From 98ccb216ebc61a231207830f0b6b37c8133d0d48 Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Mon, 4 Mar 2024 23:00:49 +0300 Subject: [PATCH] Add the ia32_emulation check Refers to #87 #112 --- kernel_hardening_checker/checks.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py index 635f0c1..b5ed925 100644 --- a/kernel_hardening_checker/checks.py +++ b/kernel_hardening_checker/checks.py @@ -570,6 +570,11 @@ def add_cmdline_checks(l, arch): # 'cut_attack_surface', 'my' l += [CmdlineCheck('cut_attack_surface', 'my', 'sysrq_always_enabled', 'is not set')] + if arch == 'X86_64': + l += [OR(CmdlineCheck('cut_attack_surface', 'my', 'ia32_emulation', '0'), + KconfigCheck('cut_attack_surface', 'kspp', 'IA32_EMULATION', 'is not set'), + AND(KconfigCheck('cut_attack_surface', 'my', 'IA32_EMULATION_DEFAULT_DISABLED', 'y'), + CmdlineCheck('cut_attack_surface', 'my', 'ia32_emulation', 'is not set')))] # 'harden_userspace' l += [CmdlineCheck('harden_userspace', 'defconfig', 'norandmaps', 'is not set')] -- 2.31.1