From: Willenst <willenst@gmail.com>
Date: Mon, 26 Aug 2024 08:40:01 +0000 (+0200)
Subject: Add io_uring_disabled sysctl check
X-Git-Tag: v0.6.10~16^2
X-Git-Url: https://jxself.org/git/?a=commitdiff_plain;h=66ec052adea90855c91eb8ec502e3c61ce660e01;p=kconfig-hardened-check.git

Add io_uring_disabled sysctl check
---

diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py
index 6fcb07d..0cc9e58 100755
--- a/kernel_hardening_checker/checks.py
+++ b/kernel_hardening_checker/checks.py
@@ -748,6 +748,10 @@ def add_sysctl_checks(l: List[ChecklistObjType], _arch: StrOrNone) -> None:
              AND(KconfigCheck('cut_attack_surface', 'kspp', 'MODULES', 'is not set'),
                  have_kconfig))] # radical, but may be useful in some cases
 
+    l += [OR(SysctlCheck('cut_attack_surface', 'grsec', 'kernel.io_uring_disabled', '2'),
+             AND(KconfigCheck('cut_attack_surface', 'grsec', 'IO_URING', 'is not set'),
+                 have_kconfig))] # compatible with the 'IO_URING' kconfig check by grsecurity
+
     l += [OR(SysctlCheck('cut_attack_surface', 'a13xp0p0v', 'kernel.sysrq', '0'),
              AND(KconfigCheck('cut_attack_surface', 'clipos', 'MAGIC_SYSRQ', 'is not set'),
                  have_kconfig))]