From: Alexander Popov <alex.popov@linux.com>
Date: Mon, 3 Jun 2019 17:13:32 +0000 (+0300)
Subject: Add more details about STACKLEAK
X-Git-Tag: v0.5.2~21
X-Git-Url: https://jxself.org/git/?a=commitdiff_plain;h=e18ade0645ad4cca683281323d3469ea2bb89fa7;p=kconfig-hardened-check.git

Add more details about STACKLEAK

Refers to the issue #19 by @HacKurx
---

diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py
index c2d35c1..4c53b15 100755
--- a/kconfig-hardened-check.py
+++ b/kconfig-hardened-check.py
@@ -240,7 +240,12 @@ def construct_checklist(arch):
         checklist.append(OptCheck('DEFAULT_MMAP_MIN_ADDR',        '32768', 'kspp', 'self_protection'))
 
     if debug_mode or arch == 'X86_64' or arch == 'ARM64' or arch == 'X86_32':
-        checklist.append(OptCheck('GCC_PLUGIN_STACKLEAK',         'y', 'my', 'self_protection'))
+        stackleak_is_set = OptCheck('GCC_PLUGIN_STACKLEAK',       'y', 'my', 'self_protection')
+        checklist.append(stackleak_is_set)
+        checklist.append(AND(OptCheck('STACKLEAK_METRICS',        'is not set', 'my', 'self_protection'), \
+                             stackleak_is_set))
+        checklist.append(AND(OptCheck('STACKLEAK_RUNTIME_DISABLE','is not set', 'my', 'self_protection'), \
+                             stackleak_is_set))
     checklist.append(OptCheck('LOCK_DOWN_KERNEL',                 'y', 'my', 'self_protection')) # remember about LOCK_DOWN_MANDATORY
     checklist.append(OptCheck('SLUB_DEBUG_ON',                    'y', 'my', 'self_protection'))
     checklist.append(OptCheck('SECURITY_DMESG_RESTRICT',          'y', 'my', 'self_protection'))