From 0d751b9101e8eb16f08ae3ee4e9a91f360ea5779 Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Sat, 2 Dec 2023 13:04:30 +0300 Subject: [PATCH] Add the KFENCE_SAMPLE_INTERVAL check Thanks to @izh1979 for the idea --- kernel_hardening_checker/checks.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py index d95d301..9865929 100644 --- a/kernel_hardening_checker/checks.py +++ b/kernel_hardening_checker/checks.py @@ -117,9 +117,12 @@ def add_kconfig_checks(l, arch): l += [KconfigCheck('self_protection', 'kspp', 'DEBUG_CREDENTIALS', 'y')] l += [KconfigCheck('self_protection', 'kspp', 'DEBUG_NOTIFIERS', 'y')] l += [KconfigCheck('self_protection', 'kspp', 'INIT_ON_ALLOC_DEFAULT_ON', 'y')] - l += [KconfigCheck('self_protection', 'kspp', 'KFENCE', 'y')] l += [KconfigCheck('self_protection', 'kspp', 'HW_RANDOM_TPM', 'y')] l += [KconfigCheck('self_protection', 'kspp', 'STATIC_USERMODEHELPER', 'y')] # needs userspace support + kfence_is_set = KconfigCheck('self_protection', 'kspp', 'KFENCE', 'y') + l += [kfence_is_set] + l += [AND(KconfigCheck('self_protection', 'my', 'KFENCE_SAMPLE_INTERVAL', 'is not off'), + kfence_is_set)] randstruct_is_set = OR(KconfigCheck('self_protection', 'kspp', 'RANDSTRUCT_FULL', 'y'), KconfigCheck('self_protection', 'kspp', 'GCC_PLUGIN_RANDSTRUCT', 'y')) l += [randstruct_is_set] -- 2.31.1