feat(kernel): add support for LZ4 decompression

fix(opensuse): add specific location for ibrs_enabled file

README.md

@@ -1,7 +1,7 @@
 Spectre & Meltdown Checker
 ==========================
 
-A simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs.
+A simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs that were made public early 2018.
 
 Without options, it'll inspect you currently running kernel. 
 You can also specify a kernel image on the command line, if you'd like to inspect a kernel you're not running.
@@ -10,7 +10,7 @@ The script will do its best to detect mitigations, including backported non-vani
 
 ## Example of script output
 
-![checker](https://framapic.org/FjroIZximyoM/EO5msoSMKb6L.png)
+![checker](https://framapic.org/6O4v4AAwMenv/M6J4CFWwsB3z.png)
 
 ## Quick summary of the CVEs
 
@@ -32,3 +32,14 @@ The script will do its best to detect mitigations, including backported non-vani
    - Impact: Kernel
    - Mitigation: updated kernel (with PTI/KPTI patches), updating the kernel is enough
    - Performance impact of the mitigation: low to medium
+
+## Disclaimer
+
+This tool does its best to determine whether your system is immune (or has proper mitigations in place) for the collectively named "speculative execution" vulnerabilities. It doesn't attempt to run any kind of exploit, and can't guarantee that your system is secure, but rather helps you verifying whether your system has the known correct mitigations in place.
+However, some mitigations could also exist in your kernel that this script doesn't know (yet) how to detect, or it might falsely detect mitigations that in the end don't work as expected (for example, on backported or modified kernels).
+
+Your system exposure also depends on your CPU. As of now, AMD and ARM processors are marked as immune to some or all of these vulnerabilities (except some specific ARM models). All Intel processors manufactured since circa 1995 are thought to be vulnerable. Whatever processor one uses, one might seek more information from the manufacturer of that processor and/or of the device in which it runs.
+
+The nature of the discovered vulnerabilities being quite new, the landscape of vulnerable processors can be expected to change over time, which is why this script makes the assumption that all CPUs are vulnerable, except if the manufacturer explicitely stated otherwise in a verifiable public announcement.
+
+This tool has been released in the hope that it'll be useful, but don't use it to jump to conclusions about your security.

spectre-meltdown-checker.sh

@@ -8,7 +8,7 @@
 #
 # Stephane Lesimple
 #
-VERSION=0.23
+VERSION=0.24
 
 # Script configuration
 show_usage()
@@ -139,6 +139,11 @@ _verbose()
 	_echo 2 "$@"
 }
 
+_debug()
+{
+	_echo 3 "(debug) $@"
+}
+
 is_cpu_vulnerable()
 {
 	# param: 1, 2 or 3 (variant)
@@ -359,7 +364,7 @@ vmlinux=''
 vmlinux_err=''
 check_vmlinux()
 {
-	readelf -h $1 > /dev/null 2>&1 || return 1
+	readelf -h "$1" > /dev/null 2>&1 || return 1
 	return 0
 }
 
@@ -369,15 +374,22 @@ try_decompress()
 	# "grep" that report the byte offset of the line instead of the pattern.
 
 	# Try to find the header ($1) and decompress from here
-	for     pos in `tr "$1\n$2" "\n$2=" < "$5" | grep -abo "^$2"`
+	for     pos in `tr "$1\n$2" "\n$2=" < "$6" | grep -abo "^$2"`
 	do
-		if ! which $3 >/dev/null 2>&1; then
-			vmlinux_err="missing '$3' tool, please install it, usually it's in the '$4' package"
+		_debug "try_decompress: magic for $3 found at offset $pos"
+		if ! which "$3" >/dev/null 2>&1; then
+			vmlinux_err="missing '$3' tool, please install it, usually it's in the '$5' package"
 			return 0
 		fi
 		pos=${pos%%:*}
-		tail -c+$pos "$5" | $3 > $vmlinuxtmp 2> /dev/null
-		check_vmlinux "$vmlinuxtmp" && vmlinux=$vmlinuxtmp && return 0
+		tail -c+$pos "$6" 2>/dev/null | $3 $4 > $vmlinuxtmp 2>/dev/null
+		if check_vmlinux "$vmlinuxtmp"; then
+			vmlinux="$vmlinuxtmp"
+			_debug "try_decompress: decompressed with $3 successfully!"
+			return 0
+		else
+			_debug "try_decompress: decompression with $3 did not work"
+		fi
 	done
 	return 1
 }
@@ -397,11 +409,12 @@ extract_vmlinux()
 	fi
 
 	# That didn't work, so retry after decompression.
-	try_decompress '\037\213\010' xy    gunzip     gunzip	"$1" && return 0
-	try_decompress '\3757zXZ\000' abcde unxz       xz-utils	"$1" && return 0
-	try_decompress 'BZh'          xy    bunzip2    bzip2	"$1" && return 0
-	try_decompress '\135\0\0\0'   xxx   unlzma     xz-utils	"$1" && return 0
-	try_decompress '\211\114\132' xy    'lzop -d'  lzop	"$1" && return 0
+	try_decompress '\037\213\010'     xy    gunzip  ''      gunzip      "$1" && return 0
+	try_decompress '\3757zXZ\000'     abcde unxz    ''      xz-utils    "$1" && return 0
+	try_decompress 'BZh'              xy    bunzip2 ''      bzip2       "$1" && return 0
+	try_decompress '\135\0\0\0'       xxx   unlzma  ''      xz-utils    "$1" && return 0
+	try_decompress '\211\114\132'     xy    'lzop'  '-d'    lzop        "$1" && return 0
+	try_decompress '\002\041\114\030' xyy   'lz4'   '-d -l' liblz4-tool "$1" && return 0
 	return 1
 }
 
@@ -428,12 +441,25 @@ if [ "$opt_live" = 1 ]; then
 	_info "Checking for vulnerabilities against live running kernel \033[35m"$(uname -s) $(uname -r) $(uname -v) $(uname -m)"\033[0m"
 
 	# try to find the image of the current running kernel
-	[ -e /boot/vmlinuz-linux       ] && opt_kernel=/boot/vmlinuz-linux
-	[ -e /boot/vmlinuz-linux-libre ] && opt_kernel=/boot/vmlinuz-linux-libre
-	[ -e /boot/vmlinuz-$(uname -r) ] && opt_kernel=/boot/vmlinuz-$(uname -r)
-	[ -e /boot/kernel-$( uname -r) ] && opt_kernel=/boot/kernel-$( uname -r)
-	[ -e /boot/bzImage-$(uname -r) ] && opt_kernel=/boot/bzImage-$(uname -r)
-	[ -e /boot/kernel-genkernel-$(uname -m)-$(uname -r) ] && opt_kernel=/boot/kernel-genkernel-$(uname -m)-$(uname -r)
+	# first, look for the BOOT_IMAGE hint in the kernel cmdline
+	if [ -r /proc/cmdline ] && grep -q 'BOOT_IMAGE=' /proc/cmdline; then
+		opt_kernel=$(grep -Eo 'BOOT_IMAGE=[^ ]+' /proc/cmdline | cut -d= -f2)
+		_debug "found opt_kernel=$opt_kernel in /proc/cmdline"
+		# if we have a dedicated /boot partition, our bootloader might have just called it /
+		# so try to prepend /boot and see if we find anything
+		[ -e "/boot/$opt_kernel" ] && opt_kernel="/boot/$opt_kernel"
+		_debug "opt_kernel is now $opt_kernel"
+		# else, the full path is already there (most probably /boot/something)
+	fi
+	# if we didn't find a kernel, default to guessing
+	if [ ! -e "$opt_kernel" ]; then
+		[ -e /boot/vmlinuz-linux       ] && opt_kernel=/boot/vmlinuz-linux
+		[ -e /boot/vmlinuz-linux-libre ] && opt_kernel=/boot/vmlinuz-linux-libre
+		[ -e /boot/vmlinuz-$(uname -r) ] && opt_kernel=/boot/vmlinuz-$(uname -r)
+		[ -e /boot/kernel-$( uname -r) ] && opt_kernel=/boot/kernel-$( uname -r)
+		[ -e /boot/bzImage-$(uname -r) ] && opt_kernel=/boot/bzImage-$(uname -r)
+		[ -e /boot/kernel-genkernel-$(uname -m)-$(uname -r) ] && opt_kernel=/boot/kernel-genkernel-$(uname -m)-$(uname -r)
+	fi
 
 	# system.map
 	if [ -e /proc/kallsyms ] ; then
@@ -583,17 +609,21 @@ check_variant2()
 	_info_nol "*   Kernel support for IBRS: "
 	if [ "$opt_live" = 1 ]; then
 		mount_debugfs
-		if [ -e /sys/kernel/debug/ibrs_enabled ]; then
-			# if the file is there, we have IBRS compiled-in
-			pstatus green YES
-			ibrs_supported=1
-			ibrs_enabled=$(cat /sys/kernel/debug/ibrs_enabled 2>/dev/null)
-		elif [ -e /sys/kernel/debug/x86/ibrs_enabled ]; then
-			# RedHat uses a different path (see https://access.redhat.com/articles/3311301)
-			pstatus green YES
-			ibrs_supported=1
-			ibrs_enabled=$(cat /sys/kernel/debug/x86/ibrs_enabled 2>/dev/null)
-		fi
+		for ibrs_file in \
+			/sys/kernel/debug/ibrs_enabled \
+			/sys/kernel/debug/x86/ibrs_enabled \
+			/proc/sys/kernel/ibrs_enabled; do
+			if [ -e "$ibrs_file" ]; then
+				# if the file is there, we have IBRS compiled-in
+				# /sys/kernel/debug/ibrs_enabled: vanilla
+				# /sys/kernel/debug/x86/ibrs_enabled: RedHat (see https://access.redhat.com/articles/3311301)
+				# /proc/sys/kernel/ibrs_enabled: OpenSUSE tumbleweed
+				pstatus green YES
+				ibrs_supported=1
+				ibrs_enabled=$(cat "$ibrs_file" 2>/dev/null)
+				break
+			fi
+		done
 	fi
 	if [ "$ibrs_supported" != 1 -a -n "$opt_map" ]; then
 		if grep -q spec_ctrl "$opt_map"; then