From 4dc94be8a5e0c3a0889679f7079aa93c7f44464d Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Mon, 30 Aug 2021 00:16:27 +0300 Subject: [PATCH] Add CFI_CLANG --- kconfig_hardened_check/__init__.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py index caedb97..c69380c 100644 --- a/kconfig_hardened_check/__init__.py +++ b/kconfig_hardened_check/__init__.py @@ -428,6 +428,10 @@ def construct_checklist(l, arch): if arch == 'ARM64': l += [OptCheck('self_protection', 'my', 'SHADOW_CALL_STACK', 'y')] # depends on clang, maybe it's alternative to STACKPROTECTOR_STRONG l += [OptCheck('self_protection', 'my', 'KASAN_HW_TAGS', 'y')] + cfi_clang_is_set = OptCheck('self_protection', 'my', 'CFI_CLANG', 'y') + l += [cfi_clang_is_set] + l += [AND(OptCheck('self_protection', 'my', 'CFI_PERMISSIVE', 'is not set'), + cfi_clang_is_set)] # 'security_policy' if arch in ('X86_64', 'ARM64', 'X86_32'): -- 2.31.1