- l += [SysctlCheck('self_protection', 'kspp', 'net.core.bpf_jit_harden', '2')]
+ # use an omnipresent config symbol to see if we have a config file
+ have_config_file = KconfigCheck('-', '-', 'DEFAULT_INIT', 'is present')
+ l += [OR(SysctlCheck('self_protection', 'kspp', 'net.core.bpf_jit_harden', '2'),
+ AND(KconfigCheck('cut_attack_surface', 'kspp', 'BPF_JIT', 'is not set'),
+ have_config_file))]