Greg Kroah-Hartman
598cf27219
Link: https://lore.kernel.org/r/20260217200002.683975158@linuxfoundation.org Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com> Tested-by: Peter Schneider <pschneider1968@googlemail.com> Tested-by: Jon Hunter <jonathanh@nvidia.com> Tested-by: Salvatore Bonaccorso <carnil@debian.org> Tested-by: Brett A C Sheffield <bacs@librecast.net> Tested-by: Mark Brown <broonie@kernel.org> Tested-by: Luna Jernberg <droidbittin@gmail.com> Tested-by: Ronald Warsow <rwarsow@gmx.de> Tested-by: Justin M. Forbes <jforbes@fedoraproject.org> Tested-by: Ron Economos <re@w6rz.net> Tested-by: Miguel Ojeda <ojeda@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
52 lines
1.4 KiB
Bash
Executable File
52 lines
1.4 KiB
Bash
Executable File
#!/bin/sh
|
|
# SPDX-License-Identifier: GPL-2.0
|
|
#
|
|
# Measure kernel stack entropy by sampling via LKDTM's REPORT_STACK test.
|
|
set -e
|
|
samples="${1:-1000}"
|
|
TRIGGER=/sys/kernel/debug/provoke-crash/DIRECT
|
|
KSELFTEST_SKIP_TEST=4
|
|
|
|
# Verify we have LKDTM available in the kernel.
|
|
if [ ! -r $TRIGGER ] ; then
|
|
/sbin/modprobe -q lkdtm || true
|
|
if [ ! -r $TRIGGER ] ; then
|
|
echo "Cannot find $TRIGGER (missing CONFIG_LKDTM?)"
|
|
else
|
|
echo "Cannot write $TRIGGER (need to run as root?)"
|
|
fi
|
|
# Skip this test
|
|
exit $KSELFTEST_SKIP_TEST
|
|
fi
|
|
|
|
# Capture dmesg continuously since it may fill up depending on sample size.
|
|
log=$(mktemp -t stack-entropy-XXXXXX)
|
|
dmesg --follow >"$log" & pid=$!
|
|
report=-1
|
|
for i in $(seq 1 $samples); do
|
|
echo "REPORT_STACK" > $TRIGGER
|
|
if [ -t 1 ]; then
|
|
percent=$(( 100 * $i / $samples ))
|
|
if [ "$percent" -ne "$report" ]; then
|
|
/bin/echo -en "$percent%\r"
|
|
report="$percent"
|
|
fi
|
|
fi
|
|
done
|
|
kill "$pid"
|
|
|
|
# Count unique offsets since last run.
|
|
seen=$(tac "$log" | grep -m1 -B"$samples"0 'Starting stack offset' | \
|
|
grep 'Stack offset' | awk '{print $NF}' | sort | uniq -c | wc -l)
|
|
bits=$(echo "obase=2; $seen" | bc | wc -L)
|
|
echo "Bits of stack entropy: $bits"
|
|
rm -f "$log"
|
|
|
|
# We would expect any functional stack randomization to be at least 5 bits.
|
|
if [ "$bits" -lt 5 ]; then
|
|
echo "Stack entropy is low! Booted without 'randomize_kstack_offset=y'?"
|
|
exit 1
|
|
else
|
|
exit 0
|
|
fi
|