From: Alexander Popov <alex.popov@linux.com>
Date: Mon, 4 Mar 2024 20:00:49 +0000 (+0300)
Subject: Add the ia32_emulation check
X-Git-Tag: v0.6.10~107
X-Git-Url: https://jxself.org/git/?a=commitdiff_plain;h=98ccb216ebc61a231207830f0b6b37c8133d0d48;p=kconfig-hardened-check.git

Add the ia32_emulation check

Refers to #87 #112
---

diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py
index 635f0c1..b5ed925 100644
--- a/kernel_hardening_checker/checks.py
+++ b/kernel_hardening_checker/checks.py
@@ -570,6 +570,11 @@ def add_cmdline_checks(l, arch):
 
     # 'cut_attack_surface', 'my'
     l += [CmdlineCheck('cut_attack_surface', 'my', 'sysrq_always_enabled', 'is not set')]
+    if arch == 'X86_64':
+        l += [OR(CmdlineCheck('cut_attack_surface', 'my', 'ia32_emulation', '0'),
+                 KconfigCheck('cut_attack_surface', 'kspp', 'IA32_EMULATION', 'is not set'),
+                 AND(KconfigCheck('cut_attack_surface', 'my', 'IA32_EMULATION_DEFAULT_DISABLED', 'y'),
+                     CmdlineCheck('cut_attack_surface', 'my', 'ia32_emulation', 'is not set')))]
 
     # 'harden_userspace'
     l += [CmdlineCheck('harden_userspace', 'defconfig', 'norandmaps', 'is not set')]