From f0c9f888c46889f5313ee0ad683d56cd38f3b6b9 Mon Sep 17 00:00:00 2001 From: Alexander Popov Date: Mon, 10 Apr 2023 00:43:09 +0300 Subject: [PATCH] Add the LEGACY_TIOCSTI check --- kconfig_hardened_check/checks.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kconfig_hardened_check/checks.py b/kconfig_hardened_check/checks.py index d614736..af4c6e2 100644 --- a/kconfig_hardened_check/checks.py +++ b/kconfig_hardened_check/checks.py @@ -31,8 +31,9 @@ This module contains knowledge for checks. # fs.protected_regular=2 # fs.suid_dumpable=0 # kernel.modules_disabled=1 -# kernel.randomize_va_space = 2 +# kernel.randomize_va_space=2 # nosmt sysfs control file +# dev.tty.legacy_tiocsti=0 # # Think of these boot params: # module.sig_enforce=1 @@ -378,6 +379,7 @@ def add_kconfig_checks(l, arch): l += [bpf_syscall_not_set] # refers to LOCKDOWN # 'cut_attack_surface', 'my' + l += [KconfigCheck('cut_attack_surface', 'my', 'LEGACY_TIOCSTI', 'is not set')] l += [KconfigCheck('cut_attack_surface', 'my', 'MMIOTRACE', 'is not set')] # refers to LOCKDOWN (permissive) l += [KconfigCheck('cut_attack_surface', 'my', 'LIVEPATCH', 'is not set')] l += [KconfigCheck('cut_attack_surface', 'my', 'IP_DCCP', 'is not set')] -- 2.31.1