projects
/
kconfig-hardened-check.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
|
inline
| side by side (parent:
7a85a7f
)
Use CONFIG_LOCALVERSION instead of CONFIG_DEFAULT_INIT since it's older
author
Alexander Popov
<alex.popov@linux.com>
Thu, 2 May 2024 09:32:58 +0000
(12:32 +0300)
committer
Alexander Popov
<alex.popov@linux.com>
Thu, 2 May 2024 09:32:58 +0000
(12:32 +0300)
kernel_hardening_checker/checks.py
patch
|
blob
|
history
diff --git
a/kernel_hardening_checker/checks.py
b/kernel_hardening_checker/checks.py
index 4b5dee6c5dbcb50502ddb5be64b4405745a135c4..feb36ee12877393180b0ed24e28dabfc5552233c 100644
(file)
--- a/
kernel_hardening_checker/checks.py
+++ b/
kernel_hardening_checker/checks.py
@@
-663,8
+663,9
@@
def add_sysctl_checks(l, _arch):
# Calling the SysctlCheck class constructor:
# SysctlCheck(reason, decision, name, expected)
# Calling the SysctlCheck class constructor:
# SysctlCheck(reason, decision, name, expected)
- # use an omnipresent config symbol to see if we have a config file
- have_config_file = KconfigCheck('-', '-', 'DEFAULT_INIT', 'is present')
+ # Use an omnipresent kconfig symbol to see if we have a kconfig file for checking
+ have_config_file = KconfigCheck('-', '-', 'LOCALVERSION', 'is present')
+
l += [OR(SysctlCheck('self_protection', 'kspp', 'net.core.bpf_jit_harden', '2'),
AND(KconfigCheck('cut_attack_surface', 'kspp', 'BPF_JIT', 'is not set'),
have_config_file))]
l += [OR(SysctlCheck('self_protection', 'kspp', 'net.core.bpf_jit_harden', '2'),
AND(KconfigCheck('cut_attack_surface', 'kspp', 'BPF_JIT', 'is not set'),
have_config_file))]