Add the KSPP cmdline recommendations for x86_64

[kconfig-hardened-check.git] / kconfig_hardened_check / __init__.py

diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py
index df94812e0a4765c23aa1ecea0639c451f8ce5474..fae452415afbe96eb8feb2e53a2f8dcb0fcfe027 100644 (file)
--- a/kconfig_hardened_check/__init__.py
+++ b/kconfig_hardened_check/__init__.py
@@ -378,7 +378,7 @@ def add_kconfig_checks(l, arch):
              VersionCheck((5, 5)))] # REFCOUNT_FULL is enabled by default since v5.5
     if arch in ('X86_64', 'ARM64', 'X86_32'):
         l += [KconfigCheck('self_protection', 'defconfig', 'RANDOMIZE_BASE', 'y')]
-    if arch in ('X86_64', 'ARM64'):
+    if arch in ('X86_64', 'ARM64', 'ARM'):
         l += [KconfigCheck('self_protection', 'defconfig', 'VMAP_STACK', 'y')]
     if arch in ('X86_64', 'X86_32'):
         l += [KconfigCheck('self_protection', 'defconfig', 'DEBUG_WX', 'y')]
@@ -1105,12 +1105,16 @@ def main():
             parse_cmdline_file(parsed_cmdline_options, args.cmdline)
             populate_with_data(config_checklist, parsed_cmdline_options, 'cmdline')
 
-        # now everything is ready for performing the checks
+        # now everything is ready, perform the checks
         perform_checks(config_checklist)
 
-        # finally print the results
         if mode == 'verbose':
-            print_unknown_options(config_checklist, parsed_kconfig_options)
+            # print the parsed options without the checks (for debugging)
+            all_parsed_options = parsed_kconfig_options # assignment does not copy
+            all_parsed_options.update(parsed_cmdline_options)
+            print_unknown_options(config_checklist, all_parsed_options)
+
+        # finally print the results
         print_checklist(mode, config_checklist, True)
 
         sys.exit(0)