From: Shawn C <citypw@hardenedlinux.org>
Date: Tue, 6 Aug 2024 16:05:45 +0000 (+0000)
Subject: Add ARM SMMU check options
X-Git-Tag: v0.6.10~20^2
X-Git-Url: https://jxself.org/git/?a=commitdiff_plain;h=1c655f8d4b554786df6c8e67ed08f6ab8ddbdb96;p=kconfig-hardened-check.git

Add ARM SMMU check options

Threat model:
https://github.com/hardenedlinux/grsecurity-101-tutorials/blob/master/embedded_platform_security.md
---

diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py
index 6b89bd7..2f9d6ff 100755
--- a/kernel_hardening_checker/checks.py
+++ b/kernel_hardening_checker/checks.py
@@ -121,6 +121,9 @@ def add_kconfig_checks(l: List[ChecklistObjType], arch: str) -> None:
         l += [KconfigCheck('self_protection', 'defconfig', 'RODATA_FULL_DEFAULT_ENABLED', 'y')]
         l += [KconfigCheck('self_protection', 'defconfig', 'ARM64_PTR_AUTH_KERNEL', 'y')]
         l += [KconfigCheck('self_protection', 'defconfig', 'ARM64_BTI_KERNEL', 'y')]
+        l += [KconfigCheck('self_protection', 'defconfig', 'ARM_SMMU', 'y')]
+        l += [KconfigCheck('self_protection', 'defconfig', 'ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT', 'y')]
+        l += [KconfigCheck('self_protection', 'defconfig', 'ARM_SMMU_V3', 'y')]
         l += [KconfigCheck('self_protection', 'defconfig', 'MITIGATE_SPECTRE_BRANCH_HISTORY', 'y')]
         l += [KconfigCheck('self_protection', 'defconfig', 'ARM64_MTE', 'y')]
         l += [KconfigCheck('self_protection', 'defconfig', 'RANDOMIZE_MODULE_REGION_FULL', 'y')]