From: Eneas U de Queiroz <cotequeiroz@gmail.com>
Date: Fri, 10 Nov 2023 18:21:19 +0000 (-0300)
Subject: Skip unprivileged_userfaultfd if USERFAULTFD unset
X-Git-Tag: v0.6.10~73^2~6
X-Git-Url: https://jxself.org/git/?a=commitdiff_plain;h=8c502dcc4e05c5e0babb32067ce17d2811e50c96;p=kconfig-hardened-check.git

Skip unprivileged_userfaultfd if USERFAULTFD unset

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
---

diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py
index 0e0f205..e2cf42e 100644
--- a/kernel_hardening_checker/checks.py
+++ b/kernel_hardening_checker/checks.py
@@ -682,7 +682,9 @@ def add_sysctl_checks(l, _arch):
     l += [SysctlCheck('cut_attack_surface', 'kspp', 'kernel.kptr_restrict', '2')]
     l += [OR(SysctlCheck('cut_attack_surface', 'kspp', 'dev.tty.legacy_tiocsti', '0'),
              SysctlCheck('cut_attack_surface', 'kspp', 'dev.tty.legacy_tiocsti', 'is not set'))]
-    l += [SysctlCheck('cut_attack_surface', 'kspp', 'vm.unprivileged_userfaultfd', '0')]
+    l += [OR(SysctlCheck('cut_attack_surface', 'kspp', 'vm.unprivileged_userfaultfd', '0'),
+             AND(KconfigCheck('cut_attack_surface', 'grsec', 'USERFAULTFD', 'is not set'),
+                 have_config_file))]
           # At first, it disabled unprivileged userfaultfd,
           # and since v5.11 it enables unprivileged userfaultfd for user-mode only.