From d233ea52674067111a9f1ab8873282fc5f36699a Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Thu, 28 Dec 2023 14:58:11 +0300 Subject: [PATCH] Fix the arch for the CPU_SRSO check (it's available only for x86_64) --- kernel_hardening_checker/checks.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel_hardening_checker/checks.py b/kernel_hardening_checker/checks.py index 6f615ba..2bd54b2 100644 --- a/kernel_hardening_checker/checks.py +++ b/kernel_hardening_checker/checks.py @@ -67,7 +67,6 @@ def add_kconfig_checks(l, arch): l += [KconfigCheck('self_protection', 'defconfig', 'X86_MCE_INTEL', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'X86_MCE_AMD', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'RETPOLINE', 'y')] - l += [KconfigCheck('self_protection', 'defconfig', 'CPU_SRSO', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'SYN_COOKIES', 'y')] # another reason? microcode_is_set = KconfigCheck('self_protection', 'defconfig', 'MICROCODE', 'y') l += [microcode_is_set] # is needed for mitigating CPU bugs @@ -90,6 +89,7 @@ def add_kconfig_checks(l, arch): l += [KconfigCheck('self_protection', 'defconfig', 'PAGE_TABLE_ISOLATION', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'RANDOMIZE_MEMORY', 'y')] l += [KconfigCheck('self_protection', 'defconfig', 'X86_KERNEL_IBT', 'y')] + l += [KconfigCheck('self_protection', 'defconfig', 'CPU_SRSO', 'y')] l += [AND(KconfigCheck('self_protection', 'defconfig', 'INTEL_IOMMU', 'y'), iommu_support_is_set)] l += [AND(KconfigCheck('self_protection', 'defconfig', 'AMD_IOMMU', 'y'), -- 2.31.1