From 78f559541028faaa02884f0fd9cc955fbbf4ca47 Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Sun, 2 Jun 2024 15:31:12 +0300 Subject: [PATCH 1/1] Add the new name of SPECULATION_MITIGATIONS Since Linux v6.9 it's called CONFIG_CPU_MITIGATIONS. Refers to #127, #117 --- kernel_hardening_checker/checks.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py index e03bd70..f9aad35 100644 --- a/kernel_hardening_checker/checks.py +++ b/kernel_hardening_checker/checks.py @@ -65,7 +65,6 @@ def add_kconfig_checks(l: List[ChecklistObjType], arch: str) -> None: if arch in ('X86_64', 'ARM64', 'ARM'): l += [vmap_stack_is_set] if arch in ('X86_64', 'X86_32'): - l += [KconfigCheck('self_protection', 'defconfig', 'SPECULATION_MITIGATIONS', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'DEBUG_WX', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'WERROR', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'X86_MCE', 'y')] @@ -88,6 +87,8 @@ def add_kconfig_checks(l: List[ChecklistObjType], arch: str) -> None: cpu_sup_intel_not_set)] l += [OR(KconfigCheck('self_protection', 'defconfig', 'X86_MCE_AMD', 'y'), cpu_sup_amd_not_set)] + l += [OR(KconfigCheck('self_protection', 'defconfig', 'CPU_MITIGATIONS', 'y'), + KconfigCheck('self_protection', 'defconfig', 'SPECULATION_MITIGATIONS', 'y'))] l += [OR(KconfigCheck('self_protection', 'defconfig', 'MITIGATION_RETPOLINE', 'y'), KconfigCheck('self_protection', 'defconfig', 'RETPOLINE', 'y'))] if arch in ('ARM64', 'ARM'): -- 2.31.1