#!/bin/sh

set -e

echo "starting kernel config sanity test with /proc/config.gz"

# decompress /proc/config.gz from the host
setvar UNZIPPED_CONFIG = $(zcat /proc/config.gz)

setvar kernelVersion = "$(uname -r)"
setvar kernelMajor = "${kernelVersion%%.*}"
setvar kernelMinor = "${kernelVersion#$kernelMajor.}"
setvar kernelMinor = "${kernelMinor%%.*}"

# Most tests against https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
# Positive cases

echo $UNZIPPED_CONFIG | grep -q CONFIG_BUG=y || shell {echo "CONFIG_BUG=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_DEBUG_KERNEL=y || shell {echo "CONFIG_DEBUG_KERNEL=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_DEBUG_RODATA=y || shell {echo "CONFIG_DEBUG_RODATA=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_CC_STACKPROTECTOR=y || shell {echo "CONFIG_CC_STACKPROTECTOR=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_CC_STACKPROTECTOR_STRONG=y || shell {echo "CONFIG_CC_STACKPROTECTOR_STRONG=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_STRICT_DEVMEM=y || shell {echo "CONFIG_STRICT_DEVMEM=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_SYN_COOKIES=y || shell {echo "CONFIG_SYN_COOKIES=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_DEBUG_CREDENTIALS=y || shell {echo "CONFIG_DEBUG_CREDENTIALS=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_DEBUG_NOTIFIERS=y || shell {echo "CONFIG_DEBUG_NOTIFIERS=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_DEBUG_LIST=y || shell {echo "CONFIG_DEBUG_LIST=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_SECCOMP=y || shell {echo "CONFIG_SECCOMP=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_SECCOMP_FILTER=y || shell {echo "CONFIG_SECCOMP_FILTER=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_SECURITY=y || shell {echo "CONFIG_SECURITY=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_SECURITY_YAMA=y || shell {echo "CONFIG_SECURITY_YAMA=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_PANIC_ON_OOPS=y || shell {echo "CONFIG_PANIC_ON_OOPS=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_DEBUG_SET_MODULE_RONX=y || shell {echo "CONFIG_DEBUG_SET_MODULE_RONX=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_SYN_COOKIES=y || shell {echo "CONFIG_SYN_COOKIES=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_LEGACY_VSYSCALL_NONE=y || shell {echo "CONFIG_LEGACY_VSYSCALL_NONE=y" && exit 1}
echo $UNZIPPED_CONFIG | grep -q CONFIG_RANDOMIZE_BASE=y || shell {echo "CONFIG_RANDOMIZE_BASE=y" && exit 1}

# Conditional on kernel version
if test $kernelMajor -ge 4 -a $kernelMinor -ge 5 {
  echo $UNZIPPED_CONFIG | grep -q CONFIG_IO_STRICT_DEVMEM=y || shell {echo "CONFIG_IO_STRICT_DEVMEM=y" && exit 1}
  echo $UNZIPPED_CONFIG | grep -q CONFIG_UBSAN=y || shell {echo "CONFIG_UBSAN=y" && exit 1}
}
if test $kernelMajor -ge 4 -a $kernelMinor -ge 7 {
  echo $UNZIPPED_CONFIG | grep -q CONFIG_SLAB_FREELIST_RANDOM=y || shell {echo "CONFIG_SLAB_FREELIST_RANDOM=y" && exit 1}
}
if test $kernelMajor -ge 4 -a $kernelMinor -ge 8 {
  echo $UNZIPPED_CONFIG | grep -q CONFIG_HARDENED_USERCOPY=y || shell {echo "CONFIG_HARDENED_USERCOPY=y" && exit 1}
  echo $UNZIPPED_CONFIG | grep -q CONFIG_RANDOMIZE_MEMORY=y || shell {echo "CONFIG_RANDOMIZE_MEMORY=y" && exit 1}
}

# poisoning cannot be enabled in 4.4
if test $kernelMajor -ge 4 -a $kernelMinor -ge 9 {
  echo $UNZIPPED_CONFIG | grep -q CONFIG_PAGE_POISONING=y || shell {echo "CONFIG_PAGE_POISONING=y" && exit 1}
  echo $UNZIPPED_CONFIG | grep -q CONFIG_PAGE_POISONING_NO_SANITY=y || shell {echo "CONFIG_PAGE_POISONING_NO_SANITY=y" && exit 1}
  echo $UNZIPPED_CONFIG | grep -q CONFIG_PAGE_POISONING_ZERO=y || shell {echo "CONFIG_PAGE_POISONING_ZERO=y" && exit 1}
}

if test $kernelMajor -ge 4 -a $kernelMinor -ge 10 {
  echo $UNZIPPED_CONFIG | grep -q CONFIG_BUG_ON_DATA_CORRUPTION=y || shell {echo "CONFIG_BUG_ON_DATA_CORRUPTION=y" && exit 1}
}

# Negative cases
echo $UNZIPPED_CONFIG | grep -q 'CONFIG_ACPI_CUSTOM_METHOD is not set' || shell {echo "CONFIG_ACPI_CUSTOM_METHOD is not set" && exit 1}
echo $UNZIPPED_CONFIG | grep -q 'CONFIG_COMPAT_BRK is not set' || shell {echo "CONFIG_COMPAT_BRK is not set" && exit 1}
echo $UNZIPPED_CONFIG | grep -q 'CONFIG_DEVKMEM is not set' || shell {echo "CONFIG_DEVKMEM is not set" && exit 1}
echo $UNZIPPED_CONFIG | grep -q 'CONFIG_COMPAT_VDSO is not set' || shell {echo "CONFIG_COMPAT_VDSO is not set" && exit 1}
echo $UNZIPPED_CONFIG | grep -q 'CONFIG_KEXEC is not set' || shell {echo "CONFIG_KEXEC is not set" && exit 1}
echo $UNZIPPED_CONFIG | grep -q 'CONFIG_HIBERNATION is not set' || shell {echo "CONFIG_HIBERNATION is not set" && exit 1}
echo $UNZIPPED_CONFIG | grep -q 'CONFIG_LEGACY_PTYS is not set' || shell {echo "CONFIG_LEGACY_PTYS is not set" && exit 1}
echo $UNZIPPED_CONFIG | grep -q 'CONFIG_X86_X32 is not set' || shell {echo "CONFIG_X86_X32 is not set" && exit 1}
echo $UNZIPPED_CONFIG | grep -q 'CONFIG_MODIFY_LDT_SYSCALL is not set' || shell {echo "CONFIG_MODIFY_LDT_SYSCALL is not set" && exit 1}

echo "kernel config test succeeded!"