1 #!/bin/sh 1 #!/bin/sh
2 # SPDX-License-Identifier: GPL-2.0 2 # SPDX-License-Identifier: GPL-2.0
3 # 3 #
4 # Measure kernel stack entropy by sampling via 4 # Measure kernel stack entropy by sampling via LKDTM's REPORT_STACK test.
5 set -e 5 set -e
6 samples="${1:-1000}" 6 samples="${1:-1000}"
7 TRIGGER=/sys/kernel/debug/provoke-crash/DIRECT 7 TRIGGER=/sys/kernel/debug/provoke-crash/DIRECT
8 KSELFTEST_SKIP_TEST=4 8 KSELFTEST_SKIP_TEST=4
9 9
10 # Verify we have LKDTM available in the kernel 10 # Verify we have LKDTM available in the kernel.
11 if [ ! -r $TRIGGER ] ; then 11 if [ ! -r $TRIGGER ] ; then
12 /sbin/modprobe -q lkdtm || true 12 /sbin/modprobe -q lkdtm || true
13 if [ ! -r $TRIGGER ] ; then 13 if [ ! -r $TRIGGER ] ; then
14 echo "Cannot find $TRIGGER (mi 14 echo "Cannot find $TRIGGER (missing CONFIG_LKDTM?)"
15 else 15 else
16 echo "Cannot write $TRIGGER (n 16 echo "Cannot write $TRIGGER (need to run as root?)"
17 fi 17 fi
18 # Skip this test 18 # Skip this test
19 exit $KSELFTEST_SKIP_TEST 19 exit $KSELFTEST_SKIP_TEST
20 fi 20 fi
21 21
22 # Capture dmesg continuously since it may fill 22 # Capture dmesg continuously since it may fill up depending on sample size.
23 log=$(mktemp -t stack-entropy-XXXXXX) 23 log=$(mktemp -t stack-entropy-XXXXXX)
24 dmesg --follow >"$log" & pid=$! 24 dmesg --follow >"$log" & pid=$!
25 report=-1 25 report=-1
26 for i in $(seq 1 $samples); do 26 for i in $(seq 1 $samples); do
27 echo "REPORT_STACK" > $TRIGGER 27 echo "REPORT_STACK" > $TRIGGER
28 if [ -t 1 ]; then 28 if [ -t 1 ]; then
29 percent=$(( 100 * $i / $sample 29 percent=$(( 100 * $i / $samples ))
30 if [ "$percent" -ne "$report" 30 if [ "$percent" -ne "$report" ]; then
31 /bin/echo -en "$percen 31 /bin/echo -en "$percent%\r"
32 report="$percent" 32 report="$percent"
33 fi 33 fi
34 fi 34 fi
35 done 35 done
36 kill "$pid" 36 kill "$pid"
37 37
38 # Count unique offsets since last run. 38 # Count unique offsets since last run.
39 seen=$(tac "$log" | grep -m1 -B"$samples"0 'St 39 seen=$(tac "$log" | grep -m1 -B"$samples"0 'Starting stack offset' | \
40 grep 'Stack offset' | awk '{print $NF} 40 grep 'Stack offset' | awk '{print $NF}' | sort | uniq -c | wc -l)
41 bits=$(echo "obase=2; $seen" | bc | wc -L) 41 bits=$(echo "obase=2; $seen" | bc | wc -L)
42 echo "Bits of stack entropy: $bits" 42 echo "Bits of stack entropy: $bits"
43 rm -f "$log" 43 rm -f "$log"
44 44
45 # We would expect any functional stack randomi 45 # We would expect any functional stack randomization to be at least 5 bits.
46 if [ "$bits" -lt 5 ]; then 46 if [ "$bits" -lt 5 ]; then
47 echo "Stack entropy is low! Booted wit 47 echo "Stack entropy is low! Booted without 'randomize_kstack_offset=y'?"
48 exit 1 48 exit 1
49 else 49 else
50 exit 0 50 exit 0
51 fi 51 fi
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.