From 26ae3b02797f9494076e9cbb6f4a70abed5fb573 Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Mon, 4 Mar 2019 16:38:14 +0300 Subject: [PATCH] Fix false positive about CONFIG_MODULE_SIG_FORCE. CONFIG_MODULE_SIG_FORCE shouldn't be checked if CONFIG_MODULES is not set. Fixes issue #12. Thanks to @hannob. --- kconfig-hardened-check.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py index 3ed0f9e..a139697 100755 --- a/kconfig-hardened-check.py +++ b/kconfig-hardened-check.py @@ -187,7 +187,8 @@ def construct_checklist(arch): modules_not_set)) checklist.append(OR(OptCheck('MODULE_SIG_SHA512', 'y', 'kspp', 'self_protection'), \ modules_not_set)) - checklist.append(OptCheck('MODULE_SIG_FORCE', 'y', 'kspp', 'self_protection')) # refers to LOCK_DOWN_KERNEL + checklist.append(OR(OptCheck('MODULE_SIG_FORCE', 'y', 'kspp', 'self_protection'), \ + modules_not_set)) # refers to LOCK_DOWN_KERNEL if debug_mode or arch == 'X86_64' or arch == 'X86_32': checklist.append(OptCheck('DEFAULT_MMAP_MIN_ADDR', '65536', 'kspp', 'self_protection')) checklist.append(OptCheck('REFCOUNT_FULL', 'y', 'kspp', 'self_protection')) -- 2.31.1