From 4ed45348708b3e9e2f9e7d430a3b0cc67e01de50 Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Mon, 11 Jul 2022 08:59:37 +0300 Subject: [PATCH] Add vsyscall check --- kconfig_hardened_check/__init__.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kconfig_hardened_check/__init__.py b/kconfig_hardened_check/__init__.py index ddfc7af..30c9f3a 100644 --- a/kconfig_hardened_check/__init__.py +++ b/kconfig_hardened_check/__init__.py @@ -665,6 +665,12 @@ def add_cmdline_checks(l, arch): CmdlineCheck('self_protection', 'kspp', 'randomize_kstack_offset', 'is not set')))] if arch in ('X86_64', 'X86_32'): l += [CmdlineCheck('self_protection', 'kspp', 'pti', 'on')] + + if arch == 'X86_64': + l += [OR(CmdlineCheck('cut_attack_surface', 'kspp', 'vsyscall', 'none'), + AND(KconfigCheck('cut_attack_surface', 'kspp', 'LEGACY_VSYSCALL_NONE', 'y'), + CmdlineCheck('cut_attack_surface', 'kspp', 'vsyscall', 'is not set')))] + # TODO: add other -- 2.31.1