From: Alexander Popov <alex.popov@linux.com>
Date: Mon, 4 Mar 2019 13:38:14 +0000 (+0300)
Subject: Fix false positive about CONFIG_MODULE_SIG_FORCE.
X-Git-Tag: v0.5.2~47
X-Git-Url: https://jxself.org/git/?a=commitdiff_plain;h=26ae3b02797f9494076e9cbb6f4a70abed5fb573;p=kconfig-hardened-check.git

Fix false positive about CONFIG_MODULE_SIG_FORCE.

CONFIG_MODULE_SIG_FORCE shouldn't be checked if CONFIG_MODULES is not set.

Fixes issue #12.
Thanks to @hannob.
---

diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py
index 3ed0f9e..a139697 100755
--- a/kconfig-hardened-check.py
+++ b/kconfig-hardened-check.py
@@ -187,7 +187,8 @@ def construct_checklist(arch):
                         modules_not_set))
     checklist.append(OR(OptCheck('MODULE_SIG_SHA512',             'y', 'kspp', 'self_protection'), \
                         modules_not_set))
-    checklist.append(OptCheck('MODULE_SIG_FORCE',                 'y', 'kspp', 'self_protection')) # refers to LOCK_DOWN_KERNEL
+    checklist.append(OR(OptCheck('MODULE_SIG_FORCE',              'y', 'kspp', 'self_protection'), \
+                        modules_not_set)) # refers to LOCK_DOWN_KERNEL
     if debug_mode or arch == 'X86_64' or arch == 'X86_32':
         checklist.append(OptCheck('DEFAULT_MMAP_MIN_ADDR',        '65536', 'kspp', 'self_protection'))
         checklist.append(OptCheck('REFCOUNT_FULL',                'y', 'kspp', 'self_protection'))