From e165289160f071b9e1016af366b2a0e3948566ad Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Thu, 22 Oct 2020 21:42:21 +0300 Subject: [PATCH] Add the recommendation about UBSAN_BOUNDS Enable UBSAN_BOUNDS and UBSAN_TRAP. But keep UBSAN_MISC disabled to avoid useless reports. --- kconfig_hardened_check/__init__.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py index 48f4019..1ca0530 100644 --- a/kconfig_hardened_check/__init__.py +++ b/kconfig_hardened_check/__init__.py @@ -395,6 +395,9 @@ def construct_checklist(l, arch): iommu_support_is_set)] # 'self_protection', 'my' + l += [AND(OptCheck('self_protection', 'my', 'UBSAN_BOUNDS', 'y'), + OptCheck('self_protection', 'my', 'UBSAN_MISC', 'is not set'), + OptCheck('self_protection', 'my', 'UBSAN_TRAP', 'y'))] l += [OptCheck('self_protection', 'my', 'SLUB_DEBUG_ON', 'y')] # TODO: is it better to set that via kernel cmd? l += [OptCheck('self_protection', 'my', 'RESET_ATTACK_MITIGATION', 'y')] # needs userspace support (systemd) if arch == 'X86_64': -- 2.31.1