From 8c502dcc4e05c5e0babb32067ce17d2811e50c96 Mon Sep 17 00:00:00 2001 From: Eneas U de Queiroz Date: Fri, 10 Nov 2023 15:21:19 -0300 Subject: [PATCH] Skip unprivileged_userfaultfd if USERFAULTFD unset Signed-off-by: Eneas U de Queiroz --- kernel_hardening_checker/checks.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py index 0e0f205..e2cf42e 100644 --- a/kernel_hardening_checker/checks.py +++ b/kernel_hardening_checker/checks.py @@ -682,7 +682,9 @@ def add_sysctl_checks(l, _arch): l += [SysctlCheck('cut_attack_surface', 'kspp', 'kernel.kptr_restrict', '2')] l += [OR(SysctlCheck('cut_attack_surface', 'kspp', 'dev.tty.legacy_tiocsti', '0'), SysctlCheck('cut_attack_surface', 'kspp', 'dev.tty.legacy_tiocsti', 'is not set'))] - l += [SysctlCheck('cut_attack_surface', 'kspp', 'vm.unprivileged_userfaultfd', '0')] + l += [OR(SysctlCheck('cut_attack_surface', 'kspp', 'vm.unprivileged_userfaultfd', '0'), + AND(KconfigCheck('cut_attack_surface', 'grsec', 'USERFAULTFD', 'is not set'), + have_config_file))] # At first, it disabled unprivileged userfaultfd, # and since v5.11 it enables unprivileged userfaultfd for user-mode only. -- 2.31.1