From 250cb52244d08493672adc142d60fe61514df02e Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Sat, 9 Dec 2023 22:25:38 +0300 Subject: [PATCH 1/1] Add the gather_data_sampling check --- kernel_hardening_checker/checks.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py index ff42ca7..5943e53 100644 --- a/kernel_hardening_checker/checks.py +++ b/kernel_hardening_checker/checks.py @@ -458,6 +458,9 @@ def add_cmdline_checks(l, arch): l += [OR(CmdlineCheck('self_protection', 'defconfig', 'spec_rstack_overflow', 'is not off'), AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'), CmdlineCheck('self_protection', 'defconfig', 'spec_rstack_overflow', 'is not set')))] + l += [OR(CmdlineCheck('self_protection', 'defconfig', 'gather_data_sampling', 'is not off'), + AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'), + CmdlineCheck('self_protection', 'defconfig', 'gather_data_sampling', 'is not set')))] if arch == 'ARM64': l += [OR(CmdlineCheck('self_protection', 'defconfig', 'kpti', 'is not off'), AND(CmdlineCheck('self_protection', 'kspp', 'mitigations', 'auto,nosmt'), @@ -575,6 +578,7 @@ no_kstrtobool_options = [ 'rodata', # See set_debug_rodata() in init/main.c 'ssbd', # See parse_spectre_v4_param() in arch/arm64/kernel/proton-pack.c 'spec_rstack_overflow', # See srso_parse_cmdline() in arch/x86/kernel/cpu/bugs.c + 'gather_data_sampling', # See gds_parse_cmdline() in arch/x86/kernel/cpu/bugs.c 'slub_debug', # See setup_slub_debug() in mm/slub.c 'iommu', # See iommu_setup() in arch/x86/kernel/pci-dma.c 'vsyscall', # See vsyscall_setup() in arch/x86/entry/vsyscall/vsyscall_64.c -- 2.31.1