Improve the check of DEBUG_NOTIFIERS feature (part 2)

CFI_PERMISSIVE should be disabled. Reacting with a kernel warning
is not enough.

Thanks to @thestinger for the idea.

Refers to #99.

diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py
index b90fadeaf54e0908139da90264003b3b0958eb35..3dc1b876a0f6b3ae33d5d97cde642ea5ab3b0072 100644 (file)
--- a/kernel_hardening_checker/checks.py
+++ b/kernel_hardening_checker/checks.py
@@ -131,8 +131,10 @@ def add_kconfig_checks(l, arch):
     l += [KconfigCheck('self_protection', 'kspp', 'STATIC_USERMODEHELPER', 'y')] # needs userspace support
     l += [KconfigCheck('self_protection', 'kspp', 'SCHED_CORE', 'y')]
     cfi_clang_is_set = KconfigCheck('self_protection', 'kspp', 'CFI_CLANG', 'y')
+    cfi_clang_permissive_not_set = KconfigCheck('self_protection', 'kspp', 'CFI_PERMISSIVE', 'is not set')
     l += [OR(KconfigCheck('self_protection', 'kspp', 'DEBUG_NOTIFIERS', 'y'),
-             cfi_clang_is_set)]
+             AND(cfi_clang_is_set,
+                 cfi_clang_permissive_not_set))]
     l += [OR(KconfigCheck('self_protection', 'kspp', 'SCHED_STACK_END_CHECK', 'y'),
              vmap_stack_is_set)]
     kfence_is_set = KconfigCheck('self_protection', 'kspp', 'KFENCE', 'y')
@@ -199,7 +201,7 @@ def add_kconfig_checks(l, arch):
         l += [KconfigCheck('self_protection', 'kspp', 'RANDOMIZE_KSTACK_OFFSET_DEFAULT', 'y')]
     if arch in ('X86_64', 'ARM64'):
         l += [cfi_clang_is_set]
-        l += [AND(KconfigCheck('self_protection', 'kspp', 'CFI_PERMISSIVE', 'is not set'),
+        l += [AND(cfi_clang_permissive_not_set,
                   cfi_clang_is_set)]
     if arch in ('X86_64', 'X86_32'):
         l += [KconfigCheck('self_protection', 'kspp', 'HW_RANDOM_TPM', 'y')]