Remove log_*_check

Signed-off-by: brentholtsclaw <brent.holtsclaw@intel.com>
This commit is contained in:
brentholtsclaw
2022-01-13 09:03:24 -08:00
committed by BrentHoltsclaw
parent 37029fa0df
commit 228ac310f5
27 changed files with 66 additions and 94 deletions
+1 -1
View File
@@ -542,7 +542,7 @@ class SPI(hal_base.HALBase):
bioswe = self.cs.get_control('BiosWriteEnable' )
if self.logger.HAL: self.display_BIOS_write_protection()
self.logger.log_hal_important( "BIOS write protection is {} (BiosWriteEnable = {:d})".format('disabled' if bioswe else 'still enabled', bioswe) )
self.logger.log_hal( "BIOS write protection is {} (BiosWriteEnable = {:d})".format('disabled' if bioswe else 'still enabled', bioswe) )
return (bioswe==1)
+1 -1
View File
@@ -206,7 +206,7 @@ class TPM(hal_base.HALBase):
try:
Locality = LOCALITY[locality]
except:
self.logger.log_hal_bad("Invalid locality value\n")
self.logger.log_hal("Invalid locality value\n")
return
requestedUse = False
+1 -1
View File
@@ -129,7 +129,7 @@ def startup( command_argv ):
try:
startupType = STARTUP[int(command_argv[0])]
except:
logger().log_hal_bad("Invalid startup type option value\n")
logger().log_hal("Invalid startup type option value\n")
return
Size = 0x0E000000
command = struct.pack( COMMAND_FORMAT, TPM_TAG_RQU_COMMAND, Size, TPM_ORD_STARTUP, startupType, 0, 0 )
+2 -2
View File
@@ -221,7 +221,7 @@ class EfiHelper(Helper):
return 0
def get_threads_count ( self ):
logger().log_debug_warning( "EFI helper hasn't implemented get_threads_count yet" )
logger().log_debug( "EFI helper hasn't implemented get_threads_count yet" )
#print "OsHelper for %s does not support get_threads_count from OS API"%self.os_system.lower()
return 0
@@ -230,7 +230,7 @@ class EfiHelper(Helper):
return (reax, rebx, recx, redx)
def get_descriptor_table( self, cpu_thread_id, desc_table_code ):
logger().log_debug_warning("EFI helper has not implemented get_descriptor_table yet")
logger().log_debug("EFI helper has not implemented get_descriptor_table yet")
return 0
#
+1 -1
View File
@@ -95,7 +95,7 @@ class OsHelper:
if not self.helper.start( start_driver, from_file ):
raise OsHelperError("failed to start OS helper", 1)
except Exception as msg:
logger().log_debug_bad(traceback.format_exc())
logger().log_debug(traceback.format_exc())
error_no = errno.ENXIO
if hasattr(msg, 'errorcode'):
error_no = msg.errorcode
-28
View File
@@ -253,34 +253,6 @@ class Logger:
"""Logs an Verbose message"""
self._log(text, pyLogging.getLevelName("debug"))
def log_passed_check(self, text):
"""Logs a Test as PASSED"""
self.log_passed(text)
def log_failed_check(self, text):
"""Logs a Test as FAILED"""
self.log_failed(text)
def log_error_check(self, text):
"""Logs a Test as ERROR"""
self.error(text)
def log_skipped_check(self, text):
"""Logs a Test as Not Implemented"""
self.log_skipped(text)
def log_warn_check(self, text):
"""Logs a Warning test, a warning test is considered equal to a PASSED test"""
self.log_warning(text)
def log_information_check(self, text):
"""Logs a Information test, an information test"""
self.log_information(text)
def log_not_applicable_check(self, text):
"""Logs a Test as Not Applicable"""
self.log_not_applicable(text)
def log_passed(self, text):
"""Logs a passed message."""
text = "[+] PASSED: " + text
+4 -4
View File
@@ -100,13 +100,13 @@ class BaseModule(object):
def display_res_check(self, pass_msg, error_msg):
if self.res == ModuleResult.PASSED:
self.logger.log_passed_check(pass_msg)
self.logger.log_passed(pass_msg)
elif self.res == ModuleResult.FAILED:
self.logger.log_failed_check(error_msg)
self.logger.log_failed(error_msg)
elif self.res == ModuleResult.WARNING:
self.logger.log_warn_check(error_msg)
self.logger.log_warn(error_msg)
elif self.res == ModuleResult.INFORMATION:
self.logger.log_information_check(error_msg)
self.logger.log_information(error_msg)
def run(self, module_argv):
raise NotImplementedError('sub class should overwrite the run() method')
+3 -3
View File
@@ -60,7 +60,7 @@ class bios_kbrd_buffer(BaseModule):
has_contents = False
if COMMON_FILL_PTRN == bios_kbrd_buf:
self.logger.log_passed_check( "Keyboard buffer is filled with common fill pattern" )
self.logger.log_passed( "Keyboard buffer is filled with common fill pattern" )
return ModuleResult.PASSED
for x in bios_kbrd_buf:
@@ -75,8 +75,8 @@ class bios_kbrd_buffer(BaseModule):
self.logger.log( "[*] Checking contents of the keyboard buffer..\n" )
if has_contents: self.logger.log_warn_check( "Keyboard buffer is not empty. The test cannot determine conclusively if it contains pre-boot passwords.\n The contents might have not been cleared by pre-boot firmware or overwritten with garbage.\n Visually inspect the contents of keyboard buffer for pre-boot passwords (BIOS, HDD, full-disk encryption)." )
else: self.logger.log_passed_check( "Keyboard buffer looks empty. Pre-boot passwords don't seem to be exposed" )
if has_contents: self.logger.log_warn( "Keyboard buffer is not empty. The test cannot determine conclusively if it contains pre-boot passwords.\n The contents might have not been cleared by pre-boot firmware or overwritten with garbage.\n Visually inspect the contents of keyboard buffer for pre-boot passwords (BIOS, HDD, full-disk encryption)." )
else: self.logger.log_passed( "Keyboard buffer looks empty. Pre-boot passwords don't seem to be exposed" )
return (ModuleResult.WARNING if has_contents else ModuleResult.PASSED)
+2 -2
View File
@@ -57,10 +57,10 @@ class bios_ts(BaseModule):
if 0 == bild:
res = ModuleResult.FAILED
self.logger.log_failed_check( "BIOS Interface is not locked (including Top Swap Mode)" )
self.logger.log_failed( "BIOS Interface is not locked (including Top Swap Mode)" )
else:
res = ModuleResult.PASSED
self.logger.log_passed_check( "BIOS Interface is locked (including Top Swap Mode)" )
self.logger.log_passed( "BIOS Interface is locked (including Top Swap Mode)" )
return res
# --------------------------------------------------------------------------
+4 -4
View File
@@ -144,13 +144,13 @@ class bios_wp(BaseModule):
self.logger.log('')
if wp:
if spr: self.logger.log_passed_check( "BIOS is write protected (by SMM and SPI Protected Ranges)" )
else: self.logger.log_passed_check( "BIOS is write protected" )
if spr: self.logger.log_passed( "BIOS is write protected (by SMM and SPI Protected Ranges)" )
else: self.logger.log_passed( "BIOS is write protected" )
else:
if spr: self.logger.log_passed_check( "SPI Protected Ranges are configured to write protect BIOS" )
if spr: self.logger.log_passed( "SPI Protected Ranges are configured to write protect BIOS" )
else:
self.logger.log_important( 'BIOS should enable all available SMM based write protection mechanisms or configure SPI protected ranges to protect the entire BIOS region' )
self.logger.log_failed_check( "BIOS is NOT protected completely" )
self.logger.log_failed( "BIOS is NOT protected completely" )
if wp or spr: return ModuleResult.PASSED
else: return ModuleResult.FAILED
+1 -1
View File
@@ -78,5 +78,5 @@ class cpu_info(BaseModule):
self.logger.log('[*] Microcode: {:08X}'.format(microcode_rev))
self.logger.log('[*]')
self.logger.log_information_check('Processor information displayed')
self.logger.log_information('Processor information displayed')
return self.res
+2 -2
View File
@@ -67,7 +67,7 @@ class ia_untrusted(BaseModule):
self.res = self.check_untrusted()
self.logger.log("")
if self.res == ModuleResult.PASSED:
self.logger.log_passed_check("IA_UNTRUSTED set on all threads")
self.logger.log_passed("IA_UNTRUSTED set on all threads")
elif self.res == ModuleResult.FAILED:
self.logger.log_failed_check("IA_UNTRUSTED not set on all threads")
self.logger.log_failed("IA_UNTRUSTED not set on all threads")
return self.res
+8 -8
View File
@@ -257,32 +257,32 @@ class spectre_v2(BaseModule):
#
if not ibrs_ibpb_supported:
res = ModuleResult.FAILED
self.logger.log_failed_check( "CPU mitigation (IBRS) is missing" )
self.logger.log_failed( "CPU mitigation (IBRS) is missing" )
elif not ibrs_enh_supported:
res = ModuleResult.WARNING
self.logger.log_warn_check( "CPU supports mitigation (IBRS) but doesn't support enhanced IBRS" )
self.logger.log_warn( "CPU supports mitigation (IBRS) but doesn't support enhanced IBRS" )
elif ibrs_enh_supported and (not ibrs_enabled):
res = ModuleResult.WARNING
self.logger.log_warn_check( "CPU supports mitigation (enhanced IBRS) but OS is not using it" )
self.logger.log_warn( "CPU supports mitigation (enhanced IBRS) but OS is not using it" )
else:
if (not stibp_supported):
res = ModuleResult.WARNING
self.logger.log_warn_check( "CPU supports mitigation (enhanced IBRS) but STIBP is not supported" )
self.logger.log_warn( "CPU supports mitigation (enhanced IBRS) but STIBP is not supported" )
else:
res = ModuleResult.PASSED
self.logger.log_passed_check( "CPU and OS support hardware mitigations" )
self.logger.log_passed( "CPU and OS support hardware mitigations" )
self.logger.log_important( "OS may be using software based mitigation (eg. retpoline)" )
try:
if self.cs.helper.retpoline_enabled():
res = ModuleResult.PASSED
self.logger.log_passed_check( "Retpoline is enabled by the OS" )
self.logger.log_passed( "Retpoline is enabled by the OS" )
else:
self.logger.log_bad( "Retpoline is NOT enabled by the OS" )
except UnimplementedAPIError as e:
self.logger.log_warn_check(str(e))
self.logger.log_warn(str(e))
except NotImplementedError:
self.logger.log_warn_check("Retpoline check not implemented in current environment")
self.logger.log_warn("Retpoline check not implemented in current environment")
return res
+4 -4
View File
@@ -58,7 +58,7 @@ class debugenabled(BaseModule):
supported = (ecx & BIT11) != 0
if not supported:
self.res = ModuleResult.NOTAPPLICABLE
self.logger.log_skipped_check('CPU Debug features are not supported on this platform')
self.logger.log_skipped('CPU Debug features are not supported on this platform')
return supported
def check_dci( self ):
@@ -115,12 +115,12 @@ class debugenabled(BaseModule):
self.logger.log("\n[*] Module Result")
if (dci_test_fail == ModuleResult.FAILED or cpu_debug_test_fail == ModuleResult.FAILED):
self.logger.log_failed_check('One or more of the debug checks have failed and a debug feature is enabled')
self.logger.log_failed('One or more of the debug checks have failed and a debug feature is enabled')
self.res = ModuleResult.FAILED
elif (dci_test_fail == ModuleResult.WARNING or cpu_debug_test_fail == ModuleResult.WARNING):
self.logger.log_warn_check('An unexpected debug state was discovered on this platform')
self.logger.log_warn('An unexpected debug state was discovered on this platform')
self.res = ModuleResult.WARNING
else:
self.logger.log_passed_check('All checks have successfully passed')
self.logger.log_passed('All checks have successfully passed')
return self.res
+2 -2
View File
@@ -55,9 +55,9 @@ class ia32cfg(BaseModule):
res = ModuleResult.FAILED
if res == ModuleResult.PASSED:
self.logger.log_passed_check( "IA32_FEATURE_CONTROL MSR is locked on all logical CPUs" )
self.logger.log_passed( "IA32_FEATURE_CONTROL MSR is locked on all logical CPUs" )
else:
self.logger.log_failed_check( "IA32_FEATURE_CONTROL MSR is not locked on all logical CPUs" )
self.logger.log_failed( "IA32_FEATURE_CONTROL MSR is not locked on all logical CPUs" )
return res
+3 -3
View File
@@ -74,7 +74,7 @@ class rtclock(BaseModule):
self.logger.log_warning('Restoring original value')
self.cmos.write_cmos_high(self.test_offset, original_val)
else:
self.logger.log_warn_check("Unable to test lock bits without attempting to modify CMOS.")
self.logger.log_warn("Unable to test lock bits without attempting to modify CMOS.")
self.logger.log("[*] Run chipsec_main manually with the following commandline flags.")
self.logger.log("[*] python chipsec_main -m common.rtclock -a modify")
return ModuleResult.WARNING
@@ -86,10 +86,10 @@ class rtclock(BaseModule):
if ll == 1 and ul == 1:
res = ModuleResult.PASSED
self.logger.log_passed_check( "Protected locations in RTC memory are locked" )
self.logger.log_passed( "Protected locations in RTC memory are locked" )
else:
res = ModuleResult.WARNING
self.logger.log_warn_check( "Protected locations in RTC memory are accessible (BIOS may not be using them)" )
self.logger.log_warn( "Protected locations in RTC memory are accessible (BIOS may not be using them)" )
return res
@@ -53,7 +53,7 @@ class variables(BaseModule):
def is_supported( self ):
supported = self.cs.helper.EFI_supported()
if not supported: self.logger.log_skipped_check( "OS does not support UEFI Runtime API" )
if not supported: self.logger.log_skipped( "OS does not support UEFI Runtime API" )
return supported
@@ -100,14 +100,14 @@ class variables(BaseModule):
sbvars = self._uefi.list_EFI_variables()
if sbvars is None:
self.logger.log_warn_check( 'Could not enumerate UEFI variables.' )
self.logger.log_warn( 'Could not enumerate UEFI variables.' )
return ModuleResult.SKIPPED
for name in SECURE_BOOT_VARIABLES:
if name in sbvars.keys() and sbvars[name] is not None:
if len(sbvars[name]) > 1:
self.logger.log_failed_check( 'There should only be one instance of variable {}'.format(name) )
self.logger.log_failed( 'There should only be one instance of variable {}'.format(name) )
return ModuleResult.FAILED
for (off, buf, hdr, data, guid, attrs) in sbvars[name]:
self.logger.log( "[*] Checking protections of UEFI variable {}:{}".format(guid, name) )
@@ -144,7 +144,7 @@ class variables(BaseModule):
if len(SECURE_BOOT_VARIABLES) == not_found:
# None of Secure Boot variables were not found
self.logger.log_skipped_check( 'None of required Secure Boot variables found. Secure Boot is not enabled' )
self.logger.log_skipped( 'None of required Secure Boot variables found. Secure Boot is not enabled' )
return ModuleResult.SKIPPED
else:
# Some Secure Boot variables exist
@@ -155,14 +155,14 @@ class variables(BaseModule):
if not_wp > 0: self.logger.log_bad( 'Some Secure Boot variables can be modified' )
if is_secureboot_enabled:
self.logger.log_failed_check( 'Not all Secure Boot UEFI variables are protected' )
self.logger.log_failed( 'Not all Secure Boot UEFI variables are protected' )
return ModuleResult.FAILED
else:
self.logger.log_warn_check( 'Not all Secure Boot UEFI variables are protected' )
self.logger.log_warn( 'Not all Secure Boot UEFI variables are protected' )
return ModuleResult.WARNING
else:
self.logger.log_passed_check( 'All Secure Boot UEFI variables are protected' )
self.logger.log_passed( 'All Secure Boot UEFI variables are protected' )
return ModuleResult.PASSED
+5 -5
View File
@@ -338,13 +338,13 @@ class sgx_check(BaseModule):
else:
self.res = self.check_sgx_config()
if self.res == ModuleResult.PASSED:
self.logger.log_passed_check('All SGX checks passed')
self.logger.log_passed('All SGX checks passed')
elif self.res == ModuleResult.WARNING:
self.logger.log_warn_check('One or more SGX checks detected a warning')
self.logger.log_warn('One or more SGX checks detected a warning')
elif self.res == ModuleResult.SKIPPED:
self.logger.log_skipped_check('SGX test is being skipped')
self.logger.log_skipped('SGX test is being skipped')
elif self.res == ModuleResult.NOTAPPLICABLE:
self.logger.log_not_applicable_check('SGX test is being skipped')
self.logger.log_not_applicable('SGX test is being skipped')
else:
self.logger.log_failed_check('One or more SGX checks failed')
self.logger.log_failed('One or more SGX checks failed')
return self.res
+3 -3
View File
@@ -64,11 +64,11 @@ class spi_lock(BaseModule):
reg_print = False
if res == ModuleResult.FAILED:
self.logger.log_failed_check("SPI Flash Controller not locked correctly.")
self.logger.log_failed("SPI Flash Controller not locked correctly.")
elif res == ModuleResult.PASSED:
self.logger.log_passed_check("SPI Flash Controller locked correctly.")
self.logger.log_passed("SPI Flash Controller locked correctly.")
else:
self.logger.log_warn_check("Unable to determine if SPI Flash Controller is locked correctly.")
self.logger.log_warn("Unable to determine if SPI Flash Controller is locked correctly.")
return res
+1 -1
View File
@@ -487,7 +487,7 @@ class te(BaseModule):
def is_supported(self):
#win8 = self.cs.helper.is_win8_or_greater()
efi_mode = self.cs.helper.EFI_supported()
if not efi_mode: self.logger.log_skipped_check( "OS did not boot in UEFI mode" )
if not efi_mode: self.logger.log_skipped( "OS did not boot in UEFI mode" )
return efi_mode
def run( self, module_argv ):
+3 -3
View File
@@ -76,7 +76,7 @@ Please run 'pip install virustotal-api' and try again.""")
if vt_report["results"]["response_code"] == 0:
# Hash is unknown to VT.
self.logger.log_warn_check("Unfamiliar EFI binary found in the UEFI firmware image\n{}".format(efi_module))
self.logger.log_warn("Unfamiliar EFI binary found in the UEFI firmware image\n{}".format(efi_module))
return False
if vt_report["results"]["positives"] >= self.vt_threshold:
@@ -98,9 +98,9 @@ Please run 'pip install virustotal-api' and try again.""")
self.logger.log( '' )
if found:
res = ModuleResult.WARNING
self.logger.log_warn_check("Suspicious EFI binary found in the UEFI firmware image")
self.logger.log_warn("Suspicious EFI binary found in the UEFI firmware image")
else:
self.logger.log_passed_check("Didn't find any suspicious EFI binary")
self.logger.log_passed("Didn't find any suspicious EFI binary")
return res
def usage(self):
@@ -411,7 +411,7 @@ class s3script_modify(BaseModule):
return ModuleResult.ERROR
if sts:
self.logger.log_passed_check( 'The script has been modified. Go to sleep..' )
self.logger.log_passed( 'The script has been modified. Go to sleep..' )
return ModuleResult.PASSED
else:
return ModuleResult.FAILED
+2 -2
View File
@@ -122,9 +122,9 @@ class scan_blocked(BaseModule):
self.logger.log( '' )
if found:
res = ModuleResult.WARNING
self.logger.log_warn_check("Blocked EFI binary found in the UEFI firmware image")
self.logger.log_warn("Blocked EFI binary found in the UEFI firmware image")
else:
self.logger.log_passed_check("Didn't find any blocked EFI binary")
self.logger.log_passed("Didn't find any blocked EFI binary")
return res
def usage(self):
+2 -2
View File
@@ -168,10 +168,10 @@ class scan_image(BaseModule):
self.logger.log_important( "found EFI executable not in the list:\n {} (sha256)\n {} (sha1)\n {{{}}}\n {}".format(m, sha1, guid, name))
if len(self.suspect_modules) > 0:
self.logger.log_warn_check( "found {:d} EFI executables not in the list '{}'".format(len(self.suspect_modules), json_pth) )
self.logger.log_warn( "found {:d} EFI executables not in the list '{}'".format(len(self.suspect_modules), json_pth) )
return ModuleResult.WARNING
else:
self.logger.log_passed_check( "all EFI executables match the list '{}'".format(json_pth) )
self.logger.log_passed( "all EFI executables match the list '{}'".format(json_pth) )
return ModuleResult.PASSED
@@ -47,5 +47,5 @@ class vbox_crash_apicbase (BaseModule):
self.cs.write_register( 'IA32_APIC_BASE', apicbase_msr, tid )
# If we are here, then we are fine ;)
self.logger.log_passed_check( "VMM/Host OS didn't crash (not vulnerable)" )
self.logger.log_passed( "VMM/Host OS didn't crash (not vulnerable)" )
return ModuleResult.PASSED
+1 -1
View File
@@ -28,7 +28,7 @@ class ModuleClass(BaseModule):
return True
def action(self):
self.logger.log_passed_check("Module was successful")
self.logger.log_passed("Module was successful")
return ModuleResult.PASSED
def run(self, module_argv):
+1 -1
View File
@@ -163,7 +163,7 @@ class ChipsecMain:
return module_common.ModuleResult.SKIPPED
except BaseException as msg:
logger().log_debug(traceback.format_exc())
logger().log_error_check("Exception occurred during {}.run(): '{}'".format(modx.get_name(), str(msg)))
logger().log_error( "Exception occurred during {}.run(): '{}'".format(modx.get_name(), str(msg)) )
raise msg
return result