From 0e0aa5f1516aeb4ffd9161d1d2c3479fe8caa39d Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Thu, 2 May 2024 12:32:58 +0300 Subject: [PATCH] Use CONFIG_LOCALVERSION instead of CONFIG_DEFAULT_INIT since it's older --- kernel_hardening_checker/checks.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py index 4b5dee6..feb36ee 100644 --- a/kernel_hardening_checker/checks.py +++ b/kernel_hardening_checker/checks.py @@ -663,8 +663,9 @@ def add_sysctl_checks(l, _arch): # Calling the SysctlCheck class constructor: # SysctlCheck(reason, decision, name, expected) - # use an omnipresent config symbol to see if we have a config file - have_config_file = KconfigCheck('-', '-', 'DEFAULT_INIT', 'is present') + # Use an omnipresent kconfig symbol to see if we have a kconfig file for checking + have_config_file = KconfigCheck('-', '-', 'LOCALVERSION', 'is present') + l += [OR(SysctlCheck('self_protection', 'kspp', 'net.core.bpf_jit_harden', '2'), AND(KconfigCheck('cut_attack_surface', 'kspp', 'BPF_JIT', 'is not set'), have_config_file))] -- 2.31.1