l += [OR(KconfigCheck('self_protection', 'kspp', 'MODULE_SIG_ALL', 'y'),
modules_not_set)]
l += [OR(KconfigCheck('self_protection', 'kspp', 'MODULE_SIG_SHA512', 'y'),
+ KconfigCheck('self_protection', 'my', 'MODULE_SIG_SHA3_512', 'y'),
modules_not_set)]
l += [OR(KconfigCheck('self_protection', 'kspp', 'MODULE_SIG_FORCE', 'y'),
modules_not_set)] # refers to LOCKDOWN
# 'cut_attack_surface', 'my'
l += [CmdlineCheck('cut_attack_surface', 'my', 'sysrq_always_enabled', 'is not set')]
+ if arch == 'X86_64':
+ l += [OR(CmdlineCheck('cut_attack_surface', 'my', 'ia32_emulation', '0'),
+ KconfigCheck('cut_attack_surface', 'kspp', 'IA32_EMULATION', 'is not set'),
+ AND(KconfigCheck('cut_attack_surface', 'my', 'IA32_EMULATION_DEFAULT_DISABLED', 'y'),
+ CmdlineCheck('cut_attack_surface', 'my', 'ia32_emulation', 'is not set')))]
# 'harden_userspace'
l += [CmdlineCheck('harden_userspace', 'defconfig', 'norandmaps', 'is not set')]