From: Alexander Popov <alex.popov@linux.com>
Date: Sun, 9 Oct 2022 17:49:58 +0000 (+0300)
Subject: Check COREDUMP (recommended by Clip OS)
X-Git-Tag: v0.6.1~77
X-Git-Url: https://jxself.org/git/?a=commitdiff_plain;h=7f9ca336e7f48c966e18fece3804f8a3de5ce9b5;p=kconfig-hardened-check.git

Check COREDUMP (recommended by Clip OS)

Disabling COREDUMP is needed for cutting userspace attack surface.
---

diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py
index 9ae2474..3412a1a 100644
--- a/kconfig_hardened_check/__init__.py
+++ b/kconfig_hardened_check/__init__.py
@@ -641,6 +641,7 @@ def add_kconfig_checks(l, arch):
     l += [KconfigCheck('cut_attack_surface', 'clipos', 'X86_IOPL_IOPERM', 'is not set')] # refers to LOCKDOWN
     l += [KconfigCheck('cut_attack_surface', 'clipos', 'ACPI_TABLE_UPGRADE', 'is not set')] # refers to LOCKDOWN
     l += [KconfigCheck('cut_attack_surface', 'clipos', 'EFI_CUSTOM_SSDT_OVERLAYS', 'is not set')]
+    l += [KconfigCheck('cut_attack_surface', 'clipos', 'COREDUMP', 'is not set')] # cut userspace attack surface
     l += [AND(KconfigCheck('cut_attack_surface', 'clipos', 'LDISC_AUTOLOAD', 'is not set'),
               KconfigCheck('cut_attack_surface', 'clipos', 'LDISC_AUTOLOAD'))] # option presence check
     if arch in ('X86_64', 'X86_32'):