From: Alexander Popov <alex.popov@linux.com>
Date: Sun, 9 Apr 2023 21:43:09 +0000 (+0300)
Subject: Add the LEGACY_TIOCSTI check
X-Git-Tag: v0.6.6~177
X-Git-Url: https://jxself.org/git/?a=commitdiff_plain;ds=sidebyside;h=f0c9f888c46889f5313ee0ad683d56cd38f3b6b9;p=kconfig-hardened-check.git

Add the LEGACY_TIOCSTI check
---

diff --git a/kconfig_hardened_check/checks.py b/kconfig_hardened_check/checks.py
index d614736..af4c6e2 100644
--- a/kconfig_hardened_check/checks.py
+++ b/kconfig_hardened_check/checks.py
@@ -31,8 +31,9 @@ This module contains knowledge for checks.
 #    fs.protected_regular=2
 #    fs.suid_dumpable=0
 #    kernel.modules_disabled=1
-#    kernel.randomize_va_space = 2
+#    kernel.randomize_va_space=2
 #    nosmt sysfs control file
+#    dev.tty.legacy_tiocsti=0
 #
 # Think of these boot params:
 #    module.sig_enforce=1
@@ -378,6 +379,7 @@ def add_kconfig_checks(l, arch):
     l += [bpf_syscall_not_set] # refers to LOCKDOWN
 
     # 'cut_attack_surface', 'my'
+    l += [KconfigCheck('cut_attack_surface', 'my', 'LEGACY_TIOCSTI', 'is not set')]
     l += [KconfigCheck('cut_attack_surface', 'my', 'MMIOTRACE', 'is not set')] # refers to LOCKDOWN (permissive)
     l += [KconfigCheck('cut_attack_surface', 'my', 'LIVEPATCH', 'is not set')]
     l += [KconfigCheck('cut_attack_surface', 'my', 'IP_DCCP', 'is not set')]