Create rhel-8.0.config

[kconfig-hardened-check.git] / kconfig-hardened-check.py

diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py
index b149567fb1317d64eaada195e01e49bfe264c49d..692d1922a3d8c6b635daa540ab7102134f2cbe94 100755 (executable)
--- a/kconfig-hardened-check.py
+++ b/kconfig-hardened-check.py
@@ -26,6 +26,7 @@
 #
 # N.B. Hardening sysctl's:
 #    net.core.bpf_jit_harden
+#    kptr_restrict=2
 
 import sys
 from argparse import ArgumentParser
@@ -322,6 +323,8 @@ def construct_checklist(arch):
     if debug_mode or arch == 'X86_32':
         checklist.append(OptCheck('MODIFY_LDT_SYSCALL', 'is not set', 'my', 'cut_attack_surface'))
 
+    if debug_mode or arch == 'ARM64':
+        checklist.append(OptCheck('ARM64_PTR_AUTH',       'y', 'defconfig', 'userspace_protection'))
     if debug_mode or arch == 'X86_64' or arch == 'ARM64':
         checklist.append(OptCheck('ARCH_MMAP_RND_BITS',   '32', 'my', 'userspace_protection'))
     if debug_mode or arch == 'X86_32' or arch == 'ARM':