From e2ed77e8af4fe965c0d3eb7aef64412ce55ef0f6 Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Tue, 24 Mar 2020 15:10:37 +0300 Subject: [PATCH] CLIP OS recommends disabling Intel TSX --- kconfig-hardened-check.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kconfig-hardened-check.py b/kconfig-hardened-check.py index b24918a..5df4997 100755 --- a/kconfig-hardened-check.py +++ b/kconfig-hardened-check.py @@ -29,6 +29,7 @@ # spec_store_bypass_disable=on # l1tf=full,force # mds=full,nosmt +# tsx=off # ARM64: # kpti=on # ssbd=force-on @@ -419,6 +420,8 @@ def construct_checklist(checklist, arch): checklist.append(OptCheck('BPF_SYSCALL', 'is not set', 'lockdown', 'cut_attack_surface')) # refers to LOCKDOWN checklist.append(OptCheck('MMIOTRACE_TEST', 'is not set', 'lockdown', 'cut_attack_surface')) # refers to LOCKDOWN + if arch == 'X86_64' or arch == 'X86_32': + checklist.append(OptCheck('X86_INTEL_TSX_MODE_OFF', 'y', 'clipos', 'cut_attack_surface')) # tsx=off checklist.append(OptCheck('STAGING', 'is not set', 'clipos', 'cut_attack_surface')) checklist.append(OptCheck('KSM', 'is not set', 'clipos', 'cut_attack_surface')) # to prevent FLUSH+RELOAD attack # checklist.append(OptCheck('IKCONFIG', 'is not set', 'clipos', 'cut_attack_surface')) # no, this info is needed for this check :) -- 2.31.1