# Calling the SysctlCheck class constructor:
# SysctlCheck(reason, decision, name, expected)
- # use an omnipresent config symbol to see if we have a config file
- have_config_file = KconfigCheck('-', '-', 'DEFAULT_INIT', 'is present')
+ # Use an omnipresent kconfig symbol to see if we have a kconfig file for checking
+ have_config_file = KconfigCheck('-', '-', 'LOCALVERSION', 'is present')
+
l += [OR(SysctlCheck('self_protection', 'kspp', 'net.core.bpf_jit_harden', '2'),
- AND(KconfigCheck('cut_attack_surface', 'kspp', 'BPF_JIT', 'is not set'),
+ AND(KconfigCheck('-', '-', 'BPF_JIT', 'is not set'),
have_config_file))]
l += [SysctlCheck('cut_attack_surface', 'kspp', 'kernel.dmesg_restrict', '1')]
AND(KconfigCheck('cut_attack_surface', 'lockdown', 'BPF_SYSCALL', 'is not set'),
have_config_file))]
l += [SysctlCheck('cut_attack_surface', 'kspp', 'kernel.kptr_restrict', '2')]
- l += [OR(SysctlCheck('cut_attack_surface', 'kspp', 'dev.tty.legacy_tiocsti', '0'),
- SysctlCheck('cut_attack_surface', 'kspp', 'dev.tty.legacy_tiocsti', 'is not set'))]
+ l += [SysctlCheck('cut_attack_surface', 'kspp', 'dev.tty.legacy_tiocsti', '0')]
l += [OR(SysctlCheck('cut_attack_surface', 'kspp', 'vm.unprivileged_userfaultfd', '0'),
AND(KconfigCheck('cut_attack_surface', 'grsec', 'USERFAULTFD', 'is not set'),
have_config_file))]