From 40e47a79f1ea4f1e3f809a78e82aacd928bd4710 Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Sun, 11 Aug 2024 12:27:12 +0300 Subject: [PATCH] Reorder some checks --- kernel_hardening_checker/checks.py | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py index d0fd79e..6765588 100755 --- a/kernel_hardening_checker/checks.py +++ b/kernel_hardening_checker/checks.py @@ -337,6 +337,17 @@ def add_kconfig_checks(l: List[ChecklistObjType], arch: str) -> None: l += [OR(KconfigCheck('cut_attack_surface', 'kspp', 'STRICT_DEVMEM', 'y'), devmem_not_set)] # refers to LOCKDOWN + # 'cut_attack_surface', 'maintainer' + l += [KconfigCheck('cut_attack_surface', 'maintainer', 'DRM_LEGACY', 'is not set')] # recommended by Daniel Vetter in /issues/38 + l += [KconfigCheck('cut_attack_surface', 'maintainer', 'FB', 'is not set')] # recommended by Daniel Vetter in /issues/38 + l += [KconfigCheck('cut_attack_surface', 'maintainer', 'VT', 'is not set')] # recommended by Daniel Vetter in /issues/38 + l += [KconfigCheck('cut_attack_surface', 'maintainer', 'BLK_DEV_FD', 'is not set')] # recommended by Denis Efremov in /pull/54 + l += [KconfigCheck('cut_attack_surface', 'maintainer', 'BLK_DEV_FD_RAWCMD', 'is not set')] # recommended by Denis Efremov in /pull/62 + l += [KconfigCheck('cut_attack_surface', 'maintainer', 'NOUVEAU_LEGACY_CTX_SUPPORT', 'is not set')] + # recommended by Dave Airlie in kernel commit b30a43ac7132cdda + l += [KconfigCheck('cut_attack_surface', 'maintainer', 'N_GSM', 'is not set')] + # recommended by Greg KH at https://www.openwall.com/lists/oss-security/2024/04/17/1 + # 'cut_attack_surface', 'grsec' l += [KconfigCheck('cut_attack_surface', 'grsec', 'ZSMALLOC_STAT', 'is not set')] l += [KconfigCheck('cut_attack_surface', 'grsec', 'PAGE_OWNER', 'is not set')] @@ -378,17 +389,6 @@ def add_kconfig_checks(l: List[ChecklistObjType], arch: str) -> None: l += [AND(KconfigCheck('cut_attack_surface', 'grsec', 'PTDUMP_DEBUGFS', 'is not set'), KconfigCheck('cut_attack_surface', 'grsec', 'X86_PTDUMP', 'is not set'))] - # 'cut_attack_surface', 'maintainer' - l += [KconfigCheck('cut_attack_surface', 'maintainer', 'DRM_LEGACY', 'is not set')] # recommended by Daniel Vetter in /issues/38 - l += [KconfigCheck('cut_attack_surface', 'maintainer', 'FB', 'is not set')] # recommended by Daniel Vetter in /issues/38 - l += [KconfigCheck('cut_attack_surface', 'maintainer', 'VT', 'is not set')] # recommended by Daniel Vetter in /issues/38 - l += [KconfigCheck('cut_attack_surface', 'maintainer', 'BLK_DEV_FD', 'is not set')] # recommended by Denis Efremov in /pull/54 - l += [KconfigCheck('cut_attack_surface', 'maintainer', 'BLK_DEV_FD_RAWCMD', 'is not set')] # recommended by Denis Efremov in /pull/62 - l += [KconfigCheck('cut_attack_surface', 'maintainer', 'NOUVEAU_LEGACY_CTX_SUPPORT', 'is not set')] - # recommended by Dave Airlie in kernel commit b30a43ac7132cdda - l += [KconfigCheck('cut_attack_surface', 'maintainer', 'N_GSM', 'is not set')] - # recommended by Greg KH at https://www.openwall.com/lists/oss-security/2024/04/17/1 - # 'cut_attack_surface', 'clipos' l += [KconfigCheck('cut_attack_surface', 'clipos', 'STAGING', 'is not set')] l += [KconfigCheck('cut_attack_surface', 'clipos', 'KSM', 'is not set')] # to prevent FLUSH+RELOAD attack -- 2.31.1