From 103bbe9258fdb6ec0b064bdc53aaf3ba31367de7 Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Fri, 16 Oct 2020 18:39:41 +0300 Subject: [PATCH] Add CLIP OS recommendation about EFI_CUSTOM_SSDT_OVERLAYS --- kconfig_hardened_check/__init__.py | 1 + 1 file changed, 1 insertion(+) diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py index 90f06b6..937b3a0 100644 --- a/kconfig_hardened_check/__init__.py +++ b/kconfig_hardened_check/__init__.py @@ -477,6 +477,7 @@ def construct_checklist(l, arch): l += [OptCheck('cut_attack_surface', 'clipos', 'IO_URING', 'is not set')] l += [OptCheck('cut_attack_surface', 'clipos', 'X86_IOPL_IOPERM', 'is not set')] # refers to LOCKDOWN l += [OptCheck('cut_attack_surface', 'clipos', 'ACPI_TABLE_UPGRADE', 'is not set')] # refers to LOCKDOWN + l += [OptCheck('cut_attack_surface', 'clipos', 'EFI_CUSTOM_SSDT_OVERLAYS', 'is not set')] l += [AND(OptCheck('cut_attack_surface', 'clipos', 'LDISC_AUTOLOAD', 'is not set'), PresenceCheck('LDISC_AUTOLOAD'))] if arch in ('X86_64', 'X86_32'): -- 2.31.1