hardened-check HOT 3 CLOSED

thestinger commented on July 30, 2024

CONFIG_ARCH_MMAP_RND_BITS check is wrong for arm64

from kconfig-hardened-check.

Comments (3)

a13xp0p0v commented on July 30, 2024

Hi @thestinger,

I agree with you, currently the code already does this.

Quoting init.py#L328:

        # hackish refinement of the CONFIG_ARCH_MMAP_RND_BITS check
        mmap_rnd_bits_max = parsed_kconfig_options.get('CONFIG_ARCH_MMAP_RND_BITS_MAX', None)
        if mmap_rnd_bits_max:
            override_expected_value(config_checklist, 'CONFIG_ARCH_MMAP_RND_BITS', mmap_rnd_bits_max)
        else:
            # remove the CONFIG_ARCH_MMAP_RND_BITS check to avoid false results
            print('[-] Can\'t check CONFIG_ARCH_MMAP_RND_BITS without CONFIG_ARCH_MMAP_RND_BITS_MAX')
            config_checklist[:] = [o for o in config_checklist if o.name != 'CONFIG_ARCH_MMAP_RND_BITS']

So kernel-hardening-checker creates this recommendation dynamically.

The example output for arm64_defconfig_6.6.config:

[+] Kconfig file to check: kernel_hardening_checker/config_files/defconfigs/arm64_defconfig_6.6.config
[+] Detected microarchitecture: ARM64
[+] Detected kernel version: 6.6
[+] Detected compiler: GCC 130001
...
CONFIG_ARCH_MMAP_RND_BITS               |kconfig|     33     |    my    | harden_userspace | FAIL: "18"

I'll create a new tag very soon, and this will get into the new release of the tool.

from kconfig-hardened-check.

thestinger commented on July 30, 2024

I can also start testing with the git revision now before making recommendations, it just didn't occur to me that it had been a long time since the last stable release and I didn't see recent commits for those things.

from kconfig-hardened-check.

a13xp0p0v commented on July 30, 2024

@thestinger, thank you for testing!

Preparing a release of the tool corresponding to the new kernel version takes a lot of effort.

I hope to find resources to do that more often.

from kconfig-hardened-check.

Recommend Projects