From 3ccd5268b84cd2e27c0e56b4903439d8adbdaa2c Mon Sep 17 00:00:00 2001 From: jvoisin Date: Fri, 3 May 2024 15:43:43 +0200 Subject: [PATCH] Add a check for CONFIG_UNWIND_PATCH_PAC_INTO_SCS It allows to fallback to a shadow call stack on aarch64 if PAC isn't supported. --- kernel_hardening_checker/checks.py | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py index fa664e0..e0caab6 100644 --- a/kernel_hardening_checker/checks.py +++ b/kernel_hardening_checker/checks.py @@ -241,6 +241,7 @@ def add_kconfig_checks(l, arch): if arch == 'ARM64': l += [KconfigCheck('self_protection', 'kspp', 'ARM64_SW_TTBR0_PAN', 'y')] l += [KconfigCheck('self_protection', 'kspp', 'SHADOW_CALL_STACK', 'y')] + l += [KconfigCheck('self_protection', 'kspp', 'UNWIND_PATCH_PAC_INTO_SCS', 'y')] l += [KconfigCheck('self_protection', 'kspp', 'KASAN_HW_TAGS', 'y')] # see also: kasan=on, kasan.stacktrace=off, kasan.fault=panic if arch == 'X86_32': l += [KconfigCheck('self_protection', 'kspp', 'PAGE_TABLE_ISOLATION', 'y')] -- 2.31.1