From 7538ce443f7ba88804485fcfc148e37076066052 Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Sun, 16 Jun 2024 08:23:40 +0300 Subject: [PATCH] Add the "cfi" check --- kernel_hardening_checker/checks.py | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py index 42d9407..b84ecd6 100755 --- a/kernel_hardening_checker/checks.py +++ b/kernel_hardening_checker/checks.py @@ -534,6 +534,7 @@ def add_cmdline_checks(l: List[ChecklistObjType], arch: str) -> None: l += [CmdlineCheck('self_protection', 'kspp', 'slab_merge', 'is not set')] # consequence of 'slab_nomerge' by kspp l += [CmdlineCheck('self_protection', 'kspp', 'slub_merge', 'is not set')] # consequence of 'slab_nomerge' by kspp l += [CmdlineCheck('self_protection', 'kspp', 'page_alloc.shuffle', '1')] + l += [CmdlineCheck('self_protection', 'kspp', 'cfi', 'kcfi')] l += [OR(CmdlineCheck('self_protection', 'kspp', 'slab_nomerge', 'is present'), AND(KconfigCheck('self_protection', 'clipos', 'SLAB_MERGE_DEFAULT', 'is not set'), CmdlineCheck('self_protection', 'kspp', 'slab_merge', 'is not set'), -- 2.31.1