From 61b5ca3c8f95212141284be8eb4036c8c1bda9e7 Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Thu, 5 Mar 2020 13:39:15 +0300 Subject: [PATCH] LDISC_AUTOLOAD can be disabled since v5.1 This fixes the false positive report about LDISC_AUTOLOAD for old kernels --- kconfig-hardened-check.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py index 47b4456..02bef29 100755 --- a/kconfig-hardened-check.py +++ b/kconfig-hardened-check.py @@ -411,7 +411,8 @@ def construct_checklist(checklist, arch): checklist.append(OptCheck('MAGIC_SYSRQ', 'is not set', 'clipos', 'cut_attack_surface')) checklist.append(OptCheck('KEXEC_FILE', 'is not set', 'clipos', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL (permissive) checklist.append(OptCheck('USER_NS', 'is not set', 'clipos', 'cut_attack_surface')) # user.max_user_namespaces=0 - checklist.append(OptCheck('LDISC_AUTOLOAD', 'is not set', 'clipos', 'cut_attack_surface')) + checklist.append(AND(OptCheck('LDISC_AUTOLOAD', 'is not set', 'clipos', 'cut_attack_surface'), \ + VerCheck((5, 1)))) # LDISC_AUTOLOAD can be disabled since v5.1 checklist.append(OptCheck('MMIOTRACE', 'is not set', 'my', 'cut_attack_surface')) # refers to LOCK_DOWN_KERNEL (permissive) checklist.append(OptCheck('LIVEPATCH', 'is not set', 'my', 'cut_attack_surface')) -- 2.31.1