From 0341dcaab00a45a699f580ea2a712dab0e6475f7 Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Wed, 3 Jul 2024 16:38:13 +0300 Subject: [PATCH 1/1] Update the KFENCE_SAMPLE_INTERVAL check --- kernel_hardening_checker/checks.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py index c2440cf..b33e3d9 100755 --- a/kernel_hardening_checker/checks.py +++ b/kernel_hardening_checker/checks.py @@ -166,7 +166,7 @@ def add_kconfig_checks(l: List[ChecklistObjType], arch: str) -> None: vmap_stack_is_set)] kfence_is_set = KconfigCheck('self_protection', 'kspp', 'KFENCE', 'y') l += [kfence_is_set] - l += [AND(KconfigCheck('self_protection', 'kspp', 'KFENCE_SAMPLE_INTERVAL', 'is not off'), + l += [AND(KconfigCheck('self_protection', 'kspp', 'KFENCE_SAMPLE_INTERVAL', '100'), kfence_is_set)] randstruct_is_set = OR(KconfigCheck('self_protection', 'kspp', 'RANDSTRUCT_FULL', 'y'), KconfigCheck('self_protection', 'kspp', 'GCC_PLUGIN_RANDSTRUCT', 'y')) @@ -575,7 +575,7 @@ def add_cmdline_checks(l: List[ChecklistObjType], arch: str) -> None: # 'self_protection', 'a13xp0p0v' l += [OR(CmdlineCheck('self_protection', 'a13xp0p0v', 'kfence.sample_interval', 'is not off'), - AND(KconfigCheck('self_protection', 'a13xp0p0v', 'KFENCE_SAMPLE_INTERVAL', 'is not off'), + AND(KconfigCheck('self_protection', 'kspp', 'KFENCE_SAMPLE_INTERVAL', '100'), CmdlineCheck('self_protection', 'a13xp0p0v', 'kfence.sample_interval', 'is not set')))] # 'cut_attack_surface', 'defconfig' -- 2.31.1