forked from Qortal/Brooklyn
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
37 lines
1.0 KiB
37 lines
1.0 KiB
#!/bin/sh |
|
# SPDX-License-Identifier: GPL-2.0 |
|
# |
|
# Measure kernel stack entropy by sampling via LKDTM's REPORT_STACK test. |
|
set -e |
|
samples="${1:-1000}" |
|
|
|
# Capture dmesg continuously since it may fill up depending on sample size. |
|
log=$(mktemp -t stack-entropy-XXXXXX) |
|
dmesg --follow >"$log" & pid=$! |
|
report=-1 |
|
for i in $(seq 1 $samples); do |
|
echo "REPORT_STACK" >/sys/kernel/debug/provoke-crash/DIRECT |
|
if [ -t 1 ]; then |
|
percent=$(( 100 * $i / $samples )) |
|
if [ "$percent" -ne "$report" ]; then |
|
/bin/echo -en "$percent%\r" |
|
report="$percent" |
|
fi |
|
fi |
|
done |
|
kill "$pid" |
|
|
|
# Count unique offsets since last run. |
|
seen=$(tac "$log" | grep -m1 -B"$samples"0 'Starting stack offset' | \ |
|
grep 'Stack offset' | awk '{print $NF}' | sort | uniq -c | wc -l) |
|
bits=$(echo "obase=2; $seen" | bc | wc -L) |
|
echo "Bits of stack entropy: $bits" |
|
rm -f "$log" |
|
|
|
# We would expect any functional stack randomization to be at least 5 bits. |
|
if [ "$bits" -lt 5 ]; then |
|
echo "Stack entropy is low! Booted without 'randomize_kstack_offset=y'?" |
|
exit 1 |
|
else |
|
exit 0 |
|
fi
|
|
|