From: Alexander Popov <alex.popov@linux.com>
Date: Sat, 2 Dec 2023 10:49:42 +0000 (+0300)
Subject: Add a check for the 'kfence.sample_interval' boot parameter
X-Git-Tag: v0.6.6~44
X-Git-Url: https://jxself.org/git/?a=commitdiff_plain;h=4e3f9782fec90b034e69709e3d8dcda872891d8a;p=kconfig-hardened-check.git

Add a check for the 'kfence.sample_interval' boot parameter

Thanks to @izh1979 for the idea
---

diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py
index 9865929..d02eb4b 100644
--- a/kernel_hardening_checker/checks.py
+++ b/kernel_hardening_checker/checks.py
@@ -502,6 +502,11 @@ def add_cmdline_checks(l, arch):
     if arch in ('X86_64', 'X86_32'):
         l += [CmdlineCheck('self_protection', 'clipos', 'iommu', 'force')]
 
+    # 'self_protection', 'my'
+    l += [OR(CmdlineCheck('self_protection', 'my', 'kfence.sample_interval', 'is not off'),
+             AND(KconfigCheck('self_protection', 'my', 'KFENCE_SAMPLE_INTERVAL', 'is not off'),
+                 CmdlineCheck('self_protection', 'my', 'kfence.sample_interval', 'is not set')))]
+
     # 'cut_attack_surface', 'defconfig'
     if arch in ('X86_64', 'X86_32'):
         l += [OR(CmdlineCheck('cut_attack_surface', 'defconfig', 'tsx', 'off'),